From ab8b13c40215f478f311cdcb4d973a2b61b8edc5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 13 Dec 2024 12:28:31 +0100 Subject: [PATCH 01/82] crypto_campaign --- ...ccount_access_removal_via_quser_logoff.yml | 66 ++++++++++++++++ ...cated_files_or_information_via_rar_sfx.yml | 68 +++++++++++++++++ ...indows_remote_management_execute_shell.yml | 75 +++++++++++++++++++ 3 files changed, 209 insertions(+) create mode 100644 detections/endpoint/windows_account_access_removal_via_quser_logoff.yml create mode 100644 detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml create mode 100644 detections/endpoint/windows_remote_management_execute_shell.yml diff --git a/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml b/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml new file mode 100644 index 0000000000..f942569055 --- /dev/null +++ b/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml @@ -0,0 +1,66 @@ +name: 'Windows Account Access Removal via Quser LogOff' +id: 6d70780d-4cfe-4820-bafd-1b43941986b5 +version: 1 +date: '2024-12-12' +author: Teoderick Contreras, Splunk +data_sources: +- Powershell Script Block Logging 4104 +type: TTP +status: production +description: The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation. +kind: endpoint +search: '`powershell` EventCode=4104 ScriptBlockText = "*quser*" ScriptBlockText = "*logoff*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText UserID Computer + | rename Computer as dest, UserID as user + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_account_access_removal_via_quser_logoff_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command. +references: +- https://devblogs.microsoft.com/scripting/automating-quser-through-powershell/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: Endpoint + confidence: 70 + impact: 70 + message: Powershell process having commandline [$ScriptBlockText$] used to logoff user on [$dest$]. + mitre_attack_id: + - T1531 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - dest + - user + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://github.com/splunk/contentctl/wiki + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml new file mode 100644 index 0000000000..9852179d8a --- /dev/null +++ b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml @@ -0,0 +1,68 @@ +name: Windows Obfuscated Files or Information via RAR SFX +id: 4ab6862b-ce88-4223-96c0-f6da2cffb898 +version: 1 +date: '2024-12-12' +author: Teoderick Contreras, Splunk +data_sources: +- Sysmon Event ID 11 +type: TTP +status: production +description: The following analytic detects the creation of RAR Self-Extracting (SFX) files by monitoring the generation of file related to rar sfx installation. This method leverages a heuristic to identify RAR SFX archives based on specific markers that indicate a combination of executable code and compressed RAR data. By tracking such activity, the analytic helps pinpoint potentially unauthorized or suspicious file creation events, which are often associated with malware packaging or data exfiltration. Legitimate usage may include custom installers or compressed file delivery. +kind: endpoint +search: '`sysmon` EventCode=11 Image="*.exe" TargetFilename IN ("*__tmp_rar_sfx_access_check*") + | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename Computer + | rename Computer as dest + | rename TargetFilename as file_name + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_obfuscated_files_or_information_via_rar_sfx_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, TargetFilename, and eventcode 11 executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where rar sfx executable may be used. +known_false_positives: It can detect a third part utility software tool compiled to rar sfx. +references: +- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A process commandline- [$Image$] that drops [$file_name$] on [$dest$]. + mitre_attack_id: + - T1027.013 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - process_name + - file_name + - process_guid + - dest + - user_id + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://github.com/splunk/contentctl/wiki + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_management_execute_shell.yml b/detections/endpoint/windows_remote_management_execute_shell.yml new file mode 100644 index 0000000000..2fcb2a13fe --- /dev/null +++ b/detections/endpoint/windows_remote_management_execute_shell.yml @@ -0,0 +1,75 @@ +name: Windows Remote Management Execute Shell +id: 28b80028-851d-4b8d-88a5-375ba115418a +version: 1 +date: '2024-12-12' +author: Teoderick Contreras, Splunk +data_sources: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +type: Anomaly +status: production +description: The following analytic detects the execution of winrshost.exe initiating CMD or PowerShell processes as part of a potential payload execution. winrshost.exe is associated with Windows Remote Management (WinRM) and is typically used for remote execution. By monitoring for this behavior, the detection identifies instances where winrshost.exe is leveraged to run potentially malicious commands or payloads via CMD or PowerShell. This behavior may indicate exploitation of remote management tools for unauthorized access or lateral movement within a compromised environment, signaling a potential security incident. +kind: endpoint +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name="winrshost.exe" AND Processes.process_name IN ("cmd.exe","*powershell*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_remote_management_execute_shell_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: administrator or power user can execute command shell or script remotely using WINRM. +references: +- https://strontic.github.io/xcyclopedia/library/winrshost.exe-6790044CEB4BA5BE6AA8161460D990FD.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: Endpoint + confidence: 30 + impact: 30 + message: a winrm remote proces [$parent_process_name$] execute [$process_name$] shell on [$dest$]. + mitre_attack_id: + - T1021.006 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 9 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://github.com/splunk/contentctl/wiki + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog From 6fc84d916acf38cda009144cc1a3adc2317b723f Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 17 Dec 2024 11:33:34 +0100 Subject: [PATCH 02/82] crypto_campaign --- .../add_or_set_windows_defender_exclusion.yml | 15 +-- .../endpoint/any_powershell_downloadfile.yml | 56 +++++++--- .../attempt_to_stop_security_service.yml | 55 ++++++++-- .../endpoint/chcp_command_execution.yml | 47 ++++++-- ...cmd_carry_out_string_command_parameter.yml | 66 +++++++---- ...password_spray_attack_behavior_on_user.yml | 45 ++++++-- .../endpoint/detect_rare_executables.yml | 43 ++++++-- .../download_files_using_telegram.yml | 36 ++++-- .../excessive_service_stop_attempt.yml | 45 ++++++-- .../endpoint/excessive_usage_of_cacls_app.yml | 46 ++++++-- .../excessive_usage_of_sc_service_utility.yml | 38 +++++-- .../endpoint/excessive_usage_of_taskkill.yml | 45 ++++++-- ..._or_script_creation_in_suspicious_path.yml | 103 +++++++++++------- ..._files_and_directories_with_attrib_exe.yml | 7 +- .../high_process_termination_frequency.yml | 38 +++++-- detections/endpoint/icacls_deny_command.yml | 7 +- detections/endpoint/icacls_grant_command.yml | 51 +++++++-- ...s_powershell_process___encoded_command.yml | 47 ++++++-- ...dify_acl_permission_to_files_or_folder.yml | 40 ++++++- ...mission_modification_using_takeown_app.yml | 46 ++++++-- .../sc_exe_manipulating_windows_services.yml | 55 +++++++--- .../endpoint/suspicious_process_file_path.yml | 102 +++++++++++------ ...s_scheduled_task_from_public_directory.yml | 58 +++++++--- ...ccount_access_removal_via_quser_logoff.yml | 2 +- .../endpoint/windows_autoit3_execution.yml | 46 ++++++-- ..._autostart_execution_in_startup_folder.yml | 36 ++++-- ...s_disable_or_modify_tools_via_taskkill.yml | 44 ++++++-- ...cated_files_or_information_via_rar_sfx.yml | 2 +- ...indows_remote_management_execute_shell.yml | 2 +- .../windows_screen_capture_in_temp_folder.yml | 32 ++++-- ...e_created_with_suspicious_service_path.yml | 49 ++++++--- ..._service_creation_using_registry_entry.yml | 35 ++++-- .../windows_service_deletion_in_registry.yml | 40 +++++-- .../windows_service_stop_by_deletion.yml | 45 ++++++-- ...rvice_stop_via_net__and_sc_application.yml | 41 +++++-- .../endpoint/windows_system_file_on_disk.yml | 28 ++++- ...indows_system_user_discovery_via_quser.yml | 37 +++++-- detections/endpoint/xmrig_driver_loaded.yml | 32 ++++-- stories/crypto_stealer.yml | 17 +++ 39 files changed, 1192 insertions(+), 387 deletions(-) create mode 100644 stories/crypto_stealer.yml diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index 38269fe035..4f89eb2be5 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -1,7 +1,7 @@ name: Add or Set Windows Defender Exclusion id: 773b66fe-4dd9-11ec-8289-acde48001122 -version: '5' -date: '2024-11-28' +version: '6' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -55,14 +55,15 @@ drilldown_searches: latest_offset: $info_max_time$ tags: analytic_story: - - WhisperGate - - Windows Defense Evasion Tactics + - CISA AA22-320A + - AgentTesla - Remcos - Data Destruction - - CISA AA22-320A - - ValleyRAT - Compromised Windows Host - - AgentTesla + - ValleyRAT + - Windows Defense Evasion Tactics + - WhisperGate + - Crypto Stealer asset_type: Endpoint confidence: 80 impact: 80 diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 728aa2b257..c39831de5a 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -1,18 +1,40 @@ name: Any Powershell DownloadFile id: 1a93b7ea-7af7-11eb-adb5-acde48001122 -version: 7 -date: '2024-09-30' +version: '8' +date: '2024-12-17' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects the use of PowerShell's `DownloadFile` method to download files. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant as it is commonly used in malicious frameworks to download and execute additional payloads. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the system. Analysts should investigate the source and destination of the download and review AMSI or PowerShell transaction logs for additional context. +description: The following analytic detects the use of PowerShell's `DownloadFile` + method to download files. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process execution logs. This activity is significant as + it is commonly used in malicious frameworks to download and execute additional payloads. + If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, + or further compromise of the system. Analysts should investigate the source and + destination of the download and review AMSI or PowerShell transaction logs for additional + context. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*DownloadFile* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadfile_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_powershell` Processes.process=*DownloadFile* + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.parent_process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `any_powershell_downloadfile_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positives may be present and filtering will need to occur + by parent process or command line argument. It may be required to modify this query + to an EDR product for more granular coverage. references: - https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 - https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ @@ -23,26 +45,34 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - DarkCrystal RAT - - Ingress Tool Transfer - Hermetic Wiper - - Malicious PowerShell - - Data Destruction - Log4Shell CVE-2021-44228 - Phemedrone Stealer - - Braodo Stealer + - Data Destruction - PXA Stealer + - Ingress Tool Transfer + - Malicious PowerShell + - DarkCrystal RAT + - Crypto Stealer + - Braodo Stealer asset_type: Endpoint confidence: 70 cve: - CVE-2021-44228 impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile + within PowerShell. mitre_attack_id: - T1059 - T1059.001 diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index a84ecb6ecc..3f924af863 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -1,18 +1,42 @@ name: Attempt To Stop Security Service id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 -version: 7 -date: '2024-09-30' +version: '8' +date: '2024-12-17' author: Rico Valdez, Splunk status: production type: TTP -description: The following analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for processes involving the "sc.exe" command with the "stop" parameter. This activity is significant because disabling security services can undermine the organization's security posture, potentially leading to unauthorized access, data exfiltration, or further attacks like malware installation or privilege escalation. If confirmed malicious, this behavior could compromise the endpoint and the entire network, necessitating immediate investigation and response. +description: The following analytic detects attempts to stop security-related services + on an endpoint, which may indicate malicious activity. It leverages data from Endpoint + Detection and Response (EDR) agents, specifically searching for processes involving + the "sc.exe" command with the "stop" parameter. This activity is significant because + disabling security services can undermine the organization's security posture, potentially + leading to unauthorized access, data exfiltration, or further attacks like malware + installation or privilege escalation. If confirmed malicious, this behavior could + compromise the endpoint and the entire network, necessitating immediate investigation + and response. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: None identified. Attempts to disable security-related services should be identified and understood. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop + *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` |lookup security_services_lookup service as + process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: None identified. Attempts to disable security-related services + should be identified and understood. references: - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ @@ -22,21 +46,28 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - WhisperGate - - Graceful Wipe Out Attack - - Disabling Security Tools - - Data Destruction - Azorult + - Data Destruction + - Disabling Security Tools - Trickbot + - Graceful Wipe Out Attack + - WhisperGate + - Crypto Stealer asset_type: Endpoint confidence: 50 impact: 40 - message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to disable security services on endpoint $dest$ by user $user$. mitre_attack_id: - T1562.001 - T1562 diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index 2e3fc9984c..d5a4427eba 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -1,18 +1,40 @@ name: CHCP Command Execution id: 21d236ec-eec1-11eb-b23e-acde48001122 -version: 3 -date: '2024-09-30' +version: '4' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the execution of the chcp.exe application, which is used to change the active code page of the console. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where chcp.exe is executed by cmd.exe with specific command-line arguments. This activity is significant because it can indicate the presence of malware, such as IcedID, which uses this technique to determine the locale region, language, or country of the compromised host. If confirmed malicious, this could lead to further system compromise and data exfiltration. +description: The following analytic detects the execution of the chcp.exe application, + which is used to change the active code page of the console. This detection leverages + data from Endpoint Detection and Response (EDR) agents, focusing on process creation + events where chcp.exe is executed by cmd.exe with specific command-line arguments. + This activity is significant because it can indicate the presence of malware, such + as IcedID, which uses this technique to determine the locale region, language, or + country of the compromised host. If confirmed malicious, this could lead to further + system compromise and data exfiltration. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*) by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.process_id Processes.parent_process_id Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `chcp_command_execution_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: other tools or script may used this to change code page to UTF-* or others +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=chcp.com + Processes.parent_process_name = cmd.exe (Processes.parent_process=*/c* OR Processes.parent_process=*/k*) + by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process + Processes.process_id Processes.parent_process_id Processes.dest Processes.user | + `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `chcp_command_execution_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: other tools or script may used this to change code page to + UTF-* or others references: - https://ss64.com/nt/chcp.html - https://twitter.com/tccontre18/status/1419941156633329665?s=20 @@ -22,18 +44,25 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - IcedID - Azorult - Forest Blizzard + - Crypto Stealer + - IcedID asset_type: Endpoint confidence: 30 impact: 30 - message: parent process $parent_process_name$ spawning chcp process $process_name$ with parent command line $parent_process$ + message: parent process $parent_process_name$ spawning chcp process $process_name$ + with parent command line $parent_process$ mitre_attack_id: - T1059 observable: diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index f61bc4534d..05569333b5 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -1,50 +1,72 @@ name: CMD Carry Out String Command Parameter id: 54a6ed00-3256-11ec-b031-acde48001122 -version: 6 -date: '2024-10-17' +version: '7' +date: '2024-12-17' author: Teoderick Contreras, Bhavin Patel, Splunk status: production type: Hunting -description: The following analytic detects the use of `cmd.exe /c` to execute commands, a technique often employed by adversaries and malware to run batch commands or invoke other shells like PowerShell. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. Monitoring this activity is crucial as it can indicate script-based attacks or unauthorized command execution. If confirmed malicious, this behavior could lead to unauthorized code execution, privilege escalation, or persistence within the environment. +description: The following analytic detects the use of `cmd.exe /c` to execute commands, + a technique often employed by adversaries and malware to run batch commands or invoke + other shells like PowerShell. This detection leverages data from Endpoint Detection + and Response (EDR) agents, focusing on command-line executions and process metadata. + Monitoring this activity is crucial as it can indicate script-based attacks or unauthorized + command execution. If confirmed malicious, this behavior could lead to unauthorized + code execution, privilege escalation, or persistence within the environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="* /c*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_carry_out_string_command_parameter_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives may be high based on legitimate scripted code in any environment. Filter as needed. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_cmd` AND Processes.process="* + /c*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `cmd_carry_out_string_command_parameter_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positives may be high based on legitimate scripted code + in any environment. Filter as needed. references: - https://thedfirreport.com/2021/10/18/icedid-to-xinglocker-ransomware-in-24-hours/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ tags: analytic_story: - - AsyncRAT - - Winter Vivern - - WhisperGate - - Living Off The Land + - Data Destruction - DarkGate Malware - - ProxyNotShell - - Log4Shell CVE-2021-44228 - - NjRAT - - RedLine Stealer - - Rhysida Ransomware - - IcedID - Chaos Ransomware - - PlugX - - Azorult - - Qakbot - Hermetic Wiper - Warzone RAT - - DarkCrystal RAT + - Winter Vivern + - ProxyNotShell + - IcedID + - Living Off The Land + - NjRAT + - Log4Shell CVE-2021-44228 - CISA AA23-347A - - Data Destruction + - AsyncRAT + - Rhysida Ransomware + - DarkCrystal RAT + - Crypto Stealer + - Azorult + - Qakbot + - RedLine Stealer + - PlugX + - WhisperGate asset_type: Endpoint automated_detection_testing: passed confidence: 50 cve: - CVE-2021-44228 impact: 60 - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting spawn a new process. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting spawn a new process. mitre_attack_id: - T1059.003 - T1059 diff --git a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml index a191014ffd..a8226968c8 100644 --- a/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml +++ b/detections/endpoint/detect_password_spray_attack_behavior_on_user.yml @@ -1,16 +1,37 @@ name: Detect Password Spray Attack Behavior On User id: a7539705-7183-4a12-9b6a-b6eef645a6d7 -version: 2 -date: '2024-09-30' +version: '3' +date: '2024-12-17' author: Steven Dick status: production type: TTP -description: The following analytic identifies any user failing to authenticate from 10 or more unique sources. This behavior could represent an adversary performing a Password Spraying attack to obtain initial access or elevate privileges. This logic can be used for real time security monitoring as well as threat hunting exercises. Environments can be very different depending on the organization. Test and customize this detections thresholds as needed +description: The following analytic identifies any user failing to authenticate from + 10 or more unique sources. This behavior could represent an adversary performing + a Password Spraying attack to obtain initial access or elevate privileges. This + logic can be used for real time security monitoring as well as threat hunting exercises. + Environments can be very different depending on the organization. Test and customize + this detections thresholds as needed data_source: - Authentication Events (various) -search: '| tstats `security_content_summariesonly` max(_time) as lastTime, min(_time) as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication where * by Authentication.action,Authentication.src,Authentication.user | `drop_dm_object_name("Authentication")` | eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), success=if(action="success",count,0), src=upper(src), success_src=if(action="success",src,null), failure=if(action="failure",count,0), failed_src=if(action="failure",src,null) | `detect_password_spray_attack_behavior_on_user_filter` | stats count min(firstTime) as firstTime max(lastTime) as lastTime values(app) as app values(src_category) as src_category values(success_src) as src values(failed_src) as failed_src dc(success_src) as success_dc dc(failed_src) as failed_dc dc(src) as src_dc, sum(failure) as failure, sum(success) as success by user | fields - _time | where src_dc >= 10 AND .25 > (success/failure) AND failed_dc > success_dc | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' -how_to_implement: This detection requires ingesting authentication data to the appropriate accelerated datamodel. Recommend adjusting the search time window for this correlation to match the number of unique users (user_dc) in hours. i.e. 10 users over 10hrs -known_false_positives: Domain controllers, authentication chokepoints, and vulnerability scanners. +search: '| tstats `security_content_summariesonly` max(_time) as lastTime, min(_time) + as firstTime, values(Authentication.user_category) as user_category values(Authentication.src_category) + as src_category values(Authentication.app) as app count from datamodel=Authentication.Authentication + where * by Authentication.action,Authentication.src,Authentication.user | `drop_dm_object_name("Authentication")` + | eval user=case((match(upper(user),"[a-zA-Z0-9]{3}")),upper(user),true(),null), + success=if(action="success",count,0), src=upper(src), success_src=if(action="success",src,null), + failure=if(action="failure",count,0), failed_src=if(action="failure",src,null) | + `detect_password_spray_attack_behavior_on_user_filter` | stats count min(firstTime) + as firstTime max(lastTime) as lastTime values(app) as app values(src_category) as + src_category values(success_src) as src values(failed_src) as failed_src dc(success_src) + as success_dc dc(failed_src) as failed_dc dc(src) as src_dc, sum(failure) as failure, + sum(success) as success by user | fields - _time | where src_dc >= 10 AND .25 > + (success/failure) AND failed_dc > success_dc | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' +how_to_implement: This detection requires ingesting authentication data to the appropriate + accelerated datamodel. Recommend adjusting the search time window for this correlation + to match the number of unique users (user_dc) in hours. i.e. 10 users over 10hrs +known_false_positives: Domain controllers, authentication chokepoints, and vulnerability + scanners. references: - https://attack.mitre.org/techniques/T1110/003/ - https://www.microsoft.com/en-us/security/blog/2020/04/23/protecting-organization-password-spray-attacks/ @@ -21,16 +42,24 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$src$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - Compromised User Account + - Crypto Stealer asset_type: Account confidence: 75 impact: 80 - message: A total of $src_dc$ distinct sources attempted to access the account [$user$], $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins detected. + message: A total of $src_dc$ distinct sources attempted to access the account [$user$], + $count$ times between [$firstTime$] and [$lastTime$]. $success$ successful logins + detected. mitre_attack_id: - T1110.003 - T1110 diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml index 8c752373bf..547df9f00b 100644 --- a/detections/endpoint/detect_rare_executables.yml +++ b/detections/endpoint/detect_rare_executables.yml @@ -1,18 +1,38 @@ name: Detect Rare Executables id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac -version: 6 -date: '2024-09-30' +version: '7' +date: '2024-12-17' author: Bhavin Patel, Splunk status: production type: Anomaly -description: The following analytic detects the execution of rare processes that appear only once across the network within a specified timeframe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant for a SOC as it helps identify potentially malicious activities or unauthorized software, which could indicate a security breach or ongoing attack. If confirmed malicious, such rare processes could lead to data theft, privilege escalation, or complete system compromise, making early detection crucial for minimizing impact. +description: The following analytic detects the execution of rare processes that appear + only once across the network within a specified timeframe. It leverages data from + Endpoint Detection and Response (EDR) agents, focusing on process execution logs. + This activity is significant for a SOC as it helps identify potentially malicious + activities or unauthorized software, which could indicate a security breach or ongoing + attack. If confirmed malicious, such rare processes could lead to data theft, privilege + escalation, or complete system compromise, making early detection crucial for minimizing + impact. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` dc(Processes.dest) as dc_dest values(Processes.dest) as dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name | `drop_dm_object_name(Processes)` | search dc_dest < 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rare_executables_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Some legitimate processes may be only rarely executed in your environment. +search: '| tstats `security_content_summariesonly` dc(Processes.dest) as dc_dest values(Processes.dest) + as dest values(Processes.user) as user min(_time) as firstTime max(_time) as lastTime + from datamodel=Endpoint.Processes by Processes.process_name | `drop_dm_object_name(Processes)` + | search dc_dest < 10 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_rare_executables_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Some legitimate processes may be only rarely executed in your + environment. references: [] drilldown_searches: - name: View the detection results for - "$dest$" @@ -20,17 +40,24 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - Unusual Processes - Rhysida Ransomware + - Crypto Stealer asset_type: Endpoint confidence: 50 impact: 50 - message: A rare process - [$process_name$] has been detected on less than 10 hosts in your environment. + message: A rare process - [$process_name$] has been detected on less than 10 hosts + in your environment. mitre_attack_id: - T1204 observable: diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index 32643a7bbd..279deb8cd0 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -1,16 +1,30 @@ name: Download Files Using Telegram id: 58194e28-ae5e-11eb-8912-acde48001122 -version: 3 -date: '2024-09-30' +version: '4' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious file downloads by the Telegram application on a Windows system. It leverages Sysmon EventCode 15 to identify instances where Telegram.exe creates files with a Zone.Identifier, indicating a download. This activity is significant as it may indicate an adversary using Telegram to download malicious tools, such as network scanners, for further exploitation. If confirmed malicious, this behavior could lead to network mapping, lateral movement, and potential compromise of additional systems within the network. +description: The following analytic detects suspicious file downloads by the Telegram + application on a Windows system. It leverages Sysmon EventCode 15 to identify instances + where Telegram.exe creates files with a Zone.Identifier, indicating a download. + This activity is significant as it may indicate an adversary using Telegram to download + malicious tools, such as network scanners, for further exploitation. If confirmed + malicious, this behavior could lead to network mapping, lateral movement, and potential + compromise of additional systems within the network. data_source: - Sysmon EventID 15 -search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" |stats count min(_time) as firstTime max(_time) as lastTime by dest EventCode process_name process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `download_files_using_telegram_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and TargetFilename from your endpoints or Events that monitor filestream events which is happened when process download something. (EventCode 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: normal download of file in telegram app. (if it was a common app in network) +search: '`sysmon` EventCode= 15 process_name = "telegram.exe" TargetFilename = "*:Zone.Identifier" + |stats count min(_time) as firstTime max(_time) as lastTime by dest EventCode process_name + process_id TargetFilename Hash | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `download_files_using_telegram_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and TargetFilename from your endpoints or Events that + monitor filestream events which is happened when process download something. (EventCode + 15) If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon + TA. +known_false_positives: normal download of file in telegram app. (if it was a common + app in network) references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ drilldown_searches: @@ -19,14 +33,20 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - XMRig - Phemedrone Stealer + - Crypto Stealer - Snake Keylogger + - XMRig asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 90dcb51e91..d8a67122f8 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -1,17 +1,39 @@ name: Excessive Service Stop Attempt id: ae8d3f4a-acd7-11eb-8846-acde48001122 -version: 5 -date: '2024-09-30' +version: '6' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects multiple attempts to stop or delete services on a system using `net.exe`, `sc.exe`, or `net1.exe`. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window. This activity is significant as it may indicate an adversary attempting to disable security or critical services to evade detection and further their objectives. If confirmed malicious, this could lead to the attacker gaining persistence, escalating privileges, or disrupting essential services, thereby compromising the system's security posture. +description: The following analytic detects multiple attempts to stop or delete services + on a system using `net.exe`, `sc.exe`, or `net1.exe`. It leverages Endpoint Detection + and Response (EDR) telemetry, focusing on process names and command-line executions + within a one-minute window. This activity is significant as it may indicate an adversary + attempting to disable security or critical services to evade detection and further + their objectives. If confirmed malicious, this could lead to the attacker gaining + persistence, escalating privileges, or disrupting essential services, thereby compromising + the system's security posture. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name + = "sc.exe" OR Processes.process_name = "net1.exe" AND Processes.process="*stop*" + OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name + Processes.parent_process_name Processes.dest Processes.user _time span=1m | where + count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: unknown references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -21,18 +43,25 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - XMRig - Ransomware - BlackByte Ransomware + - Crypto Stealer + - XMRig asset_type: Endpoint confidence: 100 impact: 80 - message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. + message: An excessive amount of $process_name$ was executed on $dest$ attempting + to disable services. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index c68c383ee9..36bdf29052 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -1,18 +1,39 @@ name: Excessive Usage Of Cacls App id: 0bdf6092-af17-11eb-939a-acde48001122 -version: 4 -date: '2024-09-30' +version: '5' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`, or `icacls.exe` to change file or folder permissions. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an adversary attempting to restrict access to malware components or artifacts on a compromised system. If confirmed malicious, this behavior could prevent users from deleting or accessing critical files, aiding in the persistence and concealment of malicious activities. +description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`, + or `icacls.exe` to change file or folder permissions. It leverages data from Endpoint + Detection and Response (EDR) agents, focusing on process names and command-line + executions. This activity is significant as it may indicate an adversary attempting + to restrict access to malware components or artifacts on a compromised system. If + confirmed malicious, this behavior could prevent users from deleting or accessing + critical files, aiding in the persistence and concealment of malicious activities. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id values(Processes.process_name) as process_name count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id values(Processes.process_name) as process_name + count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" + OR Processes.process_name = "XCACLS.exe" by Processes.parent_process_name Processes.parent_process + Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_cacls_app_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. + Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ drilldown_searches: @@ -21,19 +42,26 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - XMRig - Azorult - Windows Post-Exploitation - Prestige Ransomware + - XMRig + - Crypto Stealer asset_type: Endpoint confidence: 100 impact: 80 - message: An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. + message: An excessive amount of $process_name$ was executed on $dest$ attempting + to modify permissions. mitre_attack_id: - T1222 observable: diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 331e4ae543..f81eb1785e 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -1,18 +1,34 @@ name: Excessive Usage Of SC Service Utility id: cb6b339e-d4c6-11eb-a026-acde48001122 -version: 3 -date: '2024-09-30' +version: '4' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects excessive usage of the `sc.exe` service utility on a host machine. It leverages Sysmon EventCode 1 logs to identify instances where `sc.exe` is executed more frequently than normal within a 15-minute window. This behavior is significant as it is commonly associated with ransomware, cryptocurrency miners, and other malware attempting to create, modify, delete, or disable services, potentially related to security applications or for privilege escalation. If confirmed malicious, this activity could allow attackers to manipulate critical services, leading to system compromise or disruption of security defenses. +description: The following analytic detects excessive usage of the `sc.exe` service + utility on a host machine. It leverages Sysmon EventCode 1 logs to identify instances + where `sc.exe` is executed more frequently than normal within a 15-minute window. + This behavior is significant as it is commonly associated with ransomware, cryptocurrency + miners, and other malware attempting to create, modify, delete, or disable services, + potentially related to security applications or for privilege escalation. If confirmed + malicious, this activity could allow attackers to manipulate critical services, + leading to system compromise or disruption of security defenses. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m | stats values(process) as process count as numScExe by dest, _time | eventstats avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by dest | eval upperThreshold=(avgScExe + stdScExe *3) | eval isOutlier=if(avgScExe > 5 and avgScExe >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. -known_false_positives: excessive execution of sc.exe is quite suspicious since it can modify or execute app in high privilege permission. +search: '`sysmon` EventCode = 1 process_name = "sc.exe" | bucket _time span=15m | + stats values(process) as process count as numScExe by dest, _time | eventstats + avg(numScExe) as avgScExe, stdev(numScExe) as stdScExe, count as numSlots by dest + | eval upperThreshold=(avgScExe + stdScExe *3) | eval isOutlier=if(avgScExe > + 5 and avgScExe >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_sc_service_utility_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed taskkill.exe may be used. +known_false_positives: excessive execution of sc.exe is quite suspicious since it + can modify or execute app in high privilege permission. references: - https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/ drilldown_searches: @@ -21,13 +37,19 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - Ransomware - Azorult + - Ransomware + - Crypto Stealer asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index d84d915514..917a20b309 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -1,17 +1,37 @@ name: Excessive Usage Of Taskkill id: fe5bca48-accb-11eb-a67c-acde48001122 -version: 4 -date: '2024-09-30' +version: '5' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies excessive usage of `taskkill.exe`, a command-line utility used to terminate processes. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on instances where `taskkill.exe` is executed ten or more times within a one-minute span. This behavior is significant as adversaries often use `taskkill.exe` to disable security tools or other critical processes to evade detection. If confirmed malicious, this activity could allow attackers to bypass security defenses, maintain persistence, and further compromise the system. +description: The following analytic identifies excessive usage of `taskkill.exe`, + a command-line utility used to terminate processes. The detection leverages data + from Endpoint Detection and Response (EDR) agents, focusing on instances where `taskkill.exe` + is executed ten or more times within a one-minute span. This behavior is significant + as adversaries often use `taskkill.exe` to disable security tools or other critical + processes to evade detection. If confirmed malicious, this activity could allow + attackers to bypass security defenses, maintain persistence, and further compromise + the system. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" by Processes.parent_process_name Processes.process_name Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" by + Processes.parent_process_name Processes.process_name Processes.dest Processes.user + _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_taskkill_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: Unknown. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -22,21 +42,28 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - XMRig - Azorult - - CISA AA22-264A - AgentTesla - CISA AA22-277A - NjRAT + - CISA AA22-264A + - XMRig + - Crypto Stealer asset_type: Endpoint confidence: 70 impact: 40 - message: Excessive usage of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. + message: Excessive usage of taskkill.exe with process id $process_id$ (more than + 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. mitre_attack_id: - T1562.001 - T1562 diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 75d4463450..59a2e517d2 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,23 +1,35 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 5 -date: '2024-11-28' +version: '6' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat. +description: The following analytic identifies the creation of executables or scripts + in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem + data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created + in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is + significant as adversaries often use these paths to evade detection and maintain + persistence. If confirmed malicious, this behavior could allow attackers to execute + unauthorized code, escalate privileges, or persist within the environment, posing + a significant security threat. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where - Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND - Filesystem.file_path IN ("*\\windows\\fonts\\*", "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*", "*:\\temp\\*") - by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +search: '| tstats `security_content_summariesonly` values(Filesystem.file_path) as + file_path count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.exe", "*.dll", "*.sys", "*.com", "*.vbs", "*.vbe", + "*.js", "*.ps1", "*.bat", "*.cmd", "*.pif") AND Filesystem.file_path IN ("*\\windows\\fonts\\*", + "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", + "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", + "*\\Windows\\repair\\*", "*\\AppData\\Local\\Temp*", "*\\PerfLogs\\*", "*:\\temp\\*") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executables_or_script_creation_in_suspicious_path_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: Administrators may allow creation of script or exe in the paths specified. Filter as needed. +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: Administrators may allow creation of script or exe in the paths + specified. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ @@ -29,50 +41,57 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - Double Zero Destructor - - Graceful Wipe Out Attack - - AsyncRAT - - WhisperGate - - DarkGate Malware - - AgentTesla - - Brute Ratel C4 - - NjRAT - - RedLine Stealer - - Rhysida Ransomware - - Swift Slicer - - IcedID - - DarkCrystal RAT - - Chaos Ransomware - - PlugX - - Industroyer2 - - Azorult - - Remcos - - XMRig - - Qakbot - Volt Typhoon - - Hermetic Wiper - - Warzone RAT - - Trickbot - - Amadey - - BlackByte Ransomware - LockBit Ransomware - - CISA AA23-347A - Data Destruction - Snake Keylogger + - XMRig + - DarkGate Malware + - Chaos Ransomware + - Double Zero Destructor + - Hermetic Wiper + - Warzone RAT - AcidPour + - Graceful Wipe Out Attack + - BlackByte Ransomware + - IcedID + - NjRAT - Handala Wiper - - MoonPeak - - ValleyRAT - Meduza Stealer + - CISA AA23-347A + - AsyncRAT + - Amadey + - Industroyer2 + - ValleyRAT + - Rhysida Ransomware + - DarkCrystal RAT + - Crypto Stealer + - Azorult + - Swift Slicer + - AgentTesla + - Qakbot + - Remcos + - Trickbot + - Brute Ratel C4 + - RedLine Stealer + - PlugX + - MoonPeak + - WhisperGate asset_type: Endpoint confidence: 50 impact: 40 - message: Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ + message: Suspicious executable or scripts with file name $file_name$, $file_path$ + and process_id $process_id$ executed in suspicious file path in Windows by $user$ mitre_attack_id: - T1036 observable: diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 328268b77a..73cad59c98 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -1,7 +1,7 @@ name: Hiding Files And Directories With Attrib exe id: 6e5a3ae4-90a3-462d-9aa6-0119f638c0f1 -version: '8' -date: '2024-11-28' +version: '9' +date: '2024-12-17' author: Bhavin Patel, Splunk status: production type: TTP @@ -50,10 +50,11 @@ drilldown_searches: latest_offset: $info_max_time$ tags: analytic_story: - - Windows Persistence Techniques - Azorult + - Windows Persistence Techniques - Compromised Windows Host - Windows Defense Evasion Tactics + - Crypto Stealer asset_type: Endpoint confidence: 80 impact: 90 diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index 6835d76660..7f75080cd3 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -1,15 +1,26 @@ name: High Process Termination Frequency id: 17cd75b2-8666-11eb-9ab4-acde48001122 -version: 5 -date: '2024-09-30' +version: '6' +date: '2024-12-17' author: Teoderick Contreras status: production type: Anomaly -description: The following analytic identifies a high frequency of process termination events on a computer within a short period. It leverages Sysmon EventCode 5 logs to detect instances where 15 or more processes are terminated within a 3-second window. This behavior is significant as it is commonly associated with ransomware attempting to avoid exceptions during file encryption. If confirmed malicious, this activity could indicate an active ransomware attack, potentially leading to widespread file encryption and significant data loss. +description: The following analytic identifies a high frequency of process termination + events on a computer within a short period. It leverages Sysmon EventCode 5 logs + to detect instances where 15 or more processes are terminated within a 3-second + window. This behavior is significant as it is commonly associated with ransomware + attempting to avoid exceptions during file encryption. If confirmed malicious, this + activity could indicate an active ransomware attack, potentially leading to widespread + file encryption and significant data loss. data_source: - Sysmon EventID 5 -search: '`sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_terminated min(_time) as firstTime max(_time) as lastTime count by _time dest EventCode ProcessID | where count >= 15 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `high_process_termination_frequency_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting logs with the Image (process full path of terminated process) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +search: '`sysmon` EventCode=5 |bin _time span=3s |stats values(Image) as proc_terminated + min(_time) as firstTime max(_time) as lastTime count by _time dest EventCode ProcessID + | where count >= 15 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `high_process_termination_frequency_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Image (process full path of terminated process) from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: admin or user tool that can terminate multiple process. references: - https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft @@ -20,20 +31,27 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - Clop Ransomware - LockBit Ransomware - - BlackByte Ransomware - - Rhysida Ransomware + - Clop Ransomware - Snake Keylogger + - Rhysida Ransomware + - BlackByte Ransomware + - Crypto Stealer asset_type: Endpoint confidence: 80 impact: 90 - message: High frequency process termination (more than 15 processes within 3s) detected on host $dest$ + message: High frequency process termination (more than 15 processes within 3s) detected + on host $dest$ mitre_attack_id: - T1486 observable: diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index bbb37ece01..d0dc9adb73 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -1,7 +1,7 @@ name: Icacls Deny Command id: cf8d753e-a8fe-11eb-8f58-acde48001122 -version: '4' -date: '2024-11-28' +version: '5' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: TTP @@ -54,8 +54,9 @@ tags: analytic_story: - Azorult - Sandworm Tools - - XMRig - Compromised Windows Host + - XMRig + - Crypto Stealer asset_type: Endpoint confidence: 80 impact: 90 diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 9445ecf5d7..8e18f883b8 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -1,17 +1,37 @@ name: ICACLS Grant Command id: b1b1e316-accc-11eb-a9b4-acde48001122 -version: 3 -date: '2024-09-30' +version: '5' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the use of the ICACLS command to grant additional access permissions to files or directories. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process names and command-line arguments. This activity is significant because it is commonly used by Advanced Persistent Threats (APTs) and coinminer scripts to evade detection and maintain control over compromised systems. If confirmed malicious, this behavior could allow attackers to manipulate file permissions, potentially leading to unauthorized access, data exfiltration, or further system compromise. +type: Anomaly +description: The following analytic detects the use of the ICACLS command to grant + additional access permissions to files or directories. It leverages data from Endpoint + Detection and Response (EDR) agents, focusing on specific process names and command-line + arguments. This activity is significant because it is commonly used by Advanced + Persistent Threats (APTs) and coinminer scripts to evade detection and maintain + control over compromised systems. If confirmed malicious, this behavior could allow + attackers to manipulate file permissions, potentially leading to unauthorized access, + data exfiltration, or further system compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN( "icacls.exe", + "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") by Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.process Processes.process_guid + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `icacls_grant_command_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: Unknown. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -21,17 +41,24 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - XMRig - Ransomware + - Crypto Stealer + - XMRig asset_type: Endpoint - confidence: 70 - impact: 70 - message: Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$ + confidence: 50 + impact: 50 + message: Process name $process_name$ with grant argument executed by $user$ to change + security permission of a specific file or directory on host $dest$ mitre_attack_id: - T1222 observable: @@ -55,7 +82,7 @@ tags: - Processes.user - Processes.process_id - Processes.process - risk_score: 49 + risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 2b22f40390..7b71b2d244 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -1,17 +1,39 @@ name: Malicious PowerShell Process - Encoded Command id: c4db14d9-7909-48b4-a054-aa14d89dbb19 -version: 11 -date: '2024-10-17' +version: '12' +date: '2024-12-17' author: David Dorsey, Michael Haag, Splunk, SirDuckly, GitHub Community status: production type: Hunting -description: The following analytic detects the use of the EncodedCommand parameter in PowerShell processes. It leverages Endpoint Detection and Response (EDR) data to identify variations of the EncodedCommand parameter, including shortened forms and different command switch types. This activity is significant because adversaries often use encoded commands to obfuscate malicious scripts, making detection harder. If confirmed malicious, this behavior could allow attackers to execute hidden code, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment. Review parallel events to determine legitimacy and tune based on known administrative scripts. +description: The following analytic detects the use of the EncodedCommand parameter + in PowerShell processes. It leverages Endpoint Detection and Response (EDR) data + to identify variations of the EncodedCommand parameter, including shortened forms + and different command switch types. This activity is significant because adversaries + often use encoded commands to obfuscate malicious scripts, making detection harder. + If confirmed malicious, this behavior could allow attackers to execute hidden code, + potentially leading to unauthorized access, privilege escalation, or persistent + threats within the environment. Review parallel events to determine legitimacy and + tune based on known administrative scripts. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013|\u2014|\u2015][Ee^]{1,2}[NnCcOoDdEeMmAa^]+\\s+[\\\"]?[A-Za-z0-9+/=]{5,}[\\\"]?\") | `malicious_powershell_process___encoded_command_filter`" -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: "| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)\ + \ as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user\ + \ Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name\ + \ Processes.dest Processes.process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`\ + \ | `security_content_ctime(lastTime)` | where match(process,\"(?i)[\\-|\\/|\u2013\ + |\u2014|\u2015][Ee^]{1,2}[NnCcOoDdEeMmAa^]+\\s+[\\\"]?[A-Za-z0-9+/=]{5,}[\\\"]?\"\ + ) | `malicious_powershell_process___encoded_command_filter`" +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: System administrators may use this option, but it's not common. references: - https://regexr.com/662ov @@ -22,17 +44,18 @@ references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ tags: analytic_story: - - Hermetic Wiper - - Malicious PowerShell - - NOBELIUM Group - - WhisperGate - - DarkCrystal RAT - - Qakbot - CISA AA22-320A + - Hermetic Wiper - Sandworm Tools - - Data Destruction + - Qakbot - Volt Typhoon + - NOBELIUM Group + - Data Destruction - Lumma Stealer + - Malicious PowerShell + - DarkCrystal RAT + - WhisperGate + - Crypto Stealer asset_type: Endpoint confidence: 50 impact: 70 diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index abcc1f260d..46322d94ca 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -1,17 +1,39 @@ name: Modify ACL permission To Files Or Folder id: 7e8458cc-acca-11eb-9e3f-acde48001122 -version: 4 -date: '2024-09-30' +version: '6' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the modification of ACL permissions to files or folders, making them accessible to everyone. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on processes like "cacls.exe," "icacls.exe," and "xcacls.exe" with specific command-line arguments. This activity is significant as it may indicate an adversary attempting to evade ACLs or access protected files. If confirmed malicious, this could allow unauthorized access to sensitive data, potentially leading to data breaches or further system compromise. +description: The following analytic detects the modification of ACL permissions to + files or folders, making them accessible to everyone or to system account. It leverages + data from Endpoint Detection and Response (EDR) agents, focusing on processes like + "cacls.exe," "icacls.exe," and "xcacls.exe" with specific command-line arguments. + This activity is significant as it may indicate an adversary attempting to evade + ACLs or access protected files. If confirmed malicious, this could allow unauthorized + access to sensitive data, potentially leading to data breaches or further system + compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "cacls.exe" OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe") AND Processes.process = "*/G*" AND (Processes.process = "* everyone:*" OR Processes.process = "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*") by Processes.parent_process_name Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modify_acl_permission_to_files_or_folder_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "cacls.exe" + OR Processes.process_name = "icacls.exe" OR Processes.process_name = "xcacls.exe") + AND Processes.process = "*/G*" AND (Processes.process = "* everyone:*" OR Processes.process + = "* SYSTEM:*" OR Processes.process = "* S-1-1-0:*") by Processes.parent_process_name + Processes.process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `modify_acl_permission_to_files_or_folder_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. known_false_positives: administrators may use this command. Filter as needed. references: - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -21,11 +43,17 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: + - Crypto Stealer - XMRig asset_type: Endpoint confidence: 80 diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 9f41a164a9..928faecc2b 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -1,18 +1,39 @@ name: Permission Modification using Takeown App id: fa7ca5c6-c9d8-11eb-bce9-acde48001122 -version: 3 -date: '2024-09-30' +version: '4' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the modification of file or directory permissions using the takeown.exe Windows application. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include process GUID, process name, and command-line details. This activity is significant because it is a common technique used by ransomware to take ownership of files or folders for encryption or deletion. If confirmed malicious, this could lead to unauthorized access, data encryption, or data destruction, severely impacting the integrity and availability of critical data. +description: The following analytic detects the modification of file or directory + permissions using the takeown.exe Windows application. It leverages data from Endpoint + Detection and Response (EDR) agents, focusing on process execution logs that include + process GUID, process name, and command-line details. This activity is significant + because it is a common technique used by ransomware to take ownership of files or + folders for encryption or deletion. If confirmed malicious, this could lead to unauthorized + access, data encryption, or data destruction, severely impacting the integrity and + availability of critical data. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "takeown.exe" Processes.process = "*/f*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `permission_modification_using_takeown_app_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: takeown.exe is a normal windows application that may used by network operator. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "takeown.exe" + Processes.process = "*/f*" by Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id + Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `permission_modification_using_takeown_app_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: takeown.exe is a normal windows application that may used by + network operator. references: - https://research.nccgroup.com/2020/06/23/wastedlocker-a-new-ransomware-variant-developed-by-the-evil-corp-group/ drilldown_searches: @@ -21,17 +42,24 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - Ransomware - Sandworm Tools + - Ransomware + - Crypto Stealer asset_type: Endpoint confidence: 80 impact: 70 - message: A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ + message: A suspicious of execution of $process_name$ with process id $process_id$ + and commandline $process$ to modify permission of directory or files in host $dest$ mitre_attack_id: - T1222 observable: diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index 972d6b948a..97d5cbea9c 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -1,18 +1,40 @@ name: Sc exe Manipulating Windows Services id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d -version: 6 -date: '2024-09-30' +version: '7' +date: '2024-12-17' author: Rico Valdez, Splunk status: production type: TTP -description: The following analytic detects the creation or modification of Windows services using the sc.exe command. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because manipulating Windows services can be a method for attackers to establish persistence, escalate privileges, or execute arbitrary code. If confirmed malicious, this behavior could allow an attacker to maintain long-term access, disrupt services, or gain control over critical system functions, posing a severe threat to the environment. +description: The following analytic detects the creation or modification of Windows + services using the sc.exe command. It leverages data from Endpoint Detection and + Response (EDR) agents, focusing on process names and command-line arguments. This + activity is significant because manipulating Windows services can be a method for + attackers to establish persistence, escalate privileges, or execute arbitrary code. + If confirmed malicious, this behavior could allow an attacker to maintain long-term + access, disrupt services, or gain control over critical system functions, posing + a severe threat to the environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sc.exe (Processes.process="* create *" OR Processes.process="* config *") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sc_exe_manipulating_windows_services_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Using sc.exe to manipulate Windows services is uncommon. However, there may be legitimate instances of this behavior. It is important to validate and investigate as appropriate. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = sc.exe (Processes.process="* create *" OR Processes.process="* + config *") by Processes.process_name Processes.parent_process_name Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `sc_exe_manipulating_windows_services_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Using sc.exe to manipulate Windows services is uncommon. However, + there may be legitimate instances of this behavior. It is important to validate + and investigate as appropriate. references: - https://www.secureworks.com/blog/drokbk-malware-uses-github-as-dead-drop-resolver drilldown_searches: @@ -21,23 +43,30 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - Windows Service Abuse - - DHS Report TA18-074A + - Azorult - Orangeworm Attack Group + - Windows Drivers + - NOBELIUM Group - Windows Persistence Techniques - Disabling Security Tools - - NOBELIUM Group - - Azorult - - Windows Drivers + - Windows Service Abuse + - DHS Report TA18-074A + - Crypto Stealer asset_type: Endpoint confidence: 80 impact: 70 - message: A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ + message: A sc process $process_name$ with commandline $process$ to create of configure + services in host $dest$ mitre_attack_id: - T1543.003 - T1543 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 061285ff6d..da49c97ad9 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -1,18 +1,41 @@ name: Suspicious Process File Path id: 9be25988-ad82-11eb-a14f-acde48001122 -version: 5 -date: '2024-11-28' +version: '7' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic identifies processes running from file paths not typically associated with legitimate software. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment. +description: The following analytic identifies processes running from file paths not + typically associated with legitimate software. It leverages data from Endpoint Detection + and Response (EDR) agents, focusing on specific process paths within the Endpoint + data model. This activity is significant because adversaries often use unconventional + file paths to execute malicious code without requiring administrative privileges. + If confirmed malicious, this behavior could indicate an attempt to bypass security + controls, leading to unauthorized software execution, potential system compromise, + and further malicious activities within the environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process_name) as process_name values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_path = "*\\windows\\fonts\\*" OR Processes.process_path = "*\\windows\\temp\\*" OR Processes.process_path = "*\\users\\public\\*" OR Processes.process_path = "*\\windows\\debug\\*" OR Processes.process_path = "*\\Users\\Administrator\\Music\\*" OR Processes.process_path = "*\\Windows\\servicing\\*" OR Processes.process_path = "*\\Users\\Default\\*" OR Processes.process_path = "*Recycle.bin*" OR Processes.process_path = "*\\Windows\\Media\\*" OR Processes.process_path = "\\Windows\\repair\\*" OR Processes.process_path = "*\\temp\\*" OR Processes.process_path = "*\\PerfLogs\\*" by Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Administrators may allow execution of specific binaries in non-standard paths. Filter as needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_path IN("*\\windows\\fonts\\*", + "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", + "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", + "*\\temp\\*" , "*\\PerfLogs\\*","*\\windows\\tasks\\*", "*:\\programdata\\*") by + Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators may allow execution of specific binaries in + non-standard paths. Filter as needed. references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ @@ -25,49 +48,56 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - Double Zero Destructor - - Graceful Wipe Out Attack - - AsyncRAT - - WhisperGate - - Prestige Ransomware - - DarkGate Malware - - AgentTesla - - Brute Ratel C4 - - RedLine Stealer - - Rhysida Ransomware - - Swift Slicer - - IcedID - - DarkCrystal RAT - - Chaos Ransomware - - PlugX - - Industroyer2 - - Azorult - - Remcos - - XMRig - - Qakbot - Volt Typhoon + - LockBit Ransomware + - Data Destruction + - XMRig + - DarkGate Malware + - Chaos Ransomware + - Double Zero Destructor - Hermetic Wiper - Warzone RAT - - Trickbot - - Amadey - - BlackByte Ransomware - - LockBit Ransomware - - CISA AA23-347A - - Data Destruction - Phemedrone Stealer + - Prestige Ransomware + - Graceful Wipe Out Attack + - BlackByte Ransomware + - IcedID - Handala Wiper - - MoonPeak - - ValleyRAT - Meduza Stealer + - CISA AA23-347A + - AsyncRAT + - Amadey + - Industroyer2 + - ValleyRAT + - Rhysida Ransomware + - DarkCrystal RAT + - Crypto Stealer + - Azorult + - Swift Slicer + - AgentTesla + - Qakbot + - Remcos + - Trickbot + - Brute Ratel C4 + - RedLine Stealer + - PlugX + - MoonPeak + - WhisperGate asset_type: Endpoint confidence: 50 impact: 70 - message: Suspicious process $process_name$ running from a suspicious process path- $process_path$ on host- $dest$ + message: Suspicious process $process_name$ running from a suspicious process path- + $process_path$ on host- $dest$ mitre_attack_id: - T1543 observable: diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 3b2a40cac0..cb80824bc0 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -1,18 +1,42 @@ name: Suspicious Scheduled Task from Public Directory id: 7feb7972-7ac3-11eb-bac8-acde48001122 -version: 3 -date: '2024-09-30' +version: '4' +date: '2024-12-17' author: Michael Haag, Splunk status: production type: Anomaly -description: The following analytic identifies the creation of scheduled tasks that execute binaries or scripts from public directories, such as users\public, \programdata\, or \windows\temp, using schtasks.exe with the /create command. It leverages Sysmon Event ID 1 data to detect this behavior. This activity is significant because it often indicates an attempt to maintain persistence or execute malicious scripts, which are common tactics in malware deployment. If confirmed as malicious, this could lead to data compromise, unauthorized access, and potential lateral movement within the network. +description: The following analytic identifies the creation of scheduled tasks that + execute binaries or scripts from public directories, such as users\public, \programdata\, + or \windows\temp, using schtasks.exe with the /create command. It leverages Sysmon + Event ID 1 data to detect this behavior. This activity is significant because it + often indicates an attempt to maintain persistence or execute malicious scripts, + which are common tactics in malware deployment. If confirmed as malicious, this + could lead to data compromise, unauthorized access, and potential lateral movement + within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe (Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR Processes.process=*windows\\temp*) Processes.process=*/create* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: The main source of false positives could be the legitimate use of scheduled tasks from these directories. Careful tuning of this search may be necessary to suit the specifics of your environment, reducing the rate of false positives. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name=schtasks.exe + (Processes.process=*\\users\\public\\* OR Processes.process=*\\programdata\\* OR + Processes.process=*windows\\temp*) Processes.process=*/create* by Processes.dest + Processes.user Processes.parent_process Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `suspicious_scheduled_task_from_public_directory_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: The main source of false positives could be the legitimate + use of scheduled tasks from these directories. Careful tuning of this search may + be necessary to suit the specifics of your environment, reducing the rate of false + positives. references: - https://attack.mitre.org/techniques/T1053/005/ drilldown_searches: @@ -21,21 +45,27 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - Azorult - - Ryuk Ransomware - - Scheduled Tasks - - Ransomware - - Windows Persistence Techniques - - Living Off The Land - - DarkCrystal RAT - - CISA AA23-347A - MoonPeak - CISA AA24-241A + - Windows Persistence Techniques + - CISA AA23-347A + - Ransomware + - Scheduled Tasks + - Ryuk Ransomware + - Crypto Stealer + - DarkCrystal RAT + - Living Off The Land asset_type: Endpoint confidence: 50 impact: 70 diff --git a/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml b/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml index f942569055..8084ca1e11 100644 --- a/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml +++ b/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml @@ -61,6 +61,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://github.com/splunk/contentctl/wiki + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/log_off_user/pwh_quser_logoff.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_autoit3_execution.yml b/detections/endpoint/windows_autoit3_execution.yml index bfa49d58ee..9ab54fd2cb 100644 --- a/detections/endpoint/windows_autoit3_execution.yml +++ b/detections/endpoint/windows_autoit3_execution.yml @@ -1,7 +1,7 @@ name: Windows AutoIt3 Execution id: 0ecb40d9-492b-4a57-9f87-515dd742794c -version: 4 -date: '2024-09-30' +version: '5' +date: '2024-12-17' author: Michael Haag, Splunk status: production type: TTP @@ -9,10 +9,31 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -description: The following analytic detects the execution of AutoIt3, a scripting language often used for automating Windows GUI tasks and general scripting. It identifies instances where AutoIt3 or its variants are executed by searching for process names or original file names matching 'autoit3.exe'. This activity is significant because attackers frequently use AutoIt3 to automate malicious actions, such as executing malware. If confirmed malicious, this activity could lead to unauthorized code execution, system compromise, or further propagation of malware within the environment. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("autoit3.exe", "autoit*.exe") OR Processes.original_file_name IN ("autoit3.exe", "autoit*.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_autoit3_execution_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: False positives may be present if the application is legitimately used, filter by user or endpoint as needed. +description: The following analytic detects the execution of AutoIt3, a scripting + language often used for automating Windows GUI tasks and general scripting. It identifies + instances where AutoIt3 or its variants are executed by searching for process names + or original file names matching 'autoit3.exe'. This activity is significant because + attackers frequently use AutoIt3 to automate malicious actions, such as executing + malware. If confirmed malicious, this activity could lead to unauthorized code execution, + system compromise, or further propagation of malware within the environment. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("autoit3.exe", + "autoit*.exe") OR Processes.original_file_name IN ("autoit3.exe", "autoit*.exe") + by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_autoit3_execution_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positives may be present if the application is legitimately + used, filter by user or endpoint as needed. references: - https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/main/2023-10-25-IOCs-from-DarkGate-activity.txt drilldown_searches: @@ -21,18 +42,25 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - DarkGate Malware + - Crypto Stealer - Handala Wiper + - DarkGate Malware asset_type: Endpoint atomic_guid: [] confidence: 100 impact: 50 - message: Execution of AutoIt3 detected. The source process is $parent_process_name$ and the destination process is $process_name$ on $dest$ by + message: Execution of AutoIt3 detected. The source process is $parent_process_name$ + and the destination process is $process_name$ on $dest$ by mitre_attack_id: - T1059 observable: diff --git a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml index 743156d77b..8267b2bf57 100644 --- a/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml +++ b/detections/endpoint/windows_boot_or_logon_autostart_execution_in_startup_folder.yml @@ -1,16 +1,30 @@ name: Windows Boot or Logon Autostart Execution In Startup Folder id: 99d157cb-923f-4a00-aee9-1f385412146f -version: 3 -date: '2024-09-30' +version: '4' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the creation of files in the Windows %startup% folder, a common persistence technique. It leverages the Endpoint.Filesystem data model to identify file creation events in this specific directory. This activity is significant because adversaries often use the startup folder to ensure their malicious code executes automatically upon system boot or user logon. If confirmed malicious, this could allow attackers to maintain persistence on the host, potentially leading to further system compromise and unauthorized access to sensitive information. +description: The following analytic detects the creation of files in the Windows %startup% + folder, a common persistence technique. It leverages the Endpoint.Filesystem data + model to identify file creation events in this specific directory. This activity + is significant because adversaries often use the startup folder to ensure their + malicious code executes automatically upon system boot or user logon. If confirmed + malicious, this could allow attackers to maintain persistence on the host, potentially + leading to further system compromise and unauthorized access to sensitive information. data_source: - Sysmon EventID 11 -search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path = "*\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\*" by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.user Filesystem.file_path Filesystem.process_guid Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_boot_or_logon_autostart_execution_in_startup_folder_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the Filesystem responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. -known_false_positives: Administrators may allow creation of script or exe in this path. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_path = "*\\Microsoft\\Windows\\Start + Menu\\Programs\\Startup\\*" by Filesystem.file_create_time Filesystem.process_id + Filesystem.file_name Filesystem.user Filesystem.file_path Filesystem.process_guid + Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_boot_or_logon_autostart_execution_in_startup_folder_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the Filesystem responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Filesystem` node. +known_false_positives: Administrators may allow creation of script or exe in this + path. references: - https://attack.mitre.org/techniques/T1204/002/ - https://www.fortinet.com/blog/threat-research/chaos-ransomware-variant-sides-with-russia @@ -20,15 +34,21 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$user$" and "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - Chaos Ransomware - NjRAT - RedLine Stealer - Gozi Malware + - Crypto Stealer + - Chaos Ransomware asset_type: Endpoint confidence: 90 impact: 90 diff --git a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml index 91e1238744..240bde942d 100644 --- a/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml +++ b/detections/endpoint/windows_disable_or_modify_tools_via_taskkill.yml @@ -1,7 +1,7 @@ name: Windows Disable or Modify Tools Via Taskkill id: a43ae66f-c410-4b3d-8741-9ce1ad17ddb0 -version: 5 -date: '2024-09-30' +version: '6' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -9,10 +9,32 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -description: The following analytic identifies the use of taskkill.exe to forcibly terminate processes. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include specific taskkill parameters. This activity is significant because it can indicate attempts to disable security tools or disrupt legitimate applications, a common tactic in malware operations. If confirmed malicious, this behavior could allow attackers to evade detection, disrupt system stability, and potentially gain further control over the compromised system. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_disable_or_modify_tools_via_taskkill_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Network administrator can use this application to kill process during audit or investigation. +description: The following analytic identifies the use of taskkill.exe to forcibly + terminate processes. It leverages data from Endpoint Detection and Response (EDR) + agents, focusing on command-line executions that include specific taskkill parameters. + This activity is significant because it can indicate attempts to disable security + tools or disrupt legitimate applications, a common tactic in malware operations. + If confirmed malicious, this behavior could allow attackers to evade detection, + disrupt system stability, and potentially gain further control over the compromised + system. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "taskkill.exe" + Processes.process IN ("* /f*", "* /t*") Processes.process IN ("* /im*", "* /pid*") + by Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_disable_or_modify_tools_via_taskkill_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Network administrator can use this application to kill process + during audit or investigation. references: - https://malpedia.caad.fkie.fraunhofer.de/details/win.njrat drilldown_searches: @@ -21,13 +43,19 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - NjRAT - PXA Stealer + - NjRAT + - Crypto Stealer asset_type: Endpoint confidence: 60 impact: 60 diff --git a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml index 9852179d8a..19f87dbfcc 100644 --- a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml +++ b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml @@ -63,6 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://github.com/splunk/contentctl/wiki + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1027.013/rar_sfx_execution/rar_sfx.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_remote_management_execute_shell.yml b/detections/endpoint/windows_remote_management_execute_shell.yml index 2fcb2a13fe..9d4f965dcd 100644 --- a/detections/endpoint/windows_remote_management_execute_shell.yml +++ b/detections/endpoint/windows_remote_management_execute_shell.yml @@ -70,6 +70,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://github.com/splunk/contentctl/wiki + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/wirm_execute_shell/winrshost_pwh.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_screen_capture_in_temp_folder.yml b/detections/endpoint/windows_screen_capture_in_temp_folder.yml index cbdf0d19b7..e07a5d2ccc 100644 --- a/detections/endpoint/windows_screen_capture_in_temp_folder.yml +++ b/detections/endpoint/windows_screen_capture_in_temp_folder.yml @@ -1,19 +1,25 @@ name: Windows Screen Capture in TEMP folder id: 00524d1f-a032-46f5-9108-e7d9f01bfb3c -version: 1 -date: '2024-09-24' +version: '2' +date: '2024-12-17' author: Teoderick Contreras, Splunk data_sources: - Sysmon Event ID 11 type: TTP status: production -description: The following analytic detects the creation of screen capture files by the Braodo stealer malware. This stealer is known to capture screenshots of the victim's desktop as part of its data theft activities. The detection focuses on identifying unusual screen capture activity, especially when images are saved in directories often used by malware, such as temporary or hidden folders. Monitoring for these files helps to quickly identify malicious screen capture attempts, allowing security teams to respond and mitigate potential information exposure before sensitive data is compromised. -search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("screenshot.png", "screenshot.jpg","screenshot.bmp") Filesystem.file_path = "*\\temp\\*" - by _time Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.file_create_time - | `drop_dm_object_name(Filesystem)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` +description: The following analytic detects the creation of screen capture files by + the Braodo stealer malware. This stealer is known to capture screenshots of the + victim's desktop as part of its data theft activities. The detection focuses on + identifying unusual screen capture activity, especially when images are saved in + directories often used by malware, such as temporary or hidden folders. Monitoring + for these files helps to quickly identify malicious screen capture attempts, allowing + security teams to respond and mitigate potential information exposure before sensitive + data is compromised. +search: '|tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("screenshot.png", + "screenshot.jpg","screenshot.bmp") Filesystem.file_path = "*\\temp\\*" by _time + Filesystem.file_name Filesystem.file_path Filesystem.dest Filesystem.file_create_time + | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_screen_capture_in_temp_folder_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -30,11 +36,17 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: + - Crypto Stealer - Braodo Stealer asset_type: Endpoint confidence: 80 diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 934a861942..0d0b564329 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,16 +1,30 @@ name: Windows Service Created with Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 -version: 7 -date: '2024-09-30' +version: '8' +date: '2024-12-17' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP -description: The following analytic detects the creation of a Windows Service with a binary path located in uncommon directories, using Windows Event ID 7045. It leverages logs from the `wineventlog_system` to identify services installed outside typical system directories. This activity is significant as adversaries, including those deploying Clop ransomware, often create malicious services for lateral movement, remote code execution, persistence, and execution. If confirmed malicious, this could allow attackers to maintain persistence, execute arbitrary code, and potentially escalate privileges, posing a severe threat to the environment. +description: The following analytic detects the creation of a Windows Service with + a binary path located in uncommon directories, using Windows Event ID 7045. It leverages + logs from the `wineventlog_system` to identify services installed outside typical + system directories. This activity is significant as adversaries, including those + deploying Clop ransomware, often create malicious services for lateral movement, + remote code execution, persistence, and execution. If confirmed malicious, this + could allow attackers to maintain persistence, execute arbitrary code, and potentially + escalate privileges, posing a severe threat to the environment. data_source: - Windows Event Log System 7045 -search: '`wineventlog_system` EventCode=7045 ImagePath = "*.exe" NOT (ImagePath IN ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ImagePath ServiceName ServiceType StartType Computer UserID | rename Computer as dest| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -known_false_positives: Legitimate applications may install services with uncommon services paths. +search: '`wineventlog_system` EventCode=7045 ImagePath = "*.exe" NOT (ImagePath IN + ("*:\\Windows\\*", "*:\\Program File*", "*:\\Programdata\\*", "*%systemroot%\\*")) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ImagePath + ServiceName ServiceType StartType Computer UserID | rename Computer as dest| `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_created_with_suspicious_service_path_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the Service name, Service File Name Service Start type, and Service Type + from your endpoints. +known_false_positives: Legitimate applications may install services with uncommon + services paths. references: - https://www.mandiant.com/resources/fin11-email-campaigns-precursor-for-ransomware-data-theft - https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html @@ -20,23 +34,30 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - Clop Ransomware - - Active Directory Lateral Movement - - Brute Ratel C4 - Qakbot - - Snake Malware - - Flax Typhoon - - PlugX - CISA AA23-347A + - Flax Typhoon + - Clop Ransomware + - Brute Ratel C4 + - PlugX + - Active Directory Lateral Movement + - Crypto Stealer + - Snake Malware asset_type: Endpoint confidence: 80 impact: 70 - message: A service $ImagePath$ was created from a non-standard path using $ServiceName$ on $dest$ + message: A service $ImagePath$ was created from a non-standard path using $ServiceName$ + on $dest$ mitre_attack_id: - T1569 - T1569.002 diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index ae49992523..408380ac63 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,17 +1,23 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: 6 -date: '2024-11-14' +version: '7' +date: '2024-12-17' author: Teoderick Contreras, Splunk, Steven Dick status: production type: TTP -description: The following analytic detects the modification of registry keys that define Windows services using reg.exe. This detection leverages Splunk to search for specific keywords in the registry path, value name, and value data fields. This activity is significant because it indicates potential unauthorized changes to service configurations, a common persistence technique used by attackers. If confirmed malicious, this could allow an attacker to maintain access, escalate privileges, or move laterally within the network, leading to data theft, ransomware, or other damaging outcomes. +description: The following analytic detects the modification of registry keys that + define Windows services using reg.exe. This detection leverages Splunk to search + for specific keywords in the registry path, value name, and value data fields. This + activity is significant because it indicates potential unauthorized changes to service + configurations, a common persistence technique used by attackers. If confirmed malicious, + this could allow an attacker to maintain access, escalate privileges, or move laterally + within the network, leading to data theft, ransomware, or other damaging outcomes. data_source: - Sysmon EventID 12 - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name - = ImagePath) BY Registry.dest Registry.user Registry.registry_path +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" + Registry.registry_value_name = ImagePath) BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`' @@ -29,22 +35,29 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - Active Directory Lateral Movement - - Suspicious Windows Registry Activities - Windows Persistence Techniques + - CISA AA23-347A - Windows Registry Abuse - Brute Ratel C4 - PlugX - - CISA AA23-347A + - Suspicious Windows Registry Activities + - Active Directory Lateral Movement + - Crypto Stealer asset_type: Endpoint confidence: 80 impact: 80 - message: A Windows Service was created on a endpoint from $dest$ using a registry entry + message: A Windows Service was created on a endpoint from $dest$ using a registry + entry mitre_attack_id: - T1574.011 observable: diff --git a/detections/endpoint/windows_service_deletion_in_registry.yml b/detections/endpoint/windows_service_deletion_in_registry.yml index 95df38040e..7ae071669e 100644 --- a/detections/endpoint/windows_service_deletion_in_registry.yml +++ b/detections/endpoint/windows_service_deletion_in_registry.yml @@ -1,17 +1,35 @@ name: Windows Service Deletion In Registry id: daed6823-b51c-4843-a6ad-169708f1323e -version: 3 -date: '2024-09-30' +version: '4' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the deletion of a service from the Windows Registry under CurrentControlSet\Services. It leverages data from the Endpoint.Registry datamodel, specifically monitoring registry paths and actions related to service deletion. This activity is significant as adversaries may delete services to evade detection and hinder incident response efforts. If confirmed malicious, this action could disrupt legitimate services, impair system functionality, and potentially allow attackers to maintain a lower profile within the environment, complicating detection and remediation efforts. +description: The following analytic detects the deletion of a service from the Windows + Registry under CurrentControlSet\Services. It leverages data from the Endpoint.Registry + datamodel, specifically monitoring registry paths and actions related to service + deletion. This activity is significant as adversaries may delete services to evade + detection and hinder incident response efforts. If confirmed malicious, this action + could disrupt legitimate services, impair system functionality, and potentially + allow attackers to maintain a lower profile within the environment, complicating + detection and remediation efforts. data_source: - Sysmon EventID 12 - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" AND (Registry.action = deleted OR (Registry.registry_value_name = DeleteFlag AND Registry.registry_value_data = 0x00000001 AND Registry.action=modified)) by Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_value_name Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_deletion_in_registry_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -known_false_positives: This event can be seen when administrator delete a service or uninstall/reinstall a software that creates service entry, but it is still recommended to check this alert with high priority. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path= "*\\SYSTEM\\CurrentControlSet\\Services*" + AND (Registry.action = deleted OR (Registry.registry_value_name = DeleteFlag AND + Registry.registry_value_data = 0x00000001 AND Registry.action=modified)) by Registry.registry_key_name + Registry.user Registry.registry_path Registry.registry_value_data Registry.registry_value_name + Registry.action Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_deletion_in_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: This event can be seen when administrator delete a service + or uninstall/reinstall a software that creates service entry, but it is still recommended + to check this alert with high priority. references: - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ drilldown_searches: @@ -20,13 +38,19 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - Brute Ratel C4 - PlugX + - Crypto Stealer + - Brute Ratel C4 asset_type: Endpoint confidence: 30 impact: 60 diff --git a/detections/endpoint/windows_service_stop_by_deletion.yml b/detections/endpoint/windows_service_stop_by_deletion.yml index 0d00fde6cb..025b3abf8c 100644 --- a/detections/endpoint/windows_service_stop_by_deletion.yml +++ b/detections/endpoint/windows_service_stop_by_deletion.yml @@ -1,18 +1,40 @@ name: Windows Service Stop By Deletion id: 196ff536-58d9-4d1b-9686-b176b04e430b -version: 3 -date: '2024-09-30' +version: '4' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the use of `sc.exe` to delete a Windows service. It leverages Endpoint Detection and Response (EDR) data, focusing on process execution logs that capture command-line arguments. This activity is significant because adversaries often delete services to disable security mechanisms or critical system functions, aiding in evasion and persistence. If confirmed malicious, this action could lead to the termination of essential security services, allowing attackers to operate undetected and potentially escalate their privileges or maintain long-term access to the compromised system. +description: The following analytic detects the use of `sc.exe` to delete a Windows + service. It leverages Endpoint Detection and Response (EDR) data, focusing on process + execution logs that capture command-line arguments. This activity is significant + because adversaries often delete services to disable security mechanisms or critical + system functions, aiding in evasion and persistence. If confirmed malicious, this + action could lead to the termination of essential security services, allowing attackers + to operate undetected and potentially escalate their privileges or maintain long-term + access to the compromised system. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed. +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where (Processes.process_name = sc.exe OR Processes.original_file_name = sc.exe) + Processes.process="* delete *" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_stop_by_deletion_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: It is possible administrative scripts may start/stop/delete + services. Filter as needed. references: - https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ - https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ @@ -23,17 +45,24 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - Azorult - Graceful Wipe Out Attack + - Crypto Stealer asset_type: Endpoint confidence: 70 impact: 70 - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ attempting to delete a service. + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ attempting to delete a service. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml index a610acb064..2eedffa6ef 100644 --- a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml +++ b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml @@ -1,18 +1,39 @@ name: Windows Service Stop Via Net and SC Application id: 827af04b-0d08-479b-9b84-b7d4644e4b80 -version: 3 -date: '2024-09-30' +version: '4' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic identifies attempts to stop services on a system using `net.exe` or `sc.exe`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line executions. This activity is significant as adversaries often terminate security or critical services to evade detection and further their objectives. If confirmed malicious, this behavior could allow attackers to disable security defenses, facilitate ransomware encryption, or disrupt essential services, leading to potential data loss or system compromise. +description: The following analytic identifies attempts to stop services on a system + using `net.exe` or `sc.exe`. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process names, GUIDs, and command-line executions. This + activity is significant as adversaries often terminate security or critical services + to evade detection and further their objectives. If confirmed malicious, this behavior + could allow attackers to disable security defenses, facilitate ransomware encryption, + or disrupt essential services, leading to potential data loss or system compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name = "sc.exe" OR Processes.original_file_name= "sc.exe" AND Processes.process="*stop*" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_via_net__and_sc_application_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: Windows OS or software may stop and restart services due to some critical update. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name + = "sc.exe" OR Processes.original_file_name= "sc.exe" AND Processes.process="*stop*" + by Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_stop_via_net__and_sc_application_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Windows OS or software may stop and restart services due to + some critical update. references: - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ drilldown_searches: @@ -21,13 +42,19 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - Prestige Ransomware - Graceful Wipe Out Attack + - Crypto Stealer asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/windows_system_file_on_disk.yml b/detections/endpoint/windows_system_file_on_disk.yml index 5208b98aba..9c2bfc1cd6 100644 --- a/detections/endpoint/windows_system_file_on_disk.yml +++ b/detections/endpoint/windows_system_file_on_disk.yml @@ -1,22 +1,38 @@ name: Windows System File on Disk id: 993ce99d-9cdd-42c7-a2cf-733d5954e5a6 -version: 4 -date: '2024-10-17' +version: '5' +date: '2024-12-17' author: Michael Haag, Splunk status: production type: Hunting -description: The following analytic detects the creation of new .sys files on disk. It leverages the Endpoint.Filesystem data model to identify and log instances where .sys files are written to the filesystem. This activity is significant because .sys files are often used as kernel mode drivers, and their unauthorized creation can indicate malicious activity such as rootkit installation. If confirmed malicious, this could allow an attacker to gain kernel-level access, leading to full system compromise, persistent control, and the ability to bypass security mechanisms. +description: The following analytic detects the creation of new .sys files on disk. + It leverages the Endpoint.Filesystem data model to identify and log instances where + .sys files are written to the filesystem. This activity is significant because .sys + files are often used as kernel mode drivers, and their unauthorized creation can + indicate malicious activity such as rootkit installation. If confirmed malicious, + this could allow an attacker to gain kernel-level access, leading to full system + compromise, persistent control, and the ability to bypass security mechanisms. data_source: - Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.sys*" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.file_hash | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_system_file_on_disk_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information on files from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. In addition, filtering may occur by adding NOT (Filesystem.file_path IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")). This will level out the noise generated to potentally lead to generating notables. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name="*.sys*" + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.file_path Filesystem.file_hash | `drop_dm_object_name(Filesystem)` | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `windows_system_file_on_disk_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on files from your endpoints into the `Endpoint` datamodel in the `Filesystem` node. + In addition, confirm the latest CIM App 4.20 or higher is installed and the latest + TA for the endpoint product. In addition, filtering may occur by adding NOT (Filesystem.file_path + IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")). + This will level out the noise generated to potentally lead to generating notables. known_false_positives: False positives will be present. Filter as needed. references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ tags: analytic_story: - - Windows Drivers - CISA AA22-264A + - Windows Drivers + - Crypto Stealer asset_type: Endpoint confidence: 50 impact: 20 diff --git a/detections/endpoint/windows_system_user_discovery_via_quser.yml b/detections/endpoint/windows_system_user_discovery_via_quser.yml index acac29b5ee..41a30da811 100644 --- a/detections/endpoint/windows_system_user_discovery_via_quser.yml +++ b/detections/endpoint/windows_system_user_discovery_via_quser.yml @@ -1,26 +1,49 @@ name: Windows System User Discovery Via Quser id: 0c3f3e09-e47a-410e-856f-a02a5c5fafb0 -version: 3 -date: '2024-10-17' +version: '4' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic detects the execution of the Windows OS tool quser.exe, commonly used to gather information about user sessions on a Remote Desktop Session Host server. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. Monitoring this activity is crucial as quser.exe is often abused by post-exploitation tools like winpeas, used in ransomware attacks to enumerate user sessions. If confirmed malicious, attackers could leverage this information to further compromise the system, maintain persistence, or escalate privileges. +description: The following analytic detects the execution of the Windows OS tool quser.exe, + commonly used to gather information about user sessions on a Remote Desktop Session + Host server. This detection leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process execution logs. Monitoring this activity is crucial + as quser.exe is often abused by post-exploitation tools like winpeas, used in ransomware + attacks to enumerate user sessions. If confirmed malicious, attackers could leverage + this information to further compromise the system, maintain persistence, or escalate + privileges. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="quser.exe" OR Processes.original_file_name = "quser.exe" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_system_user_discovery_via_quser_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: network administrator can use this command tool to audit RDP access of user in specific network or host. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name="quser.exe" + OR Processes.original_file_name = "quser.exe" by Processes.process_name Processes.original_file_name + Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name + Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_system_user_discovery_via_quser_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: network administrator can use this command tool to audit RDP + access of user in specific network or host. references: - https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser - https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS - https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ tags: analytic_story: - - Windows Post-Exploitation - Prestige Ransomware + - Crypto Stealer + - Windows Post-Exploitation asset_type: Endpoint confidence: 30 impact: 30 diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index 29ed54a869..141082b380 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -1,15 +1,27 @@ name: XMRIG Driver Loaded id: 90080fa6-a8df-11eb-91e4-acde48001122 -version: 3 -date: '2024-09-30' +version: '4' +date: '2024-12-17' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the installation of the XMRIG coinminer driver on a system. It identifies the loading of the `WinRing0x64.sys` driver, commonly associated with XMRIG, by analyzing Sysmon EventCode 6 logs for specific signatures and image loads. This activity is significant because XMRIG is an open-source CPU miner frequently exploited by adversaries to mine cryptocurrency illicitly. If confirmed malicious, this activity could lead to unauthorized resource consumption, degraded system performance, and potential financial loss due to unauthorized cryptocurrency mining. +description: The following analytic detects the installation of the XMRIG coinminer + driver on a system. It identifies the loading of the `WinRing0x64.sys` driver, commonly + associated with XMRIG, by analyzing Sysmon EventCode 6 logs for specific signatures + and image loads. This activity is significant because XMRIG is an open-source CPU + miner frequently exploited by adversaries to mine cryptocurrency illicitly. If confirmed + malicious, this activity could lead to unauthorized resource consumption, degraded + system performance, and potential financial loss due to unauthorized cryptocurrency + mining. data_source: - Sysmon EventID 6 -search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" | stats min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `xmrig_driver_loaded_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting logs with the driver loaded and Signature from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +search: '`sysmon` EventCode=6 Signature="Noriyuki MIYAZAKI" OR ImageLoaded= "*\\WinRing0x64.sys" + | stats min(_time) as firstTime max(_time) as lastTime count by dest ImageLoaded + Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `xmrig_driver_loaded_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the driver loaded and Signature from your endpoints. If you are using + Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: False positives should be limited. references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ @@ -19,13 +31,19 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ tags: analytic_story: - - XMRig - CISA AA22-320A + - Crypto Stealer + - XMRig asset_type: Endpoint confidence: 100 impact: 80 diff --git a/stories/crypto_stealer.yml b/stories/crypto_stealer.yml new file mode 100644 index 0000000000..4179a96824 --- /dev/null +++ b/stories/crypto_stealer.yml @@ -0,0 +1,17 @@ +name: Crypto Stealer +id: 71efef85-aec7-46c7-bdaa-693b9d2bef4b +version: 1 +date: '2024-12-17' +author: Teoderick Contreras, Splunk +description: Crypto Stealer is a malware strain designed to exfiltrate cryptocurrency-related data from compromised systems. It scans the infected machine for wallet files, clipboard activity, and other cryptocurrency artifacts, focusing on intercepting sensitive information like private keys or transaction details. The malware communicates with a command-and-control (C2) server to transmit the harvested data and can dynamically adapt its behavior based on instructions received. Detection indicators include unusual network activity to suspicious IP addresses, unauthorized file access targeting cryptocurrency wallet directories, and anomalous clipboard usage associated with cryptocurrency strings (e.g., wallet addresses). Security solutions should monitor for these behaviors and implement heuristic analysis to identify deviations from normal system operations. Users are encouraged to maintain updated endpoint protection and avoid downloading files from untrusted sources to mitigate the risk posed by Crypto Stealer. +narrative: In the ever-evolving landscape of cybercrime, Crypto Stealer emerges as a sophisticated malware targeting the lucrative world of cryptocurrency. By exploiting system vulnerabilities, the malware actively scans for wallet files, clipboard data, and other digital assets, focusing on intercepting sensitive information like private keys and transaction details. Once deployed, Crypto Stealer communicates with a command-and-control (C2) server to exfiltrate stolen data and receive updated instructions for further exploitation. Notably, it often works in tandem with other malicious components, such as XMRig, a widely abused cryptocurrency miner that hijacks system resources for illicit mining operations, and ClipBanker, which manipulates clipboard activity to replace wallet addresses in transactions with those controlled by attackers. These combined tactics maximize the attack's profitability while minimizing the victim's ability to detect the theft. Indicators of compromise include unauthorized access to cryptocurrency wallet files, suspicious clipboard behavior, and outbound connections to known malicious IP addresses. By understanding and recognizing these patterns, defenders can develop effective strategies to detect and mitigate threats like Crypto Stealer before significant damage occurs. + +references: [] +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 95be36ea2bf7b6e9ddc74034a7a02f9b625836bb Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 17 Dec 2024 11:55:42 +0100 Subject: [PATCH 03/82] crypto_campaign --- .../windows_account_access_removal_via_quser_logoff.yml | 2 +- .../windows_obfuscated_files_or_information_via_rar_sfx.yml | 2 +- detections/endpoint/windows_remote_management_execute_shell.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml b/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml index 8084ca1e11..530f9e1d2b 100644 --- a/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml +++ b/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml @@ -30,7 +30,7 @@ drilldown_searches: latest_offset: $info_max_time$ tags: analytic_story: - - UPDATE_STORY_NAME + - Crypto Stealer asset_type: Endpoint confidence: 70 impact: 70 diff --git a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml index 19f87dbfcc..0949e047e1 100644 --- a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml +++ b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml @@ -31,7 +31,7 @@ drilldown_searches: latest_offset: $info_max_time$ tags: analytic_story: - - UPDATE_STORY_NAME + - Crypto Stealer asset_type: Endpoint confidence: 50 impact: 50 diff --git a/detections/endpoint/windows_remote_management_execute_shell.yml b/detections/endpoint/windows_remote_management_execute_shell.yml index 9d4f965dcd..db9fe3dbfe 100644 --- a/detections/endpoint/windows_remote_management_execute_shell.yml +++ b/detections/endpoint/windows_remote_management_execute_shell.yml @@ -32,7 +32,7 @@ drilldown_searches: latest_offset: $info_max_time$ tags: analytic_story: - - UPDATE_STORY_NAME + - Crypto Stealer asset_type: Endpoint confidence: 30 impact: 30 From 3db1a7e77fd92c0fa22757eb7ac05770d78caf3d Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 17 Dec 2024 14:20:51 +0100 Subject: [PATCH 04/82] crypto_campaign --- ...fuscated_files_or_information_via_rar_sfx.yml | 4 ++-- ...windows_powershell_logoff_user_via_quser.yml} | 16 +++++++++------- 2 files changed, 11 insertions(+), 9 deletions(-) rename detections/endpoint/{windows_account_access_removal_via_quser_logoff.yml => windows_powershell_logoff_user_via_quser.yml} (91%) diff --git a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml index 0949e047e1..75c46cf773 100644 --- a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml +++ b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml @@ -5,9 +5,9 @@ date: '2024-12-12' author: Teoderick Contreras, Splunk data_sources: - Sysmon Event ID 11 -type: TTP +type: Anomaly status: production -description: The following analytic detects the creation of RAR Self-Extracting (SFX) files by monitoring the generation of file related to rar sfx installation. This method leverages a heuristic to identify RAR SFX archives based on specific markers that indicate a combination of executable code and compressed RAR data. By tracking such activity, the analytic helps pinpoint potentially unauthorized or suspicious file creation events, which are often associated with malware packaging or data exfiltration. Legitimate usage may include custom installers or compressed file delivery. +description: The following analytic detects the creation of RAR Self-Extracting (SFX) files by monitoring the generation of file related to rar sfx .tmp file creation during sfx installation. This method leverages a heuristic to identify RAR SFX archives based on specific markers that indicate a combination of executable code and compressed RAR data. By tracking such activity, the analytic helps pinpoint potentially unauthorized or suspicious file creation events, which are often associated with malware packaging or data exfiltration. Legitimate usage may include custom installers or compressed file delivery. kind: endpoint search: '`sysmon` EventCode=11 Image="*.exe" TargetFilename IN ("*__tmp_rar_sfx_access_check*") | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename Computer diff --git a/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml similarity index 91% rename from detections/endpoint/windows_account_access_removal_via_quser_logoff.yml rename to detections/endpoint/windows_powershell_logoff_user_via_quser.yml index 530f9e1d2b..1300d56e6a 100644 --- a/detections/endpoint/windows_account_access_removal_via_quser_logoff.yml +++ b/detections/endpoint/windows_powershell_logoff_user_via_quser.yml @@ -1,20 +1,20 @@ -name: 'Windows Account Access Removal via Quser LogOff' +name: 'Windows Powershell Logoff User via Quser' id: 6d70780d-4cfe-4820-bafd-1b43941986b5 version: 1 date: '2024-12-12' author: Teoderick Contreras, Splunk data_sources: - Powershell Script Block Logging 4104 -type: TTP +type: Anomaly status: production description: The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation. kind: endpoint -search: '`powershell` EventCode=4104 ScriptBlockText = "*quser*" ScriptBlockText = "*logoff*" +search: '`powershell` EventCode=4104 ScriptBlockText = "*quser*logoff*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText UserID Computer | rename Computer as dest, UserID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_account_access_removal_via_quser_logoff_filter`' + | `windows_powershell_logoff_user_via_quser_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: Administrators or power users may use this command. references: @@ -32,11 +32,13 @@ tags: analytic_story: - Crypto Stealer asset_type: Endpoint - confidence: 70 - impact: 70 + confidence: 30 + impact: 30 message: Powershell process having commandline [$ScriptBlockText$] used to logoff user on [$dest$]. mitre_attack_id: - T1531 + - T1059.001 + - T1059 observable: - name: dest type: Hostname @@ -56,7 +58,7 @@ tags: - Message - dest - user - risk_score: 49 + risk_score: 9 security_domain: endpoint tests: - name: True Positive Test From 6581cc66463b8469c771b6973a9dcd860f9e447b Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 17 Dec 2024 14:39:20 +0100 Subject: [PATCH 05/82] crypto_campaign --- ...rectory_permissions_enable_inheritance.yml | 71 +++++++++++++++++++ ...rectory_permissions_remove_inheritance.yml | 71 +++++++++++++++++++ 2 files changed, 142 insertions(+) create mode 100644 detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml create mode 100644 detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml diff --git a/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml b/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml new file mode 100644 index 0000000000..3cab7d6b4a --- /dev/null +++ b/detections/endpoint/windows_file_and_directory_permissions_enable_inheritance.yml @@ -0,0 +1,71 @@ +name: Windows File and Directory Permissions Enable Inheritance +id: 0247f90a-aca4-47b2-a94d-e30f445d7b41 +version: 1 +date: '2024-12-13' +author: Teoderick Contreras, Splunk +data_sources: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +type: Hunting +status: production +description: The following analytic detects the enabling of permission inheritance using ICACLS. This analytic identifies instances where ICACLS commands are used to enable permission inheritance on files or directories. The /inheritance:e flag, which restores inherited permissions from a parent directory, is monitored to detect changes that might reapply broader access control settings. Enabling inheritance can indicate legitimate administrative actions but may also signal attempts to override restrictive custom permissions, potentially exposing sensitive files to unauthorized access. +kind: endpoint +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process = "*/inheritance:e*" + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_file_and_directory_permissions_enable_inheritance_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +references: +- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + confidence: 25 + impact: 25 + message: A [$process_name$] was executed on [$dest$] attempting to enable inheritance permissions. + mitre_attack_id: + - T1222.001 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_guid + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process + risk_score: 5 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml b/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml new file mode 100644 index 0000000000..bd2b142207 --- /dev/null +++ b/detections/endpoint/windows_file_and_directory_permissions_remove_inheritance.yml @@ -0,0 +1,71 @@ +name: Windows File and Directory Permissions Remove Inheritance +id: 9b62da2c-e442-474f-83ca-fac4dabab1b3 +version: 1 +date: '2024-12-13' +author: Teoderick Contreras, Splunk +data_sources: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +type: Anomaly +status: production +description: The following analytic detects the removal of permission inheritance using ICACLS. This analytic identifies instances where ICACLS is used to remove permission inheritance from files or directories. The /inheritance:r flag, which strips inherited permissions while optionally preserving or altering explicit permissions, is monitored to detect changes that may restrict access or establish isolated permission configurations. Removing inheritance can be a legitimate administrative action but may also indicate an attempt to conceal malicious activity or bypass inherited security controls. +kind: endpoint +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process = "*/inheritance:r*" + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_file_and_directory_permissions_remove_inheritance_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +references: +- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: A [$process_name$] was executed on [$dest$] attempting to remove inheritance permissions. + mitre_attack_id: + - T1222.001 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_guid + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file From 4a5edfb3f43674ab7850c472c0baf992b599c09e Mon Sep 17 00:00:00 2001 From: tccontre Date: Tue, 17 Dec 2024 14:41:45 +0100 Subject: [PATCH 06/82] crypto_campaign --- .../windows_obfuscated_files_or_information_via_rar_sfx.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml index 75c46cf773..1af9691ace 100644 --- a/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml +++ b/detections/endpoint/windows_obfuscated_files_or_information_via_rar_sfx.yml @@ -9,7 +9,7 @@ type: Anomaly status: production description: The following analytic detects the creation of RAR Self-Extracting (SFX) files by monitoring the generation of file related to rar sfx .tmp file creation during sfx installation. This method leverages a heuristic to identify RAR SFX archives based on specific markers that indicate a combination of executable code and compressed RAR data. By tracking such activity, the analytic helps pinpoint potentially unauthorized or suspicious file creation events, which are often associated with malware packaging or data exfiltration. Legitimate usage may include custom installers or compressed file delivery. kind: endpoint -search: '`sysmon` EventCode=11 Image="*.exe" TargetFilename IN ("*__tmp_rar_sfx_access_check*") +search: '`sysmon` EventCode=11 TargetFilename IN ("*__tmp_rar_sfx_access_check*") | stats count min(_time) as firstTime max(_time) as lastTime by Image TargetFilename Computer | rename Computer as dest | rename TargetFilename as file_name From 96ce18730fcdfcf68742805befbab0e981a51562 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 18 Dec 2024 16:07:43 +0100 Subject: [PATCH 07/82] crypto_campaign --- ...removal_via_powershell_initiate_logoff.yml | 70 ++++++++++++++++++ ...ctional_communication_via_telegram_bot.yml | 67 +++++++++++++++++ ..._directory_enable_readonly_permissions.yml | 74 +++++++++++++++++++ 3 files changed, 211 insertions(+) create mode 100644 detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml create mode 100644 detections/endpoint/windows_bidirectional_communication_via_telegram_bot.yml create mode 100644 detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml diff --git a/detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml b/detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml new file mode 100644 index 0000000000..b72b7a53e2 --- /dev/null +++ b/detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml @@ -0,0 +1,70 @@ +name: 'Windows Account Access Removal via Powershell Initiate Logoff' +id: 223572ab-8768-4e20-9b39-c38707af80dc +version: 1 +date: '2024-12-17' +author: Teoderick Contreras, Splunk +data_sources: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +type: Anomaly +status: production +description: The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation. +kind: endpoint +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.parent_process_name = powershell.exe AND Processes.process_name = logoff.exe + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_account_access_removal_via_powershell_initiate_logoff_filter`' +how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. +known_false_positives: Administrators or power users may use this command. +references: +- https://devblogs.microsoft.com/scripting/automating-quser-through-powershell/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + confidence: 50 + impact: 50 + message: Powershell process having commandline [$ScriptBlockText$] used to logoff user on [$dest$]. + mitre_attack_id: + - T1531 + - T1059.001 + - T1059 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - dest + - user + risk_score: 25 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/powershell_log_process_tree/powershell_logoff.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_bidirectional_communication_via_telegram_bot.yml b/detections/endpoint/windows_bidirectional_communication_via_telegram_bot.yml new file mode 100644 index 0000000000..df76899b85 --- /dev/null +++ b/detections/endpoint/windows_bidirectional_communication_via_telegram_bot.yml @@ -0,0 +1,67 @@ +name: Windows Bidirectional Communication via Telegram Bot +id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e +version: 1 +date: '2024-12-12' +author: Teoderick Contreras, Splunk +data_sources: +- Sysmon EventID 22 +type: Anomaly +status: production +description: The following analytic detects the use of DNS API calls associated with Telegram, which may indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network. +kind: endpoint +search: '`sysmon` EventCode=22 query = "api.telegram.org" + | stats count min(_time) as firstTime max(_time) as lastTime by query answer QueryResults QueryStatus process_name process_guid Computer + | rename Computer as dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_bidirectional_communication_via_telegram_bot_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: a third part automation using telegram API. +references: +- https://www.splunk.com/en_us/blog/security/threat-advisory-telegram-crypto-botnet-strt-ta01.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + confidence: 30 + impact: 30 + message: a DNS query to [$query$] on [$dest$]. + mitre_attack_id: + - T1102.002 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - QueryName + - QueryStatus + - ProcessId + - dest + risk_score: 9 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1102.002/telegram_api_dns/telegram_dns.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml new file mode 100644 index 0000000000..8c9a919006 --- /dev/null +++ b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml @@ -0,0 +1,74 @@ +name: Windows File and Directory Enable ReadOnly Permissions +id: 1ae407b0-a042-4eb0-834a-590da055575e +version: 1 +date: '2024-12-13' +author: Teoderick Contreras, Splunk +data_sources: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +type: TTP +status: production +description: The following analytic detects instances where file or folder permissions are modified to grant read-only access. Such changes are characterized by the presence of read-related permissions (e.g., R, REA, RA, RD) and the absence of write (W) or execute (E) permissions. Monitoring these events is crucial for tracking access control changes that could be intentional for restricting access or indicative of malicious behavior. Alerts generated by this detection help ensure that legitimate security measures are enforced while unauthorized changes are promptly investigated. +kind: endpoint +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name IN( "icacls.exe", "cacls.exe", "xcacls.exe") AND Processes.process IN ("*/grant*", "*/G*") AND Processes.process IN ("*SYSTEM*", "*admin*", "*S-1-1-0*", "*EVERYONE*") + by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | rex field=process ":\\((?[^)]+)\\)" + | eval has_write_execute=if(match(permission, "(W|GE|X|M|F)"), "true", "false") + | where has_write_execute="false" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_file_and_directory_enable_readonly_permissions_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or administrative scripts may use this application. Filter as needed. +references: +- https://www.splunk.com/en_us/blog/security/-applocker-rules-as-defense-evasion-complete-analysis.html +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - Crypto Stealer + asset_type: Endpoint + confidence: 80 + impact: 80 + message: A [$process_name$] was executed on [$dest$] attempting to change the access to a file or directory into readonly permissions. + mitre_attack_id: + - T1222.001 + observable: + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process + - Processes.process_guid + - Processes.process_name + - Processes.parent_process_name + - Processes.dest + - Processes.user + - Processes.parent_process + risk_score: 64 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/icacls_inheritance/icacls_process_1.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file From aa34aa3131f22d0fa82007d6b3febf7bf31170f5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 18 Dec 2024 16:11:24 +0100 Subject: [PATCH 08/82] crypto_campaign --- ...ws_account_access_removal_via_powershell_initiate_logoff.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml b/detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml index b72b7a53e2..f6347133d3 100644 --- a/detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml +++ b/detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml @@ -36,7 +36,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Powershell process having commandline [$ScriptBlockText$] used to logoff user on [$dest$]. + message: Powershell process having child process [$process_name$] used to logoff user on [$dest$]. mitre_attack_id: - T1531 - T1059.001 From 9153947933561e9ad71643c2368f484338895ac5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 8 Jan 2025 10:12:01 +0100 Subject: [PATCH 09/82] crypto_campaign --- ...indows_account_access_removal_via_logoff_exec.yml} | 8 ++++---- ...windows_dns_query_request_by_telegram_bot_api.yml} | 11 +++++++---- 2 files changed, 11 insertions(+), 8 deletions(-) rename detections/endpoint/{windows_account_access_removal_via_powershell_initiate_logoff.yml => windows_account_access_removal_via_logoff_exec.yml} (90%) rename detections/endpoint/{windows_bidirectional_communication_via_telegram_bot.yml => windows_dns_query_request_by_telegram_bot_api.yml} (74%) diff --git a/detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml b/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml similarity index 90% rename from detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml rename to detections/endpoint/windows_account_access_removal_via_logoff_exec.yml index f6347133d3..1e6afcd776 100644 --- a/detections/endpoint/windows_account_access_removal_via_powershell_initiate_logoff.yml +++ b/detections/endpoint/windows_account_access_removal_via_logoff_exec.yml @@ -1,4 +1,4 @@ -name: 'Windows Account Access Removal via Powershell Initiate Logoff' +name: 'Windows Account Access Removal via Logoff Exec' id: 223572ab-8768-4e20-9b39-c38707af80dc version: 1 date: '2024-12-17' @@ -11,12 +11,12 @@ status: production description: The following analytic detects the process of logging off a user through the use of the quser and logoff commands. By monitoring for these commands, the analytic identifies actions where a user session is forcibly terminated, which could be part of an administrative task or a potentially unauthorized access attempt. This detection helps identify potential misuse or malicious activity where a user’s access is revoked without proper authorization, providing insight into potential security incidents involving account management or session manipulation. kind: endpoint search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.parent_process_name = powershell.exe AND Processes.process_name = logoff.exe + where Processes.process_name = logoff.exe by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_account_access_removal_via_powershell_initiate_logoff_filter`' + | `windows_account_access_removal_via_logoff_exec_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: Administrators or power users may use this command. references: @@ -36,7 +36,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: Powershell process having child process [$process_name$] used to logoff user on [$dest$]. + message: Process having child process [$process_name$] used to logoff user on [$dest$]. mitre_attack_id: - T1531 - T1059.001 diff --git a/detections/endpoint/windows_bidirectional_communication_via_telegram_bot.yml b/detections/endpoint/windows_dns_query_request_by_telegram_bot_api.yml similarity index 74% rename from detections/endpoint/windows_bidirectional_communication_via_telegram_bot.yml rename to detections/endpoint/windows_dns_query_request_by_telegram_bot_api.yml index df76899b85..ea311fb08f 100644 --- a/detections/endpoint/windows_bidirectional_communication_via_telegram_bot.yml +++ b/detections/endpoint/windows_dns_query_request_by_telegram_bot_api.yml @@ -1,4 +1,4 @@ -name: Windows Bidirectional Communication via Telegram Bot +name: Windows DNS Query Request by Telegram Bot API id: 86f66f44-94d9-412d-a71d-5d8ed0fef72e version: 1 date: '2024-12-12' @@ -7,14 +7,14 @@ data_sources: - Sysmon EventID 22 type: Anomaly status: production -description: The following analytic detects the use of DNS API calls associated with Telegram, which may indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network. +description: The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network. kind: endpoint -search: '`sysmon` EventCode=22 query = "api.telegram.org" +search: '`sysmon` EventCode=22 query = "api.telegram.org" process_name != "telegram.exe" | stats count min(_time) as firstTime max(_time) as lastTime by query answer QueryResults QueryStatus process_name process_guid Computer | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_bidirectional_communication_via_telegram_bot_filter`' + | `windows_dns_query_request_by_telegram_bot_api_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and eventcode = 22 dnsquery executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: a third part automation using telegram API. references: @@ -37,6 +37,9 @@ tags: message: a DNS query to [$query$] on [$dest$]. mitre_attack_id: - T1102.002 + - T1071.004 + - T1071 + - T1102 observable: - name: dest type: Hostname From 185a5b8a109b0dc04339d4e2d9c881917e15c059 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 8 Jan 2025 10:32:39 +0100 Subject: [PATCH 10/82] crypto_campaign --- .../windows_file_and_directory_enable_readonly_permissions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml index 8c9a919006..7e903eff3c 100644 --- a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml +++ b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml @@ -15,7 +15,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | rex field=process ":\\((?[^)]+)\\)" - | eval has_write_execute=if(match(permission, "(W|GE|X|M|F)"), "true", "false") + | eval has_write_execute=if(match(permission, "(W|G|X|M|F|AD|DC)"), "true", "false") | where has_write_execute="false" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 7a46c66392a244cf4accc74d86376c98201614e5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 8 Jan 2025 10:41:44 +0100 Subject: [PATCH 11/82] crypto_campaign --- ...indows_file_and_directory_enable_readonly_permissions.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml index 7e903eff3c..14e1dbd4f0 100644 --- a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml +++ b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml @@ -15,8 +15,9 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | rex field=process ":\\((?[^)]+)\\)" - | eval has_write_execute=if(match(permission, "(W|G|X|M|F|AD|DC)"), "true", "false") - | where has_write_execute="false" + | eval has_read_execute=if(match(permission, "R"), "true", "false") + | eval has_write_execute=if(match(permission, "(W|G|X|M|F|AD|DC|DE)"), "true", "false") + | where has_write_execute="false" and has_read_execute = "true" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_and_directory_enable_readonly_permissions_filter`' From 4f75199c0955a13953467959a9dd8a474f23ec6b Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 8 Jan 2025 10:58:40 +0100 Subject: [PATCH 12/82] crypto_campaign --- ...windows_file_and_directory_enable_readonly_permissions.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml index 14e1dbd4f0..04d6c8fa53 100644 --- a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml +++ b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml @@ -15,9 +15,9 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | rex field=process ":\\((?[^)]+)\\)" - | eval has_read_execute=if(match(permission, "R"), "true", "false") + | eval has_read_attribute=if(match(permission, "R"), "true", "false") | eval has_write_execute=if(match(permission, "(W|G|X|M|F|AD|DC|DE)"), "true", "false") - | where has_write_execute="false" and has_read_execute = "true" + | where has_write_execute="false" and has_read_attribute = "true" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_and_directory_enable_readonly_permissions_filter`' From 1e781875acd9c0c0af598ee9501c01a64d85fd18 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 8 Jan 2025 11:12:15 +0100 Subject: [PATCH 13/82] crypto_campaign --- .../windows_file_and_directory_enable_readonly_permissions.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml index 04d6c8fa53..033dcfb9c8 100644 --- a/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml +++ b/detections/endpoint/windows_file_and_directory_enable_readonly_permissions.yml @@ -16,7 +16,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ | `drop_dm_object_name(Processes)` | rex field=process ":\\((?[^)]+)\\)" | eval has_read_attribute=if(match(permission, "R"), "true", "false") - | eval has_write_execute=if(match(permission, "(W|G|X|M|F|AD|DC|DE)"), "true", "false") + | eval has_write_execute=if(match(permission, "(W|GA|X|M|F|AD|DC|DE)"), "true", "false") | where has_write_execute="false" and has_read_attribute = "true" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From a8c3540aa8d060102091dd5975d72dc6cf5dfc73 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 8 Jan 2025 14:46:37 +0100 Subject: [PATCH 14/82] typo fixes and some logic update --- .../endpoint/linux_auditd_add_user_account.yml | 2 +- .../linux_auditd_add_user_account_type.yml | 2 +- .../linux_auditd_at_application_execution.yml | 2 +- .../linux_auditd_auditd_service_stop.yml | 4 ++-- .../linux_auditd_base64_decode_files.yml | 2 +- .../linux_auditd_change_file_owner_to_root.yml | 2 +- .../linux_auditd_clipboard_data_copy.yml | 2 +- .../linux_auditd_data_destruction_command.yml | 2 +- ...itd_data_transfer_size_limits_via_split.yml | 2 +- ..._transfer_size_limits_via_split_syscall.yml | 2 +- ...d_database_file_and_directory_discovery.yml | 2 +- .../linux_auditd_dd_file_overwrite.yml | 2 +- ...uditd_disable_or_modify_system_firewall.yml | 4 ++-- .../linux_auditd_doas_conf_file_creation.yml | 4 ++-- .../linux_auditd_doas_tool_execution.yml | 2 +- .../linux_auditd_edit_cron_table_parameter.yml | 2 +- ...nux_auditd_file_and_directory_discovery.yml | 2 +- ..._file_permission_modification_via_chmod.yml | 2 +- ...ile_permissions_modification_via_chattr.yml | 2 +- ...find_credentials_from_password_managers.yml | 2 +- ...d_find_credentials_from_password_stores.yml | 2 +- .../linux_auditd_find_private_keys.yml | 2 +- .../linux_auditd_find_ssh_private_keys.yml | 2 +- .../linux_auditd_hardware_addition_swapoff.yml | 2 +- ...d_hidden_files_and_directories_creation.yml | 2 +- ...sert_kernel_module_using_insmod_utility.yml | 2 +- ...ll_kernel_module_using_modprobe_utility.yml | 2 +- .../linux_auditd_kernel_module_enumeration.yml | 2 +- ...uditd_kernel_module_using_rmmod_utility.yml | 2 +- ...x_auditd_nopasswd_entry_in_sudoers_file.yml | 2 +- .../linux_auditd_osquery_service_stop.yml | 4 ++-- ...ess_or_modification_of_sshd_config_file.yml | 2 +- ...itd_possible_access_to_credential_files.yml | 2 +- ..._auditd_possible_access_to_sudoers_file.yml | 2 +- ..._cronjob_entry_on_existing_cronjob_file.yml | 4 ++-- ...nux_auditd_preload_hijack_library_calls.yml | 2 +- ..._auditd_preload_hijack_via_preload_file.yml | 4 ++-- .../linux_auditd_service_restarted.yml | 2 +- .../endpoint/linux_auditd_service_started.yml | 2 +- ...linux_auditd_setuid_using_chmod_utility.yml | 2 +- ...inux_auditd_setuid_using_setcap_utility.yml | 2 +- .../linux_auditd_shred_overwrite_command.yml | 2 +- .../endpoint/linux_auditd_stop_services.yml | 18 +++++++++--------- .../linux_auditd_sudo_or_su_execution.yml | 2 +- .../linux_auditd_sysmon_service_stop.yml | 4 ++-- ..._system_network_configuration_discovery.yml | 2 +- ...d_unix_shell_configuration_modification.yml | 4 ++-- ...linux_auditd_unload_module_via_modprobe.yml | 2 +- ...rtual_disk_file_and_directory_discovery.yml | 2 +- .../linux_auditd_whoami_user_discovery.yml | 2 +- ...shell_process___execution_policy_bypass.yml | 8 ++++---- .../print_spooler_failed_to_load_a_plug_in.yml | 2 +- ...installation_with_suspicious_parameters.yml | 6 +++--- ...ws_domain_admin_impersonation_indicator.yml | 2 +- ...s_service_creation_using_registry_entry.yml | 8 ++++---- playbooks/risk_notable_import_data.json | 2 +- playbooks/risk_notable_import_data.py | 2 +- 57 files changed, 81 insertions(+), 81 deletions(-) diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 3fd4de81ce..aca8ced3d0 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -9,7 +9,7 @@ description: The following analytic detects the creation of new user accounts on data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as dest | where LIKE (process_exec, "%useradd%") OR LIKE (process_exec, "%adduser%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index 19e183e33c..6080f61072 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -9,7 +9,7 @@ description: The following analytic detects the suspicious add user account type data_source: - Linux Auditd Add User search: '`linux_auditd` type=ADD_USER | rename hostname as dest| stats count min(_time) as firstTime max(_time) as lastTime by exe pid dest res UID type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_type_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index e142bdd4cf..63a79584b6 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -9,7 +9,7 @@ description: The following analytic detects the execution of the "At" applicatio data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/at","/usr/bin/atd") AND NOT (UID IN("daemon")) | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_at_application_execution_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/001/ diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index e90f3fec26..2f3a32c0b1 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -9,7 +9,7 @@ description: The following analytic detects the suspicious auditd service stop. data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP unit IN ("auditd") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_auditd_service_stop_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A service event - [$type$] event occured on host - [$dest$]. + message: A service event - [$type$] event occurred on host - [$dest$]. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index 907eb58b78..536a69b3b2 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious Base64 decode operations data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE(process_exec, "%base64%") AND (LIKE(process_exec, "%-d %") OR LIKE(process_exec, "% --d%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_base64_decode_files_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 3c8eba210c..07c7501efb 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -9,7 +9,7 @@ description: The following analytic detects the use of the 'chown' command to ch data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as dest | where LIKE (process_exec, "%chown %root%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_change_file_owner_to_root_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 8970534501..eea26987d2 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -9,7 +9,7 @@ description: The following analytic detects the use of the Linux 'xclip' command data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") OR LIKE(process_exec, "%-o%") OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, "%-selection %") OR LIKE(process_exec, "%sel %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_clipboard_data_copy_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed. references: - https://attack.mitre.org/techniques/T1115/ diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index e67774b5c1..fb2cb5fa5a 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -9,7 +9,7 @@ description: The following analytic detects the execution of a Unix shell comman data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND LIKE (process_exec, "%--no-preserve-root%") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: unknown references: - https://cert.gov.ua/article/3718487 diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index 820564df65..ee0c06ce7d 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious data transfer activities data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE(process_exec, "%split %") AND LIKE(process_exec, "% -b %") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index 9684772de3..b1edc0205e 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious data transfer activities data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm=split OR exe= "*/split" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_syscall_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index da49b339d6..bcf7f46933 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious database file and directo data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.db%") OR LIKE (process_exec, "%.sql%") OR LIKE (process_exec, "%.sqlite%") OR LIKE (process_exec, "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR LIKE (process_exec, "%.mdf%")OR LIKE (process_exec, "%.ndf%")OR LIKE (process_exec, "%.ldf%")OR LIKE (process_exec, "%.frm%")OR LIKE (process_exec, "%.idb%")OR LIKE (process_exec, "%.myd%")OR LIKE (process_exec, "%.myi%")OR LIKE (process_exec, "%.dbf%")OR LIKE (process_exec, "%.db2%")OR LIKE (process_exec, "%.dbc%")OR LIKE (process_exec, "%.fpt%")OR LIKE (process_exec, "%.ora%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index 3a60721624..4ed51e4a3f 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -9,7 +9,7 @@ description: The following analytic detects the use of the 'dd' command to overw data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%dd %") AND LIKE(process_exec, "% of=%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_dd_file_overwrite_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://gtfobins.github.io/gtfobins/dd/ diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index 84510717a5..9a72aac6c5 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -9,7 +9,7 @@ description: The following analytic detects the suspicious disable or modify sys data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_disable_or_modify_system_firewall_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A service event - [$type$] to disable or modify system firewall occured on host - [$dest$] . + message: A service event - [$type$] to disable or modify system firewall occurred on host - [$dest$] . mitre_attack_id: - T1562.004 - T1562 diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 50a5fde6ec..d8366159cb 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -9,7 +9,7 @@ description: The following analytic detects the creation of the doas.conf file o data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_doas_conf_file_creation_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://wiki.gentoo.org/wiki/Doas @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A [$type$] event occured on host - [$dest$] to create a doas.conf file. + message: A [$type$] event occurred on host - [$dest$] to create a doas.conf file. mitre_attack_id: - T1548.003 - T1548 diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index 934aa7c17d..72bec21b53 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -9,7 +9,7 @@ description: The following analytic detects the execution of the 'doas' tool on data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm=doas | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_doas_tool_execution_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://wiki.gentoo.org/wiki/Doas diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index 07d145ef1b..3369a4c80b 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -9,7 +9,7 @@ description: The following analytic detects the suspicious editing of cron jobs data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL SYSCALL=rename (comm IN ("crontab") OR exe IN ("*/crontab")) success=yes AND NOT (UID IN("daemon")) | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_edit_cron_table_parameter_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/003/ diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 408246dd45..ec265f42cb 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious file and directory discov data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.tif%") OR LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, "%.gif%") OR LIKE (process_exec, "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE (process_exec, "%.jif%")OR LIKE (process_exec, "%.jfif%")OR LIKE (process_exec, "%.jp2%")OR LIKE (process_exec, "%.jpx%")OR LIKE (process_exec, "%.j2k%")OR LIKE (process_exec, "%.j2c%")OR LIKE (process_exec, "%.fpx%")OR LIKE (process_exec, "%.pcd%")OR LIKE (process_exec, "%.png%")OR LIKE (process_exec, "%.flv%") OR LIKE (process_exec, "%.pdf%")OR LIKE (process_exec, "%.mp4%")OR LIKE (process_exec, "%.mp3%")OR LIKE (process_exec, "%.gifv%")OR LIKE (process_exec, "%.avi%")OR LIKE (process_exec, "%.mov%")OR LIKE (process_exec, "%.mpeg%")OR LIKE (process_exec, "%.wav%")OR LIKE (process_exec, "%.doc%")OR LIKE (process_exec, "%.docx%")OR LIKE (process_exec, "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE (process_exec, "%.svg%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_and_directory_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index c0930c2ab8..eb428c3c0e 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -22,7 +22,7 @@ search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename hos max(_time) as lastTime by process_exec proctitle dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permission_modification_via_chmod_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index fbbd639de3..4c46e7a037 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious file permissions modifica data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index d4897a6360..edf1c9f44e 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious attempts to find credenti data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 9adac7eebd..602f0ad3b5 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious attempts to find credenti data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%password%") OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, "%credential%")OR LIKE (process_exec, "%creds%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_find_private_keys.yml b/detections/endpoint/linux_auditd_find_private_keys.yml index 713ccc03a2..36f223e8d0 100644 --- a/detections/endpoint/linux_auditd_find_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_private_keys.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious attempts to find private data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%")OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_private_keys_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index 03daf2d62b..9435ba0ee7 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious attempts to find SSH priv data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%id_rsa%") OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_ssh_private_keys_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index b6b196b857..d44992d250 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -9,7 +9,7 @@ description: The following analytic detects the execution of the "swapoff" comma data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%swapoff %") AND LIKE(process_exec, "% -a%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_hardware_addition_swapoff_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: administrator may disable swapping of devices in a linux host. Filter is needed. references: - https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/overview-of-the-cyber-weapons-used-in-the-ukraine-russia-war/ diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index f4b313e1ab..1b748cba78 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious creation of hidden files data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml index c2c9ccc05c..eec408eae0 100644 --- a/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_auditd_insert_kernel_module_using_insmod_utility.yml @@ -19,7 +19,7 @@ search: '`linux_auditd` type=SYSCALL comm=insmod | rename host as dest | stats c success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_insert_kernel_module_using_insmod_utility_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index 9751b854ce..7bd5b274f9 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -9,7 +9,7 @@ description: The following analytic detects the installation of a Linux kernel m data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm=modprobe | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ diff --git a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml index c65b5ad0ef..43c97d4a6f 100644 --- a/detections/endpoint/linux_auditd_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_auditd_kernel_module_enumeration.yml @@ -19,7 +19,7 @@ search: '`linux_auditd` type=SYSCALL comm=lsmod | rename host as dest | stats c success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `linux_auditd_kernel_module_enumeration_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index 6c4145b1ef..f401ae1c76 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious use of the `rmmod` utilit data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm=rmmod | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_kernel_module_using_rmmod_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 37a7748495..b018346985 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -9,7 +9,7 @@ description: The following analytic detects the addition of NOPASSWD entries to data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, "%NOPASSWD%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_nopasswd_entry_in_sudoers_file_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index f8218b50a6..5ef5f252b7 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious stopping of the `osquery` data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_osquery_service_stop_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A service event - [$type$] event occured on host - [$dest$] to stop the osquery service. + message: A service event - [$type$] event occurred on host - [$dest$] to stop the osquery service. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index 5b1bb8f93a..1e6024027c 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious access or modification of data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. references: - https://www.hackingarticles.in/ssh-penetration-testing-port-22/ diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 7a393d7dc3..3a4a2cfde7 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -9,7 +9,7 @@ description: The following analytic detects attempts to access or dump the conte data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE (process_exec, "%shadow%") OR LIKE (process_exec, "%passwd%")) AND (LIKE (process_exec, "%cat %") OR LIKE (process_exec, "%nano %")OR LIKE (process_exec, "%vim %") OR LIKE (process_exec, "%vi %")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_credential_files_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 19ab4be8f0..6dfa906169 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -9,7 +9,7 @@ description: The following analytic detects potential access or modification of data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name="/etc/sudoers*" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_sudoers_file_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1548/003/ diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 93646f121e..82bb125034 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -19,7 +19,7 @@ search: '`linux_auditd` type=PATH name IN("*/etc/cron*", "*/var/spool/cron/*", " by name nametype OGID dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step @@ -45,7 +45,7 @@ tags: asset_type: Endpoint confidence: 70 impact: 70 - message: A [$type$] event has occured on host - [$dest$] to append a cronjob entry + message: A [$type$] event has occurred on host - [$dest$] to append a cronjob entry on an existing cronjob file. mitre_attack_id: - T1053.003 diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index b0b87780b3..9f9601d818 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -9,7 +9,7 @@ description: The following analytic detects the use of the LD_PRELOAD environmen data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%LD_PRELOAD%")| stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_library_calls_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5 diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index ed9d9ff948..0392e6f344 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious preload hijacking via the data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_via_preload_file_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 90 impact: 90 - message: A [$type$] event has occured on host - [$dest$] to modify the preload file. + message: A [$type$] event has occurred on host - [$dest$] to modify the preload file. mitre_attack_id: - T1574.006 - T1574 diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml index 87bbb2e1ec..827bb36175 100644 --- a/detections/endpoint/linux_auditd_service_restarted.yml +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -9,7 +9,7 @@ description: The following analytic detects the restarting or re-enabling of ser data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "%restart%") OR LIKE(process_exec, "%reenable%") OR LIKE(process_exec, "%reload%")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_service_restarted_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1543/003/ diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 127d703220..09f64c1243 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -9,7 +9,7 @@ description: The following analytic detects the suspicious service started. This data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "% start %") OR LIKE(process_exec, "% enable %")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_service_started_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml index c8ade3e08d..bf1be4bd81 100644 --- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -9,7 +9,7 @@ description: The following analytic detects the execution of the chmod utility t data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, "%chmod %") AND (LIKE (process_exec, "% u+s %") OR LIKE (process_exec, "% g+s %") OR LIKE (process_exec, "% 4777 %") OR LIKE (process_exec, "% 4577 %")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_chmod_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index dab576f585..7eba7152fe 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -9,7 +9,7 @@ description: The following analytic detects the execution of the 'setcap' utilit data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep %") OR LIKE (process_exec, "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p %") OR LIKE (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_setcap_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml index 21220aebad..20e89b1760 100644 --- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -9,7 +9,7 @@ description: The following analytic detects the execution of the 'shred' command data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, "%shred%") AND (LIKE (process_exec, "%-n%") OR LIKE (process_exec, "%-z%") OR LIKE (process_exec, "%-u%") OR LIKE (process_exec, "%-s%")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_shred_overwrite_command_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 745186a07a..702f5b4a55 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -1,15 +1,15 @@ name: Linux Auditd Stop Services id: 43bc9281-753b-4743-b4b7-60af84f085f3 -version: 2 -date: '2024-09-30' +version: 3 +date: '2024-12-16' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects attempts to stop or clear a service on Linux systems. It leverages data from Linux Auditd, focusing on processes like "systemctl," "service," and "svcadm" executing stop commands. This activity is significant as adversaries often terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability. +type: Hunting +description: The following analytic detects attempts to stop a service on Linux systems. It leverages data from Linux Auditd. This activity is significant as adversaries often stop or terminate security or critical services to disable defenses or disrupt operations, as seen in malware like Industroyer2. If confirmed malicious, this could lead to the disabling of security mechanisms, allowing attackers to persist, escalate privileges, or deploy destructive payloads, severely impacting system integrity and availability. data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_stop_services_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ @@ -30,9 +30,9 @@ tags: - AwfulShred - Compromised Linux Host asset_type: Endpoint - confidence: 70 - impact: 70 - message: A service event - [$type$] event occured on host - [$dest$] to stop or disable a service. + confidence: 30 + impact: 30 + message: A service event - [$type$] event occurred on host - [$dest$] to stop or disable a service. mitre_attack_id: - T1489 observable: @@ -51,7 +51,7 @@ tags: - UID - comm - exe - risk_score: 49 + risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index eb9bd249f1..7e6a5cadd3 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -9,7 +9,7 @@ description: The following analytic detects the execution of the "sudo" or "su" data_source: - Linux Auditd Proctitle search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%sudo %") OR LIKE(process_exec, "%su %") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sudo_or_su_execution_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1548/003/ diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index fe72f91575..f1c42a5312 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -9,7 +9,7 @@ description: The following analytic detects the suspicious sysmon service stop. data_source: - Linux Auditd Service Stop search: '`linux_auditd` type=SERVICE_STOP unit IN ("sysmon") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sysmon_service_stop_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html @@ -31,7 +31,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A service event - [$type$] event occured on host - [$dest$] to stop or disable the sysmon service. + message: A service event - [$type$] event occurred on host - [$dest$] to stop or disable the sysmon service. mitre_attack_id: - T1489 observable: diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index 2aa7efb626..0ed6958042 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious system network configurat data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss", "route") | bucket _time span=15m | rename host as dest | stats dc(comm) as unique_commands, values(comm) as comm, values(exe) as exe, values(SYSCALL) as SYSCALL, values(UID) as UID, values(ppid) as ppid, values(pid) as pid, count, min(_time) as firstTime, max(_time) as lastTime by success dest | where unique_commands >= 4 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_system_network_configuration_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 2d75516cb6..6957b46914 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious modifications to Unix she data_source: - Linux Auditd Path search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/profile.d", "/etc/bash.bashrc", "/etc/bashrc", "/etc/zsh/zprofile", "/etc/zsh/zshrc", "/etc/zsh/zlogin", "/etc/zsh/zlogout", "/etc/csh.cshrc", "/etc/csh.login", "/root/.bashrc", "/root/.bash_profile", "root/.profile", "/root/.zshrc", "/root/.zprofile", "/home/*/.bashrc", "/home/*/.zshrc", "/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login", "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_unix_shell_configuration_modification_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html @@ -32,7 +32,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 80 - message: A [$type$] event occured on host - [$dest$] to modify the unix shell configuration file. + message: A [$type$] event occurred on host - [$dest$] to modify the unix shell configuration file. mitre_attack_id: - T1546.004 - T1546 diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index f34589900d..004c43ae77 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious use of the `modprobe` com data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%modprobe%") AND LIKE (process_exec, "%-r %") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_unload_module_via_modprobe_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index cabae614c3..e5af078c4f 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -9,7 +9,7 @@ description: The following analytic detects suspicious discovery of virtual disk data_source: - Linux Auditd Execve search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, "%.vmdk%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index d2bf0d74d7..ca49aa1428 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -9,7 +9,7 @@ description: The following analytic detects the suspicious use of the whoami com data_source: - Linux Auditd Syscall search: '`linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest success | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_whoami_user_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 4bf7f6a5b3..b1c621918f 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,16 +1,16 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: 7 -date: '2024-09-30' +version: 8 +date: '2024-12-16' author: Rico Valdez, Mauricio Velazco, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects PowerShell processes initiated with parameters that bypass the local execution policy for scripts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing specific flags like "-ex" or "bypass." This activity is significant because bypassing execution policies is a common tactic used by attackers to run malicious scripts undetected. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to further system compromise, data exfiltration, or persistent access within the environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="* -ex*" OR Processes.process="* bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="* -ex*" AND Processes.process="* bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate. references: diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 6724c98beb..30eeab74ba 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -34,7 +34,7 @@ tags: - CVE-2021-34527 - CVE-2021-1675 impact: 80 - message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ with EventCode $EventCode$. + message: Suspicious printer spooler errors have occurred on endpoint $ComputerName$ with EventCode $EventCode$. mitre_attack_id: - T1547.012 - T1547 diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 0f82de52f1..b93fb7da28 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -1,7 +1,7 @@ name: Shim Database Installation With Suspicious Parameters id: 404620de-46d8-48b6-90cc-8a8d7b0876a3 -version: '7' -date: '2024-11-28' +version: 8 +date: '2024-12-16' author: David Dorsey, Splunk status: production type: TTP @@ -17,7 +17,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = sdbinst.exe NOT Processes.process IN ("\"C:\\Windows\\System32\\sdbinst.exe\"", "C:\\Windows\\System32\\sdbinst.exe", "*-mm", "*-?", "*-m -bg") by Processes.process_name Processes.parent_process_name Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `shim_database_installation_with_suspicious_parameters_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: None identified references: [] diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index aba0071eea..f2f62cc86d 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -33,7 +33,7 @@ search: '`wineventlog_security` EventCode=4627 LogonType=3 NOT TargetUserName I | fillnull value=NotDA username | search username = "NotDA" | `windows_domain_admin_impersonation_indicator_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Authentication events across all endpoints and ingest Event Id 4627. Specifically, - the Audit Group Membership subcategory within the Logon Logooff category needs to + the Audit Group Membership subcategory within the Logon Logoff category needs to be enabled. Its crucial to note that the accuracy and effectiveness of this detection heavily rely on the users diligence in populating and regularly updating this lookup table. diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index d1a040c81b..ed5eb41ae3 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,16 +1,16 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: 7 -date: '2024-12-08' +version: 8 +date: '2025-01-03' author: Teoderick Contreras, Splunk, Steven Dick status: production -type: TTP +type: Anomaly description: The following analytic detects the modification of registry keys that define Windows services using reg.exe. This detection leverages Splunk to search for specific keywords in the registry path, value name, and value data fields. This activity is significant because it indicates potential unauthorized changes to service configurations, a common persistence technique used by attackers. If confirmed malicious, this could allow an attacker to maintain access, escalate privileges, or move laterally within the network, leading to data theft, ransomware, or other damaging outcomes. data_source: - Sysmon EventID 12 - Sysmon EventID 13 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" Registry.registry_value_name + WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" Registry.registry_value_name = ImagePath) BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) diff --git a/playbooks/risk_notable_import_data.json b/playbooks/risk_notable_import_data.json index b88c0b461a..c9558e3e32 100644 --- a/playbooks/risk_notable_import_data.json +++ b/playbooks/risk_notable_import_data.json @@ -136,7 +136,7 @@ "errors": {}, "id": "1", "type": "end", - "userCode": "\t\n # Error handling in case of playbook not being able to import data properly\n if not format_summary_note:\n raise RuntimeError(\"Error occured during import data and summary note is missing\")\n \n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n", + "userCode": "\t\n # Error handling in case of playbook not being able to import data properly\n if not format_summary_note:\n raise RuntimeError(\"Error occurred during import data and summary note is missing\")\n \n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n", "x": 960, "y": 1800 }, diff --git a/playbooks/risk_notable_import_data.py b/playbooks/risk_notable_import_data.py index f699597c80..d12c554957 100644 --- a/playbooks/risk_notable_import_data.py +++ b/playbooks/risk_notable_import_data.py @@ -579,7 +579,7 @@ def on_finish(container, summary): # Error handling in case of playbook not being able to import data properly if not format_summary_note: - raise RuntimeError("Error occured during import data and summary note is missing") + raise RuntimeError("Error occurred during import data and summary note is missing") # This function is called after all actions are completed. # summary of all the action and/or all details of actions From f06f5cd618a7a592d22b48a7711e903e397b7f5a Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 9 Jan 2025 13:39:03 +0100 Subject: [PATCH 15/82] rename rule and enhance metadata --- ...g_registry_entry.yml => windows_service_creation.yml} | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) rename detections/endpoint/{windows_service_creation_using_registry_entry.yml => windows_service_creation.yml} (80%) diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation.yml similarity index 80% rename from detections/endpoint/windows_service_creation_using_registry_entry.yml rename to detections/endpoint/windows_service_creation.yml index ed5eb41ae3..b36adf5b71 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation.yml @@ -1,11 +1,11 @@ -name: Windows Service Creation Using Registry Entry +name: Windows Service Creation id: 25212358-948e-11ec-ad47-acde48001122 version: 8 date: '2025-01-03' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly -description: The following analytic detects the modification of registry keys that define Windows services using reg.exe. This detection leverages Splunk to search for specific keywords in the registry path, value name, and value data fields. This activity is significant because it indicates potential unauthorized changes to service configurations, a common persistence technique used by attackers. If confirmed malicious, this could allow an attacker to maintain access, escalate privileges, or move laterally within the network, leading to data theft, ransomware, or other damaging outcomes. +description: The following analytic detects modifications to the "ImagePath" registry value part of registry keys that define Windows services "HKLM\\System\\CurrentControlSet\\Services\\*". This activity can be significant because it indicates potential unauthorized service creation, a common persistence technique used by attackers. If confirmed malicious, this could allow an attacker to maintain access, escalate privileges, or move laterally within the network, leading to data theft, ransomware, or other damaging outcomes. data_source: - Sysmon EventID 12 - Sysmon EventID 13 @@ -14,13 +14,12 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime = ImagePath) BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`' + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: Third party tools may used this technique to create services - but not so common. +known_false_positives: Third party tools may used this technique to create services but not so common. references: - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md drilldown_searches: From 1f060bbddfcbb775b37a1c90c1504d986ff74b69 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 13 Jan 2025 22:20:46 +0100 Subject: [PATCH 16/82] update to analytics using net --- .../account_discovery_with_net_app.yml | 8 +- ...cmdline_tool_not_executed_in_cmd_shell.yml | 12 +-- .../domain_account_discovery_with_net_app.yml | 8 +- .../domain_group_discovery_with_net.yml | 8 +- .../endpoint/net_localgroup_discovery.yml | 8 +- .../remote_system_discovery_with_net.yml | 8 +- ...dows_attempt_to_stop_security_service.yml} | 18 ++--- ...e_local_administrator_account_via_net.yml} | 12 +-- ...dows_esx_admins_group_creation_via_net.yml | 12 +-- ...indows_excessive_service_stop_attempt.yml} | 12 +-- ...=> windows_excessive_usage_of_net_app.yml} | 10 +-- .../windows_group_discovery_via_net.yml | 75 +++++++++++++++++++ ..._network_connection_discovery_via_net.yml} | 8 +- ...ws_password_policy_discovery_with_net.yml} | 10 +-- ...ws_sensitive_group_discovery_with_net.yml} | 14 ++-- ...rvice_stop_via_net__and_sc_application.yml | 12 +-- ..._password_policy_to_unlimited_via_net.yml} | 19 ++--- ..._child_process_spawned_from_webserver.yml} | 12 +-- ....yml => windows_user_deletion_via_net.yml} | 10 +-- ....yml => windows_user_disabled_via_net.yml} | 10 +-- ...yml => windows_user_discovery_via_net.yml} | 10 +-- lookups/security_services.csv | 5 ++ macros/process_net.yml | 2 +- macros/process_sc.yml | 3 + 24 files changed, 195 insertions(+), 111 deletions(-) rename detections/endpoint/{attempt_to_stop_security_service.yml => windows_attempt_to_stop_security_service.yml} (75%) rename detections/endpoint/{create_local_admin_accounts_using_net_exe.yml => windows_create_local_administrator_account_via_net.yml} (72%) rename detections/endpoint/{excessive_service_stop_attempt.yml => windows_excessive_service_stop_attempt.yml} (73%) rename detections/endpoint/{excessive_usage_of_net_app.yml => windows_excessive_usage_of_net_app.yml} (84%) create mode 100644 detections/endpoint/windows_group_discovery_via_net.yml rename detections/endpoint/{network_connection_discovery_with_net.yml => windows_network_connection_discovery_via_net.yml} (86%) rename detections/endpoint/{password_policy_discovery_with_net.yml => windows_password_policy_discovery_with_net.yml} (69%) rename detections/endpoint/{elevated_group_discovery_with_net.yml => windows_sensitive_group_discovery_with_net.yml} (72%) rename detections/endpoint/{windows_valid_account_with_never_expires_password.yml => windows_set_account_password_policy_to_unlimited_via_net.yml} (83%) rename detections/endpoint/{detect_webshell_exploit_behavior.yml => windows_suspicious_child_process_spawned_from_webserver.yml} (95%) rename detections/endpoint/{deleting_of_net_users.yml => windows_user_deletion_via_net.yml} (91%) rename detections/endpoint/{disabling_net_user_account.yml => windows_user_disabled_via_net.yml} (91%) rename detections/endpoint/{local_account_discovery_with_net.yml => windows_user_discovery_via_net.yml} (79%) create mode 100644 macros/process_sc.yml diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index dd3ef42497..6e5ff417e4 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -1,11 +1,11 @@ name: Account Discovery With Net App id: 339805ce-ac30-11eb-b87d-acde48001122 -version: 7 -date: '2024-09-30' +version: 8 +date: '2025-01-13' author: Teoderick Contreras, Splunk, TheLawsOfChaos, Github Community -status: production +status: deprecated type: TTP -description: The following analytic detects potential account discovery activities using the 'net' command, commonly employed by malware like Trickbot for reconnaissance. It leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line patterns and process relationships. This activity is significant as it often precedes further malicious actions, such as lateral movement or privilege escalation. If confirmed malicious, attackers could gain valuable information about user accounts, enabling them to escalate privileges or move laterally within the network, posing a significant security risk. +description: The following analytic has been deprecated in favour of the more generic "45e52536-ae42-11eb-b5c6-acde48001122". The following analytic detects potential account discovery activities using the 'net' command, commonly employed by malware like Trickbot for reconnaissance. It leverages Endpoint Detection and Response (EDR) data, focusing on specific command-line patterns and process relationships. This activity is significant as it often precedes further malicious actions, such as lateral movement or privilege escalation. If confirmed malicious, attackers could gain valuable information about user accounts, enabling them to escalate privileges or move laterally within the network, posing a significant security risk. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index 798df38377..a0855e0861 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -1,16 +1,16 @@ -name: Cmdline Tool Not Executed In CMD Shell +name: Windows Cmdline Tool Execution From Non-Shell Process id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 -version: 5 -date: '2024-09-30' +version: 6 +date: '2025-01-13' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network. +type: Anomaly +description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" OR Processes.process_name = "systeminfo.exe" OR Processes.process_name = "net.exe" OR Processes.process_name = "net1.exe" OR Processes.process_name = "arp.exe" OR Processes.process_name = "nslookup.exe" OR Processes.process_name = "route.exe" OR Processes.process_name = "netstat.exe" OR Processes.process_name = "whoami.exe") AND NOT (Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" OR Processes.process_name = "systeminfo.exe" OR Processes.process_name = "net1.exe" OR Processes.process_name = "arp.exe" OR Processes.process_name = "nslookup.exe" OR Processes.process_name = "route.exe" OR Processes.process_name = "netstat.exe" OR Processes.process_name = "whoami.exe") AND NOT (Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name = "powershell.exe" OR Processes.parent_process_name = "powershell_ise.exe" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed. references: diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index aaff8ce6a9..e640567455 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -1,11 +1,11 @@ name: Domain Account Discovery With Net App id: 98f6a534-04c2-11ec-96b2-acde48001122 -version: 4 -date: '2024-09-30' +version: 5 +date: '2025-01-13' author: Teoderick Contreras, Mauricio Velazco, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query domain users. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt by adversaries to enumerate domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map out user accounts, potentially leading to further exploitation or lateral movement within the network. +description: This following analytic has been deprecated in favour of the generic version "". The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query domain users. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt by adversaries to enumerate domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map out user accounts, potentially leading to further exploitation or lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index f4dba5c26b..1b1c2d1460 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -1,11 +1,11 @@ name: Domain Group Discovery With Net id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 -version: 5 -date: '2024-12-11' +version: 6 +date: '2025-01-13' author: Mauricio Velazco, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic identifies the execution of `net.exe` with command-line arguments used to query domain groups, specifically `group /domain`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain groups, which is a common step in Active Directory Discovery. If confirmed malicious, this behavior could allow attackers to gain insights into the domain structure, aiding in further attacks such as privilege escalation or lateral movement. +description: This search has been deprecated in favour of the more generic analytic "Domain Group Discovery With Net". The following analytic identifies the execution of `net.exe` with command-line arguments used to query domain groups, specifically `group /domain`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain groups, which is a common step in Active Directory Discovery. If confirmed malicious, this behavior could allow attackers to gain insights into the domain structure, aiding in further attacks such as privilege escalation or lateral movement. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index 3a1e501a64..dbf16c85fa 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -1,11 +1,11 @@ name: Net Localgroup Discovery id: 54f5201e-155b-11ec-a6e2-acde48001122 -version: 4 -date: '2024-11-26' +version: 5 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic detects the execution of the `net localgroup` command, which is used to enumerate local group memberships on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it can indicate an attacker is gathering information about local group memberships, potentially to identify privileged accounts. If confirmed malicious, this behavior could lead to further privilege escalation or lateral movement within the network. +description: This search has been deprecated in favour of the more generic analytic "Domain Group Discovery With Net". The following analytic detects the execution of the `net localgroup` command, which is used to enumerate local group memberships on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it can indicate an attacker is gathering information about local group memberships, potentially to identify privileged accounts. If confirmed malicious, this behavior could lead to further privilege escalation or lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml index ba54daf19a..a9570ff02a 100644 --- a/detections/endpoint/remote_system_discovery_with_net.yml +++ b/detections/endpoint/remote_system_discovery_with_net.yml @@ -1,11 +1,11 @@ name: Remote System Discovery with Net id: 9df16706-04a2-41e2-bbfe-9b38b34409d3 -version: 4 -date: '2024-11-26' +version: 5 +date: '2025-01-13' author: Mauricio Velazco, Splunk -status: production +status: deprecated type: Hunting -description: The following analytic identifies the execution of `net.exe` or `net1.exe` with command-line arguments used to discover remote systems, such as `domain computers /domain`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out networked systems and Active Directory structures. If confirmed malicious, this behavior could lead to further network exploitation, privilege escalation, or lateral movement within the environment. +description: The following analytic has been deprecated in favour of two dedicated analytics "4dc3951f-b3f8-4f46-b412-76a483f72277" and "a23a0e20-0b1b-4a07-82e5-ec5f70811e7a" .The following analytic identifies the execution of `net.exe` or `net1.exe` with command-line arguments used to discover remote systems, such as `domain computers /domain`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries or Red Teams to map out networked systems and Active Directory structures. If confirmed malicious, this behavior could lead to further network exploitation, privilege escalation, or lateral movement within the environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml similarity index 75% rename from detections/endpoint/attempt_to_stop_security_service.yml rename to detections/endpoint/windows_attempt_to_stop_security_service.yml index a84ecb6ecc..1083c18407 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -1,16 +1,16 @@ -name: Attempt To Stop Security Service +name: Windows Attempt To Stop Security Service id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 -version: 7 -date: '2024-09-30' -author: Rico Valdez, Splunk +version: 8 +date: '2025-01-13' +author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production type: TTP -description: The following analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for processes involving the "sc.exe" command with the "stop" parameter. This activity is significant because disabling security services can undermine the organization's security posture, potentially leading to unauthorized access, data exfiltration, or further attacks like malware installation or privilege escalation. If confirmed malicious, this behavior could compromise the endpoint and the entire network, necessitating immediate investigation and response. +description: The following analytic detects attempts to stop security-related services on an endpoint, which may indicate malicious activity. It leverages data from Endpoint Detection and Response (EDR) agents, specifically searching for processes involving the "sc.exe" or "net.exe" command with the "stop" parameter or the PowerShell "Stop-Service" cmdlet. This activity is significant because disabling security services can undermine the organization's security posture, potentially leading to unauthorized access, data exfiltration, or further attacks like malware installation or privilege escalation. If confirmed malicious, this behavior could compromise the endpoint and the entire network, necessitating immediate investigation and response. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_net` OR `process_sc`) Processes.process="* stop *") OR Processes.process="*Stop-Service *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description | search category=security | `windows_attempt_to_stop_security_service_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: None identified. Attempts to disable security-related services should be identified and understood. references: @@ -34,8 +34,8 @@ tags: - Azorult - Trickbot asset_type: Endpoint - confidence: 50 - impact: 40 + confidence: 80 + impact: 80 message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. mitre_attack_id: - T1562.001 @@ -74,7 +74,7 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 20 + risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml similarity index 72% rename from detections/endpoint/create_local_admin_accounts_using_net_exe.yml rename to detections/endpoint/windows_create_local_administrator_account_via_net.yml index 5a6097eadc..118809b4c7 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -1,16 +1,16 @@ -name: Create local admin accounts using net exe +name: Windows Create Local Administrator Account Via Net id: b89919ed-fe5f-492c-b139-151bb162040e -version: 13 -date: '2024-11-26' +version: 14 +date: '2025-01-13' author: Bhavin Patel, Splunk status: production -type: TTP -description: The following analytic detects the creation of local administrator accounts using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes named net.exe or net1.exe with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate an attacker attempting to gain persistent access or escalate privileges. If confirmed malicious, this could lead to unauthorized access, data theft, or further system compromise. Review the process details, user context, and related artifacts to determine the legitimacy of the activity. +type: Anomaly +description: The following analytic detects the creation of a local administrator account using the "net.exe" command. It leverages Endpoint Detection and Response (EDR) data to identify processes named "net.exe" with the "/add" parameter and keywords related to administrator accounts. This activity is significant as it may indicate an attacker attempting to gain persistent access or escalate privileges. If confirmed malicious, this could lead to unauthorized access, data theft, or further system compromise. Review the process details, user context, and related artifacts to determine the legitimacy of the activity. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process=*/add* AND (Processes.process=*administrators* OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer* OR Processes.process=*Rendszergazda* OR Processes.process=*Администратор* OR Processes.process=*Administratör*) by Processes.process Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`' +search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process=*/add* AND (Processes.process IN ("*administrators*", "*administratoren*", "*administrateurs*", "*administrador*", "*amministratori*", "*administratorer*", "*Rendszergazda*", "*Администратор*", "*Administratör*") by Processes.process Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_create_local_administrator_account_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators often leverage net.exe to create admin accounts. references: [] diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index 8f258e1d94..61ff643051 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -1,14 +1,16 @@ name: Windows ESX Admins Group Creation via Net id: 3d7df60b-3332-4667-8090-afe03e08dce0 -version: 3 -date: '2024-11-26' +version: 4 +date: '2025-01-13' author: Michael Haag, Splunk +status: production +type: TTP data_source: - Sysmon EventID 1 -type: TTP -status: production +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 description: This analytic detects attempts to create an "ESX Admins" group using the Windows net.exe or net1.exe commands. This activity may indicate an attempt to exploit the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). Attackers can use this method to gain unauthorized access to ESXi hosts by recreating the "ESX Admins" group after its deletion from Active Directory. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*group \"ESX Admins\"*" OR Processes.process="*group ESX Admins*") AND Processes.process="*/add*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_esx_admins_group_creation_via_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" Processes.process="*ESX Admins*" AND Processes.process="*/add*" by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_esx_admins_group_creation_via_net_filter`' how_to_implement: To successfully implement this search, you need to be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: Legitimate administrators might create an "ESX Admins" group for valid reasons. Verify that the group creation is authorized and part of normal administrative tasks. Consider the context of the action, such as the user performing it and any related activities. references: diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/windows_excessive_service_stop_attempt.yml similarity index 73% rename from detections/endpoint/excessive_service_stop_attempt.yml rename to detections/endpoint/windows_excessive_service_stop_attempt.yml index 90dcb51e91..2ae9713bcd 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/windows_excessive_service_stop_attempt.yml @@ -1,16 +1,16 @@ -name: Excessive Service Stop Attempt +name: Windows Excessive Service Stop Attempt id: ae8d3f4a-acd7-11eb-8846-acde48001122 -version: 5 -date: '2024-09-30' +version: 6 +date: '2025-01-13' author: Teoderick Contreras, Splunk status: production -type: Anomaly -description: The following analytic detects multiple attempts to stop or delete services on a system using `net.exe`, `sc.exe`, or `net1.exe`. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window. This activity is significant as it may indicate an adversary attempting to disable security or critical services to evade detection and further their objectives. If confirmed malicious, this could lead to the attacker gaining persistence, escalating privileges, or disrupting essential services, thereby compromising the system's security posture. +type: TTP +description: The following analytic detects multiple attempts to stop or delete services on a system using `net.exe` or `sc.exe`. It leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and command-line executions within a one-minute window. This activity is significant as it may indicate an adversary attempting to disable security or critical services to evade detection and further their objectives. If confirmed malicious, this could lead to the attacker gaining persistence, escalating privileges, or disrupting essential services, thereby compromising the system's security posture. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name = "sc.exe" OR Processes.process_name = "net1.exe" AND Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (`process_net` OR `process_sc`) AND Processes.process="*stop*" OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name Processes.parent_process_name Processes.dest Processes.user _time span=1m | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_service_stop_attempt_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: unknown references: diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/windows_excessive_usage_of_net_app.yml similarity index 84% rename from detections/endpoint/excessive_usage_of_net_app.yml rename to detections/endpoint/windows_excessive_usage_of_net_app.yml index 9d5f2390f0..3cbb7b6a9d 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/windows_excessive_usage_of_net_app.yml @@ -1,16 +1,16 @@ -name: Excessive Usage Of Net App +name: Windows Excessive Usage Of Net App id: 45e52536-ae42-11eb-b5c6-acde48001122 -version: 4 -date: '2024-09-30' +version: 5 +date: '2025-01-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects excessive usage of `net.exe` or `net1.exe` within a one-minute interval. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This behavior is significant as it may indicate an adversary attempting to create, delete, or disable multiple user accounts rapidly, a tactic observed in Monero mining incidents. If confirmed malicious, this activity could lead to unauthorized user account manipulation, potentially compromising system integrity and enabling further malicious actions. +description: The following analytic detects excessive usage of `net.exe` within a one-minute interval. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This behavior is significant as it may indicate an adversary attempting to create, delete, or disable multiple user accounts rapidly, a tactic observed in Monero mining incidents. If confirmed malicious, this activity could lead to unauthorized user account manipulation, potentially compromising system integrity and enabling further malicious actions. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_excessive_usage_of_net_app_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: unknown. Filter as needed. Modify the time span as needed. references: diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml new file mode 100644 index 0000000000..10cb8b78e2 --- /dev/null +++ b/detections/endpoint/windows_group_discovery_via_net.yml @@ -0,0 +1,75 @@ +name: Domain Group Discovery With Net +id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 +version: 1 +date: '2025-01-13' +author: Michael Haag, Mauricio Velazco, Splunk +status: production +type: Hunting +description: The following analytic identifies the execution of `net.exe` with command-line arguments used to query global, local and domain groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local or domain groups, which is a common step in Active Directory or privileged accounts discovery. If confirmed malicious, this behavior could allow attackers to gain insights into the domain structure, aiding in further attacks such as privilege escalation or lateral movement. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*group* AND Processes.process=*/do*) AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://attack.mitre.org/techniques/T1069/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ +tags: + analytic_story: + - Windows Post-Exploitation + - Active Directory Discovery + - Prestige Ransomware + - Graceful Wipe Out Attack + - Rhysida Ransomware + - Cleo File Transfer Software + - Volt Typhoon + - IcedID + - Windows Discovery Techniques + - Azorult + asset_type: Endpoint + confidence: 50 + impact: 30 + message: Local or domain group enumeration on $dest$ by $user$ + mitre_attack_id: + - T1069 + - T1069.001 + - T1069.002 + observable: + - name: dest + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 15 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog \ No newline at end of file diff --git a/detections/endpoint/network_connection_discovery_with_net.yml b/detections/endpoint/windows_network_connection_discovery_via_net.yml similarity index 86% rename from detections/endpoint/network_connection_discovery_with_net.yml rename to detections/endpoint/windows_network_connection_discovery_via_net.yml index f708fb4466..61e696275a 100644 --- a/detections/endpoint/network_connection_discovery_with_net.yml +++ b/detections/endpoint/windows_network_connection_discovery_via_net.yml @@ -1,7 +1,7 @@ -name: Network Connection Discovery With Net +name: Windows Network Connection Discovery Via Net id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d -version: 4 -date: '2024-11-26' +version: 5 +date: '2025-01-13' author: Mauricio Velazco, Splunk status: production type: Hunting @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*use*) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*use) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_connection_discovery_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/windows_password_policy_discovery_with_net.yml similarity index 69% rename from detections/endpoint/password_policy_discovery_with_net.yml rename to detections/endpoint/windows_password_policy_discovery_with_net.yml index 669229a3a3..d85bbd0440 100644 --- a/detections/endpoint/password_policy_discovery_with_net.yml +++ b/detections/endpoint/windows_password_policy_discovery_with_net.yml @@ -1,16 +1,16 @@ -name: Password Policy Discovery with Net +name: Windows Password Policy Discovery with Net id: 09336538-065a-11ec-8665-acde48001122 -version: 5 -date: '2024-11-26' +version: 6 +date: '2025-01-13' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: Hunting -description: The following analytic identifies the execution of `net.exe` or `net1.exe` with command line arguments aimed at obtaining the domain password policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather information about Active Directory password policies. If confirmed malicious, this behavior could allow attackers to understand password complexity requirements, aiding in brute-force or password-guessing attacks, ultimately compromising user accounts and gaining unauthorized access to the network. +description: The following analytic identifies the execution of `net.exe` with command line arguments aimed at obtaining the computer or domain password policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather information about Active Directory password policies. If confirmed malicious, this behavior could allow attackers to understand password complexity requirements, aiding in brute-force or password-guessing attacks, ultimately compromising user accounts and gaining unauthorized access to the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "*accounts*" AND Processes.process = "*/domain*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `password_policy_discovery_with_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "*accounts" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_policy_discovery_with_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml similarity index 72% rename from detections/endpoint/elevated_group_discovery_with_net.yml rename to detections/endpoint/windows_sensitive_group_discovery_with_net.yml index 8b4862a20d..d02a2c241a 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -1,16 +1,16 @@ -name: Elevated Group Discovery With Net +name: Windows Sensitive Group Discovery With Net id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a -version: 4 -date: '2024-11-26' +version: 5 +date: '2025-01-13' author: Mauricio Velazco, Splunk status: production -type: TTP -description: The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query elevated domain groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to identify high-privileged users within Active Directory. If confirmed malicious, this behavior could lead to further attacks aimed at compromising privileged accounts, escalating privileges, or gaining unauthorized access to sensitive systems and data. +type: Anomaly +description: The following analytic detects the execution of `net.exe` with command-line arguments used to query elevated domain or sensitive groups. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to identify high-privileged users within Active Directory. If confirmed malicious, this behavior could lead to further attacks aimed at compromising privileged accounts, escalating privileges, or gaining unauthorized access to sensitive systems and data. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*group*" AND Processes.process="*/do*") (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns Admins*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" Processes.process IN ("*Domain Admins*", "*Enterprise Admins*", "*Schema Admins*", "*Account Operators*", "*Server Operators*", "*Protected Users*", "*Dns Admins*", "*Domain Computers*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_group_discovery_with_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: @@ -18,6 +18,7 @@ references: - https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory - https://adsecurity.org/?p=3658 - https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +- https://thedfirreport.com/2023/05/22/icedid-macro-ends-in-nokoyawa-ransomware/ drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -33,6 +34,7 @@ tags: - Volt Typhoon - Rhysida Ransomware - BlackSuit Ransomware + - IcedID asset_type: Endpoint confidence: 70 impact: 30 diff --git a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml index a610acb064..093c38aa47 100644 --- a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml +++ b/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml @@ -1,16 +1,16 @@ -name: Windows Service Stop Via Net and SC Application +name: Windows Service Stop Attempt id: 827af04b-0d08-479b-9b84-b7d4644e4b80 -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-13' author: Teoderick Contreras, Splunk status: production -type: Anomaly -description: The following analytic identifies attempts to stop services on a system using `net.exe` or `sc.exe`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, GUIDs, and command-line executions. This activity is significant as adversaries often terminate security or critical services to evade detection and further their objectives. If confirmed malicious, this behavior could allow attackers to disable security defenses, facilitate ransomware encryption, or disrupt essential services, leading to potential data loss or system compromise. +type: Hunting +description: The following analytic identifies attempts to stop services on a system using `net.exe`, `sc.exe` or the "Stop-Service" cmdlet. It leverages Endpoint Detection and Response (EDR) telemetry. This activity can be significant as adversaries often terminate security or critical services to evade detection and further their objectives. If confirmed malicious, this behavior could allow attackers to disable security defenses, facilitate ransomware encryption, or disrupt essential services, leading to potential data loss or system compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name = "sc.exe" OR Processes.original_file_name= "sc.exe" AND Processes.process="*stop*" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_via_net__and_sc_application_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_net` OR `process_sc`) Processes.process="* stop *") OR Processes.process="*Stop-Service *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_via_net__and_sc_application_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Windows OS or software may stop and restart services due to some critical update. references: diff --git a/detections/endpoint/windows_valid_account_with_never_expires_password.yml b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml similarity index 83% rename from detections/endpoint/windows_valid_account_with_never_expires_password.yml rename to detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml index a885aaf1ba..7d75a799ea 100644 --- a/detections/endpoint/windows_valid_account_with_never_expires_password.yml +++ b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml @@ -1,13 +1,13 @@ -name: Windows Valid Account With Never Expires Password +name: Windows Set Account Password Policy To Unlimited Via Net id: 73a931db-1830-48b3-8296-cd9cfa09c3c8 -version: '4' -date: '2024-11-28' -author: Teoderick Contreras, Splunk +version: 5 +date: '2025-01-13' +author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the use of net.exe to update user account policies to set passwords as non-expiring. It leverages data from Endpoint Detection - and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited". + and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited" or "/maxpwage:49710", which achieve a similar outcome theoretically. This activity is significant as it can indicate an attempt to maintain persistence, escalate privileges, evade defenses, or facilitate lateral movement. If confirmed malicious, this behavior could allow an attacker to maintain long-term access to @@ -19,11 +19,8 @@ data_source: - CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` AND Processes.process="* accounts *" AND Processes.process="* - /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `windows_valid_account_with_never_expires_password_filter`' + where `process_net` AND Processes.process="* accounts *" AND (Processes.process="* + /maxpwage:unlimited" OR Processes.process="/maxpwage:49710") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_set_account_password_policy_to_unlimited_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/detect_webshell_exploit_behavior.yml b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml similarity index 95% rename from detections/endpoint/detect_webshell_exploit_behavior.yml rename to detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml index 49baa8e1aa..eb4ad12a70 100644 --- a/detections/endpoint/detect_webshell_exploit_behavior.yml +++ b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml @@ -1,15 +1,15 @@ -name: Detect Webshell Exploit Behavior +name: Windows Suspicious Child Process Spawned From Web Server id: 22597426-6dbd-49bd-bcdc-4ec19857192f -version: '5' -date: '2024-11-28' +version: '6' +date: '2025-01-13' author: Steven Dick status: production type: TTP description: The following analytic identifies the execution of suspicious processes - typically associated with webshell activity on web servers. It detects when processes + typically associated with WebShell activity on web servers. It detects when processes like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes such as `w3wp.exe` or `nginx.exe`. This behavior is significant as it may indicate - an adversary exploiting a web application vulnerability to install a webshell, providing + an adversary exploiting a web application vulnerability to install a WebShell, providing persistent access and command execution capabilities. If confirmed malicious, this activity could allow attackers to maintain control over the compromised server, execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive @@ -29,7 +29,7 @@ search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, IN ("w3wp.exe", "http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe","tomcat*.exe")) by Processes.dest,Processes.user,Processes.parent_process,Processes.parent_process_name,Processes.process,Processes.process_name | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `detect_webshell_exploit_behavior_filter`' + | `windows_suspicious_child_process_spawned_from_webserver_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/windows_user_deletion_via_net.yml similarity index 91% rename from detections/endpoint/deleting_of_net_users.yml rename to detections/endpoint/windows_user_deletion_via_net.yml index a322d9c3e4..5a371e904d 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/windows_user_deletion_via_net.yml @@ -1,16 +1,16 @@ -name: Deleting Of Net Users +name: Windows User Deletion Via Net id: 1c8c6f66-acce-11eb-aafb-acde48001122 -version: 5 -date: '2024-09-30' +version: 6 +date: '2025-01-13' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the use of net.exe or net1.exe command-line to delete a user account on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line execution logs. This activity is significant as it may indicate an attempt to impair user accounts or cover tracks during lateral movement. If confirmed malicious, this could lead to unauthorized access removal, disruption of legitimate user activities, or concealment of adversarial actions, complicating incident response and forensic investigations. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" AND Processes.process="*/delete*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `deleting_of_net_users_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" AND Processes.process="*/delete*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_deletion_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: System administrators or scripts may delete user accounts via this technique. Filter as needed. references: diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/windows_user_disabled_via_net.yml similarity index 91% rename from detections/endpoint/disabling_net_user_account.yml rename to detections/endpoint/windows_user_disabled_via_net.yml index e7b75edae3..bdf3d0f53d 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/windows_user_disabled_via_net.yml @@ -1,16 +1,16 @@ -name: Disabling Net User Account +name: Windows User Disabled Via Net id: c0325326-acd6-11eb-98c2-acde48001122 -version: 5 -date: '2024-09-30' +version: 6 +date: '2025-01-13' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the use of the `net.exe` utility to disable a user account via the command line. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate an adversary's attempt to disrupt user availability, potentially as a precursor to further malicious actions. If confirmed malicious, this could lead to denial of service for legitimate users, aiding the attacker in maintaining control or covering their tracks. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" AND Processes.process="*/active:no*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process="*user*" AND Processes.process="*/active:no*" by Processes.process_name Processes.original_file_name Processes.dest Processes.user Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_disabled_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: unknown references: diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/windows_user_discovery_via_net.yml similarity index 79% rename from detections/endpoint/local_account_discovery_with_net.yml rename to detections/endpoint/windows_user_discovery_via_net.yml index c9a24daa9a..0e7a364c67 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/windows_user_discovery_via_net.yml @@ -1,8 +1,8 @@ -name: Local Account Discovery with Net +name: Windows User Discovery Via Net id: 5d0d4830-0133-11ec-bae3-acde48001122 -version: 4 -date: '2024-10-17' -author: Mauricio Velazco, Splunk +version: 5 +date: '2025-01-13' +author: Mauricio Velazco, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production type: Hunting description: The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments `user` or `users` to query local user accounts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate local users, which is a common step in situational awareness and Active Directory discovery. If confirmed malicious, this behavior could lead to further attacks, including privilege escalation and lateral movement within the network. @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process=*user OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `local_account_discovery_with_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process="*user" OR Processes.process="*users" OR Processes.process="*users *" OR Processes.process="*user *") AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_user_discovery_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: diff --git a/lookups/security_services.csv b/lookups/security_services.csv index b8982c6109..8aa2e35080 100644 --- a/lookups/security_services.csv +++ b/lookups/security_services.csv @@ -3,3 +3,8 @@ service,description,category *wscsvc*,Windows Security Center Service,security *windefend*,Windows Defender Service,security *sysmon*,Sysmon Driver,security +*csc_iseagent*,Cisco Secure Client - ISE Posture Agent,security +*csc_nvmagent*,Cisco Secure Client - Network Visibility Agent,security +*csc_umbrellaagent*,Cisco Secure Client - Umbrella Agent,security +*csc_swgagent*,Cisco Secure Client - Umbrella SWG Agent,security +*CiscoAMP*,Cisco Secure Endpoint,security diff --git a/macros/process_net.yml b/macros/process_net.yml index ca8bb9efa5..8ca4fcec5c 100644 --- a/macros/process_net.yml +++ b/macros/process_net.yml @@ -1,3 +1,3 @@ -definition: (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe" OR Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe") +definition: (Processes.process_name="net1.exe" OR Processes.original_file_name="net1.exe") description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ name: process_net \ No newline at end of file diff --git a/macros/process_sc.yml b/macros/process_sc.yml new file mode 100644 index 0000000000..c98f5c4685 --- /dev/null +++ b/macros/process_sc.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name="sc.exe" OR Processes.original_file_name="sc.exe") +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_sc \ No newline at end of file From efa8b09ad3ca7aa6f84411361807157c55eb0243 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 14 Jan 2025 19:34:31 +0100 Subject: [PATCH 17/82] update powershell analytics --- ...ct_critical_alerts_from_security_tools.yml | 8 +- .../endpoint/excel_spawning_powershell.yml | 9 +- .../excel_spawning_windows_script_host.yml | 7 +- .../microsoft_defender_atp_alerts.yml | 2 +- .../microsoft_defender_incident_alerts.yml | 2 +- ...ice_application_spawn_regsvr32_process.yml | 9 +- ...ice_application_spawn_rundll32_process.yml | 9 +- .../office_product_spawn_cmd_process.yml | 9 +- .../office_product_spawning_bitsadmin.yml | 9 +- .../office_product_spawning_certutil.yml | 9 +- .../office_product_spawning_mshta.yml | 9 +- ...e_product_spawning_windows_script_host.yml | 9 +- .../endpoint/office_product_spawning_wmic.yml | 7 +- ...ct_spawned_child_process_for_download.yml} | 8 +- ...indows_office_product_spawned_control.yml} | 14 +- ...> windows_office_product_spawned_msdt.yml} | 14 +- ..._product_spawned_rundll32_with_no_dll.yml} | 15 +- ...ffice_product_spawned_uncommon_process.yml | 133 ++++++++++++++++++ detections/endpoint/winword_spawning_cmd.yml | 9 +- .../endpoint/winword_spawning_powershell.yml | 9 +- .../winword_spawning_windows_script_host.yml | 9 +- macros/process_cscript.yml | 3 + macros/process_office_products.yml | 12 ++ macros/process_office_products_parent.yml | 3 + macros/process_powershell.yml | 2 +- macros/process_wscript.yml | 3 + 26 files changed, 240 insertions(+), 92 deletions(-) rename detections/endpoint/{office_document_spawned_child_process_to_download.yml => windows_office_product_spawned_child_process_for_download.yml} (89%) rename detections/endpoint/{office_spawning_control.yml => windows_office_product_spawned_control.yml} (85%) rename detections/endpoint/{windows_office_product_spawning_msdt.yml => windows_office_product_spawned_msdt.yml} (85%) rename detections/endpoint/{office_product_spawning_rundll32_with_no_dll.yml => windows_office_product_spawned_rundll32_with_no_dll.yml} (83%) create mode 100644 detections/endpoint/windows_office_product_spawned_uncommon_process.yml create mode 100644 macros/process_cscript.yml create mode 100644 macros/process_office_products.yml create mode 100644 macros/process_office_products_parent.yml create mode 100644 macros/process_wscript.yml diff --git a/detections/endpoint/detect_critical_alerts_from_security_tools.yml b/detections/endpoint/detect_critical_alerts_from_security_tools.yml index 1f4623df42..fb81228890 100644 --- a/detections/endpoint/detect_critical_alerts_from_security_tools.yml +++ b/detections/endpoint/detect_critical_alerts_from_security_tools.yml @@ -1,14 +1,14 @@ name: Detect Critical Alerts from Security Tools id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd -version: 1 -date: '2024-10-09' +version: 2 +date: '2025-01-13' author: Gowthamaraj Rajendran, Patrick Bareiss, Bhavin Patel, Bryan Pluta, Splunk -status: production +status: deprecated type: TTP data_source: - Windows Defender Alerts - MS365 Defender Incident Alerts -description: The following analytics is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model. **Note** - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. +description: The following analytic has been deprecated in favour of specific and dedicated product analytics such as "Microsoft Defender ATP Alerts". The following analytic is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model. **Note** - We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Alerts.description) as description values(Alerts.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id values(Alerts.severity) as severity values(Alerts.type) as type values(Alerts.severity_id) as severity_id values(Alerts.signature) as signature values(Alerts.signature_id) as signature_id values(Alerts.dest) as dest from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.src Alerts.user Alerts.id Alerts.vendor sourcetype | `drop_dm_object_name("Alerts")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | eval risk_score=case(severity="informational", 2, severity="low", 5, severity="medium", 10, severity="high", 50, severity="critical" , 100) | `detect_critical_alerts_from_security_tools_filter`' how_to_implement: In order to properly run this search, you to ingest alerts data from other security products such as Crowdstrike, Microsoft Defender, or Carbon Black using appropriate TAs for that technology. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary. The risk_score field is used to calculate the risk score for the alerts and the mitre_technique_id field is used to map the alerts to the MITRE ATT&CK framework is dynamically created by the detection when this is triggered. These fields need not be set in the adaptive response actions. known_false_positives: False positives may vary by endpoint protection tool; monitor and filter out the alerts that are not relevant to your environment. diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index b5a20e1c1c..563ea6d29a 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -1,11 +1,12 @@ name: Excel Spawning PowerShell id: 42d40a22-9be3-11eb-8f08-acde48001122 -version: '6' -date: '2024-11-28' +version: 7 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects Microsoft Excel spawning PowerShell, an +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects Microsoft Excel spawning PowerShell, an uncommon and suspicious behavior. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is "excel.exe" and the child process is PowerShell. This activity is significant diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index 6bf165787f..50d7f1336b 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -1,11 +1,12 @@ name: Excel Spawning Windows Script Host id: 57fe880a-9be3-11eb-9bf3-acde48001122 -version: '6' -date: '2024-11-28' +version: 7 +date: '2025-01-13' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic identifies instances where Microsoft Excel spawns +description: The following analytic has been deprecated in favour of a more generic approach. + The following analytic identifies instances where Microsoft Excel spawns Windows Script Host processes (`cscript.exe` or `wscript.exe`). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is `excel.exe`. This activity is significant diff --git a/detections/endpoint/microsoft_defender_atp_alerts.yml b/detections/endpoint/microsoft_defender_atp_alerts.yml index 20bd0b9e37..7afd85785e 100644 --- a/detections/endpoint/microsoft_defender_atp_alerts.yml +++ b/detections/endpoint/microsoft_defender_atp_alerts.yml @@ -15,7 +15,7 @@ search: ' `ms_defender_atp_alerts` (dest=* OR user=*)| eval tmp_evidence=json_ex | stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description src | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `microsoft_defender_atp_alerts_filter`' -how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. You will need to define the `ms_defender_atp_alerts` macro to point to the proper index that contains the ms:defender:atp:alerts sourcetype. **NOTE** - We also have a detection named `Detect Critical Alerts from Security Tools` that triggers on the same data and is written against the Alerts datamodel. Enabling both of these detections will result in duplicate risk/notable events, we recommend enabling only one of these detections. +how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsoft Security. This add-on will collect alerts using the ms:defender:atp:alerts sourcetype. You will need to define the `ms_defender_atp_alerts` macro to point to the proper index that contains the ms:defender:atp:alerts sourcetype. known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment. references: - https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents?view=o365-worldwide diff --git a/detections/endpoint/microsoft_defender_incident_alerts.yml b/detections/endpoint/microsoft_defender_incident_alerts.yml index 324d8b7573..986beed0d1 100644 --- a/detections/endpoint/microsoft_defender_incident_alerts.yml +++ b/detections/endpoint/microsoft_defender_incident_alerts.yml @@ -21,7 +21,7 @@ url = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "url")) | eval tmp_filtered_mv=mvfilter(json_extract(tmp_filtered_mv, "entityType") = "File"), fileName = mvmap(tmp_filtered_mv, spath(tmp_filtered_mv, "fileName")) | eval risk_score=case(severity="informational", 5, severity="low", 15, severity="medium", 25, severity="high", 50, true(), 2) | stats count min(_time) as firstTime max(_time) as lastTime values(fileName) as file_name values(severity) as severity values(processCommandLine) as process values(ipAddress) as ip_address values(registryKey) as registry_key values(url) as url values(mitreTechniques{}) as annotations.mitre_attack.mitre_technique_id values(signature) as signature values(user) as user values(risk_score) as risk_score by id description dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `microsoft_defender_incident_alerts_filter`' -how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsfot Security. This add-on will collect alerts using the ms365:defender:incident:alerts sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to point to the proper index that contains the ms365:defender:incident:alerts sourcetype. **NOTE** - We also have a detection named `Detect Critical Alerts from Security Tools` that triggers on the same data and is written against the Alerts datamodel. Enabling both of these detections will result in duplicate risk/notable events, we recommend enabling only one of these detections. +how_to_implement: In order to properly run this search, you need to ingest alerts data from Microsoft Defender, specifcally using the Splunk add-on for Microsfot Security. This add-on will collect alerts using the ms365:defender:incident:alerts sourcetype. You will need to define the `ms365_defender_incident_alerts` macro to point to the proper index that contains the ms365:defender:incident:alerts sourcetype. known_false_positives: False positives may vary based on Microsfot Defender configuration; monitor and filter out the alerts that are not relevant to your environment. references: - https://learn.microsoft.com/en-us/defender-xdr/api-list-incidents?view=o365-worldwide diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index d2a1d1f9d3..bcc5192bfa 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -1,11 +1,12 @@ name: Office Application Spawn Regsvr32 process id: 2d9fc90c-f11f-11eb-9300-acde48001122 -version: '7' -date: '2024-11-28' +version: 8 +date: '2025-01-13' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where an Office application +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where an Office application spawns a Regsvr32 process, which is often indicative of macro execution or malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is a known Office application. diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 9eb468df33..b4865e5899 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -1,11 +1,12 @@ name: Office Application Spawn rundll32 process id: 958751e4-9c5f-11eb-b103-acde48001122 -version: '7' -date: '2024-11-28' +version: 8 +date: '2025-01-13' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where an Office application +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where an Office application spawns a rundll32 process, which is often indicative of macro execution or malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is a known Office application. diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index f095e1101c..a0927c1844 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -1,11 +1,12 @@ name: Office Product Spawn CMD Process id: b8b19420-e892-11eb-9244-acde48001122 -version: 7 -date: '2024-09-30' +version: 8 +date: '2025-01-13' author: Teoderick Contreras, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects an Office product spawning a CMD process, which is indicative of a macro executing shell commands to download or run malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names. This activity is significant as it often signals the execution of malicious payloads, such as those seen in Trickbot spear-phishing campaigns. If confirmed malicious, this behavior could lead to unauthorized code execution, potentially compromising the system and allowing further malicious activities. +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects an Office product spawning a CMD process, which is indicative of a macro executing shell commands to download or run malicious code. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process names. This activity is significant as it often signals the execution of malicious payloads, such as those seen in Trickbot spear-phishing campaigns. If confirmed malicious, this behavior could lead to unauthorized code execution, potentially compromising the system and allowing further malicious activities. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index 940117145d..68a8cf0052 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -1,11 +1,12 @@ name: Office Product Spawning BITSAdmin id: e8c591f4-a6d7-11eb-8cf7-acde48001122 -version: '8' -date: '2024-11-28' +version: 9 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects any Windows Office Product spawning `bitsadmin.exe`, +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects any Windows Office Product spawning `bitsadmin.exe`, a behavior often associated with malware families like TA551 and IcedID. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant because `bitsadmin.exe` diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index c9b7f0f134..3c131b17a7 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -1,11 +1,12 @@ name: Office Product Spawning CertUtil id: 6925fe72-a6d5-11eb-9e17-acde48001122 -version: '8' -date: '2024-11-28' +version: 9 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects any Windows Office Product spawning `certutil.exe`, +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects any Windows Office Product spawning `certutil.exe`, a behavior often associated with malware families like TA551 and IcedID. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process relationships and command-line executions. The significance lies in the fact that `certutil.exe` diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 2965f3c20f..727712a09b 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -1,11 +1,12 @@ name: Office Product Spawning MSHTA id: 6078fa20-a6d2-11eb-b662-acde48001122 -version: '7' -date: '2024-11-28' +version: 8 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where a Microsoft Office +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where a Microsoft Office product spawns `mshta.exe`. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where the parent process is an Office application. This activity is significant because it is a common diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/endpoint/office_product_spawning_windows_script_host.yml index 2b93960b14..0a0e918fef 100644 --- a/detections/endpoint/office_product_spawning_windows_script_host.yml +++ b/detections/endpoint/office_product_spawning_windows_script_host.yml @@ -1,11 +1,12 @@ name: Office Product Spawning Windows Script Host id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 -version: '9' -date: '2024-11-28' +version: 10 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects an Office product spawning WScript.exe +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects an Office product spawning WScript.exe or CScript.exe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent processes. This activity is significant because it may indicate the execution of potentially diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index c9cc9e5120..6f4941e74a 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -1,11 +1,12 @@ name: Office Product Spawning Wmic id: ffc236d6-a6c9-11eb-95f1-acde48001122 -version: '9' -date: '2024-11-28' +version: 10 +date: '2025-01-13' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects any Windows Office Product spawning `wmic.exe`, +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic detects any Windows Office Product spawning `wmic.exe`, specifically when the command-line of `wmic.exe` contains `wmic process call create`. This behavior is identified using data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml similarity index 89% rename from detections/endpoint/office_document_spawned_child_process_to_download.yml rename to detections/endpoint/windows_office_product_spawned_child_process_for_download.yml index 1eef641d0b..67916f2880 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml @@ -1,7 +1,7 @@ -name: Office Document Spawned Child Process To Download +name: Windows Office Product Spawned Child Process For Download id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 -version: 8 -date: '2024-09-30' +version: 9 +date: '2025-01-14' author: Teoderick Contreras, Splunk status: production type: TTP @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe") Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe") Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_child_process_for_download_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Default browser not in the filter list. references: diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/windows_office_product_spawned_control.yml similarity index 85% rename from detections/endpoint/office_spawning_control.yml rename to detections/endpoint/windows_office_product_spawned_control.yml index 9546f5e133..2bec8c5dd6 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/endpoint/windows_office_product_spawned_control.yml @@ -1,7 +1,7 @@ -name: Office Spawning Control +name: Windows Office Product Spawned Control id: 053e027c-10c7-11ec-8437-acde48001122 -version: '8' -date: '2024-11-28' +version: 9 +date: '2025-01-14' author: Michael Haag, Splunk status: production type: TTP @@ -17,13 +17,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)`| `office_spawning_control_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `windows_office_product_spawned_control_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_office_product_spawning_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml similarity index 85% rename from detections/endpoint/windows_office_product_spawning_msdt.yml rename to detections/endpoint/windows_office_product_spawned_msdt.yml index d8c51b1823..99a38b7c32 100644 --- a/detections/endpoint/windows_office_product_spawning_msdt.yml +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -1,7 +1,7 @@ -name: Windows Office Product Spawning MSDT +name: Windows Office Product Spawned MSDT id: 127eba64-c981-40bf-8589-1830638864a7 -version: '8' -date: '2024-11-28' +version: 0 +date: '2025-01-14' author: Michael Haag, Teoderick Contreras, Splunk status: production type: TTP @@ -17,13 +17,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process_name - Processes.parent_process Processes.process_name Processes.original_file_name Processes.process - Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawning_msdt_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_msdt_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml similarity index 83% rename from detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml rename to detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml index 794babfd6f..15b754c31b 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml @@ -1,7 +1,7 @@ -name: Office Product Spawning Rundll32 with no DLL +name: Windows Office Product Spawned Rundll32 With No DLL id: c661f6be-a38c-11eb-be57-acde48001122 -version: '8' -date: '2024-11-28' +version: 9 +date: '2025-01-14' author: Michael Haag, Splunk status: production type: TTP @@ -17,14 +17,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name - IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", - "msaccess.exe", "Graph.exe","winproj.exe") `process_rundll32` (Processes.process!=*.dll*) - by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process - Processes.process_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `office_product_spawning_rundll32_with_no_dll_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") `process_rundll32` (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_rundll32_with_no_dll_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml new file mode 100644 index 0000000000..fe3b519c03 --- /dev/null +++ b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml @@ -0,0 +1,133 @@ +name: Windows Office Product Spawned Uncommon Process +id: 55d8741c-fa32-4692-8109-410304961eb8 +version: 1 +date: '2025-01-13' +author: Michael Haag, Teoderick Contreras, Splunk +status: production +type: TTP +description: The following analytic detects a Microsoft Office product spawning uncommon processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where Office applications are the parent process. This activity is significant as it may indicate an attempt of a malicious macro execution or exploitation of an unknown vulnerability in an office product, in order to bypass security controls. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further lateral movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") AND (`process_bitsadmin` OR `process_certutil` OR `process_cmd` OR `process_cscript` OR `process_mshta` OR `process_powershell` OR `process_regsvr32` OR `process_rundll32` OR `process_wmic` OR `process_wscript`) by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_uncommon_process_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. +known_false_positives: False positives should be limited, however filter as needed. +references: +- https://any.run/malware-trends/trickbot +- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe +- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/ +- https://attack.mitre.org/techniques/T1047/ +- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ +- https://blog.cluster25.duskrise.com/2022/09/23/in-the-footsteps-of-the-fancy-bear-powerpoint-graphite/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md +- https://redcanary.com/threat-detection-report/threats/TA551/ +- https://twitter.com/cyb3rops/status/1416050325870587910?s=21 +- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing +- https://www.joesandbox.com/analysis/380662/0/html +- https://www.joesandbox.com/analysis/702680/0/html +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +tags: + analytic_story: + - AgentTesla + - Azorult + - Compromised Windows Host + - CVE-2023-21716 Word RTF Heap Corruption + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + - DarkCrystal RAT + - FIN7 + - IcedID + - NjRAT + - PlugX + - Qakbot + - Remcos + - Spearphishing Attachments + - Trickbot + - Warzone RAT + asset_type: Endpoint + confidence: 100 + impact: 100 + message: Office process $parent_process_name$ spawned a potentially suspicious child + process $process_name$ with process id $process_id$ in host $dest$ + mitre_attack_id: + - T1566 + - T1566.001 + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Process + role: + - Attacker + - name: process_name + type: Process + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 100 + security_domain: endpoint +tests: +- name: True Positive Test - Macro + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test - IcedId + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/icedid/phish_icedid/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog + update_timestamp: true +- name: True Positive Test - TrickBot + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 0379596615..ea5336cf1b 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -1,11 +1,12 @@ name: Winword Spawning Cmd id: 6fcbaedc-a37b-11eb-956b-acde48001122 -version: '6' -date: '2024-11-28' +version: 7 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Word (winword.exe) +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where Microsoft Word (winword.exe) spawns the command prompt (cmd.exe). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is winword.exe. This activity is significant because it is uncommon and diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 001d2338b3..91d719d427 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -1,11 +1,12 @@ name: Winword Spawning PowerShell id: b2c950b8-9be2-11eb-8658-acde48001122 -version: '6' -date: '2024-11-28' +version: 7 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Word (winword.exe) +description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". + The following analytic identifies instances where Microsoft Word (winword.exe) spawns a PowerShell process. This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is winword.exe. This activity is significant because it is uncommon and diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index 6ac533acc8..52d3046d40 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -1,11 +1,12 @@ name: Winword Spawning Windows Script Host id: 637e1b5c-9be1-11eb-9c32-acde48001122 -version: '5' -date: '2024-11-28' +version: 6 +date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP -description: The following analytic identifies instances where Microsoft Winword.exe +description: The following analytic has been deprecated in favour of a more generic approach. + The following analytic identifies instances where Microsoft Winword.exe spawns Windows Script Host processes (cscript.exe or wscript.exe). This behavior is detected using Endpoint Detection and Response (EDR) telemetry, focusing on process creation events where the parent process is Winword.exe. This activity is significant diff --git a/macros/process_cscript.yml b/macros/process_cscript.yml new file mode 100644 index 0000000000..ea60a34a73 --- /dev/null +++ b/macros/process_cscript.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=cscript.exe OR Processes.original_file_name=cscript.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_cscript diff --git a/macros/process_office_products.yml b/macros/process_office_products.yml new file mode 100644 index 0000000000..c5ad1f758c --- /dev/null +++ b/macros/process_office_products.yml @@ -0,0 +1,12 @@ +definition: (Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_office_products + + +("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") + +(Processes.parent_process_name IN ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe")) + + +Processes.process_name +Processes.original_file_name \ No newline at end of file diff --git a/macros/process_office_products_parent.yml b/macros/process_office_products_parent.yml new file mode 100644 index 0000000000..fd0277400d --- /dev/null +++ b/macros/process_office_products_parent.yml @@ -0,0 +1,3 @@ +definition: (Processes.parent_process_name IN ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe")) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_office_products_parent \ No newline at end of file diff --git a/macros/process_powershell.yml b/macros/process_powershell.yml index e90bfb853e..f5b56bebd7 100644 --- a/macros/process_powershell.yml +++ b/macros/process_powershell.yml @@ -1,3 +1,3 @@ -definition: (Processes.process_name=pwsh.exe OR Processes.process_name=sqlps.exe OR Processes.process_name=sqltoolsps.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE) +definition: (Processes.process_name=pwsh.exe OR Processes.process_name=powershell.exe OR Processes.process_name=powershell_ise.exe OR Processes.original_file_name=pwsh.dll OR Processes.original_file_name=PowerShell.EXE OR Processes.original_file_name=powershell_ise.EXE) description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ name: process_powershell \ No newline at end of file diff --git a/macros/process_wscript.yml b/macros/process_wscript.yml new file mode 100644 index 0000000000..2ec5d68963 --- /dev/null +++ b/macros/process_wscript.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=wscript.exe OR Processes.original_file_name=wscript.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_wscript From 4f16cb3115ee2786cdf927c709217245d9744b60 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Tue, 14 Jan 2025 20:02:52 +0100 Subject: [PATCH 18/82] update office macro --- ...e_product_spawned_child_process_for_download.yml | 2 +- .../windows_office_product_spawned_control.yml | 2 +- .../windows_office_product_spawned_msdt.yml | 2 +- ..._office_product_spawned_rundll32_with_no_dll.yml | 2 +- ...dows_office_product_spawned_uncommon_process.yml | 2 +- macros/process_office_products.yml | 13 ++----------- macros/process_office_products_parent.yml | 2 +- 7 files changed, 8 insertions(+), 17 deletions(-) diff --git a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml index 67916f2880..05cd8c0c25 100644 --- a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml +++ b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", "Graph.exe","winproj.exe") Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_child_process_for_download_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_child_process_for_download_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Default browser not in the filter list. references: diff --git a/detections/endpoint/windows_office_product_spawned_control.yml b/detections/endpoint/windows_office_product_spawned_control.yml index 2bec8c5dd6..e69030ff03 100644 --- a/detections/endpoint/windows_office_product_spawned_control.yml +++ b/detections/endpoint/windows_office_product_spawned_control.yml @@ -17,7 +17,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `windows_office_product_spawned_control_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `windows_office_product_spawned_control_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_office_product_spawned_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml index 99a38b7c32..0f67d0dab1 100644 --- a/detections/endpoint/windows_office_product_spawned_msdt.yml +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -17,7 +17,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_msdt_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_msdt_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml index 15b754c31b..53b0bfcd5c 100644 --- a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml +++ b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml @@ -17,7 +17,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") `process_rundll32` (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_rundll32_with_no_dll_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` `process_rundll32` (Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_rundll32_with_no_dll_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml index fe3b519c03..6ff3bac2c6 100644 --- a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml +++ b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name IN ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") AND (`process_bitsadmin` OR `process_certutil` OR `process_cmd` OR `process_cscript` OR `process_mshta` OR `process_powershell` OR `process_regsvr32` OR `process_rundll32` OR `process_wmic` OR `process_wscript`) by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_uncommon_process_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` AND (`process_bitsadmin` OR `process_certutil` OR `process_cmd` OR `process_cscript` OR `process_mshta` OR `process_powershell` OR `process_regsvr32` OR `process_rundll32` OR `process_wmic` OR `process_wscript`) by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawned_uncommon_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: False positives should be limited, however filter as needed. references: diff --git a/macros/process_office_products.yml b/macros/process_office_products.yml index c5ad1f758c..d161fca52c 100644 --- a/macros/process_office_products.yml +++ b/macros/process_office_products.yml @@ -1,12 +1,3 @@ -definition: (Processes.process_name=ping.exe OR Processes.original_file_name=ping.exe) +definition: (Processes.process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") OR Processes.original_file_name IN ("EQNEDT32.EXE", "Excel.exe", "Graph.exe", "MSACCESS.EXE", "MSPUB.EXE", "OneNote.exe", "OneNoteIm.exe", "OneNoteM.exe", "OUTLOOK.EXE", "POWERPNT.EXE", "VISIO.EXE", "WinProj.exe", "WinWord.exe")) description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ -name: process_office_products - - -("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") - -(Processes.parent_process_name IN ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe")) - - -Processes.process_name -Processes.original_file_name \ No newline at end of file +name: process_office_products \ No newline at end of file diff --git a/macros/process_office_products_parent.yml b/macros/process_office_products_parent.yml index fd0277400d..c4cd308613 100644 --- a/macros/process_office_products_parent.yml +++ b/macros/process_office_products_parent.yml @@ -1,3 +1,3 @@ -definition: (Processes.parent_process_name IN ("excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "onenoteviewer.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe")) +definition: (Processes.parent_process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe")) description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ name: process_office_products_parent \ No newline at end of file From 082368e86dde0ce5b22e03a87fa75a0b0b652856 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 15 Jan 2025 15:55:16 +0100 Subject: [PATCH 19/82] update reg analytics --- ...dential_dump_from_registry_via_reg_exe.yml | 9 +++--- ...ows_registry_entries_exported_via_reg.yml} | 6 ++-- ...ows_registry_entries_restored_via_reg.yml} | 8 ++--- ...ve_registry_hive_dump_via_commandline.yml} | 29 ++++++++++++------- macros/process_regedit.yml | 3 ++ 5 files changed, 34 insertions(+), 21 deletions(-) rename detections/endpoint/{windows_query_registry_reg_save.yml => windows_registry_entries_exported_via_reg.yml} (71%) rename detections/endpoint/{windows_modify_registry_reg_restore.yml => windows_registry_entries_restored_via_reg.yml} (85%) rename detections/endpoint/{extraction_of_registry_hives.yml => windows_sensitive_registry_hive_dump_via_commandline.yml} (74%) create mode 100644 macros/process_regedit.yml diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 0c3559dd49..bf4321d0a1 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,11 +1,12 @@ name: Attempted Credential Dump From Registry via Reg exe id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 -version: '11' -date: '2024-11-28' +version: 12 +date: '2025-01-15' author: Patrick Bareiss, Splunk -status: production +status: deprecated type: TTP -description: The following analytic detects the execution of reg.exe with parameters +description: The following analytic has been deprecated in favour of "8bbb7d58-b360-11eb-ba21-acde48001122". + The following analytic detects the execution of reg.exe with parameters that export registry keys containing hashed credentials. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving reg.exe or cmd.exe with specific registry paths. This activity is significant diff --git a/detections/endpoint/windows_query_registry_reg_save.yml b/detections/endpoint/windows_registry_entries_exported_via_reg.yml similarity index 71% rename from detections/endpoint/windows_query_registry_reg_save.yml rename to detections/endpoint/windows_registry_entries_exported_via_reg.yml index 62d4a5536e..ebdf080905 100644 --- a/detections/endpoint/windows_query_registry_reg_save.yml +++ b/detections/endpoint/windows_registry_entries_exported_via_reg.yml @@ -1,16 +1,16 @@ -name: Windows Query Registry Reg Save +name: Windows Registry Entries Exported Via Reg id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 version: 3 date: '2024-10-17' author: Teoderick Contreras, Splunk status: production type: Hunting -description: The following analytic detects the execution of the reg.exe process with the "save" parameter. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because threat actors often use the "reg save" command to dump credentials or test registry modification capabilities on compromised hosts. If confirmed malicious, this behavior could allow attackers to escalate privileges, persist in the environment, or access sensitive information stored in the registry. +description: The following analytic detects the execution of the reg.exe process with either the "save" or "export" parameters. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant because threat actors often use the "reg save" or "reg export" command to dump credentials or test registry modification capabilities on compromised hosts. If confirmed malicious, this behavior could allow attackers to escalate privileges, persist in the environment, or access sensitive information stored in the registry. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process = "* save *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_reg_save_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process IN ("* save *", "* export *") by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_exported_via_reg_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries. references: diff --git a/detections/endpoint/windows_modify_registry_reg_restore.yml b/detections/endpoint/windows_registry_entries_restored_via_reg.yml similarity index 85% rename from detections/endpoint/windows_modify_registry_reg_restore.yml rename to detections/endpoint/windows_registry_entries_restored_via_reg.yml index 5e6a9ed246..a443300194 100644 --- a/detections/endpoint/windows_modify_registry_reg_restore.yml +++ b/detections/endpoint/windows_registry_entries_restored_via_reg.yml @@ -1,7 +1,7 @@ -name: Windows Modify Registry Reg Restore +name: Windows Registry Entries Restored Via Reg id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e -version: 3 -date: '2024-10-17' +version: 4 +date: '2025-01-14' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process = "* restore *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_reg_restore_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process = "* restore *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_registry_entries_restored_via_reg_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: network administrator can use this command tool to backup registry before updates or modifying critical registries. references: diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml similarity index 74% rename from detections/endpoint/extraction_of_registry_hives.yml rename to detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index ae858df02b..777938da61 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -1,8 +1,8 @@ -name: Extraction of Registry Hives +name: Windows Sensitive Registry Hive Dump Via CommandLine id: 8bbb7d58-b360-11eb-ba21-acde48001122 -version: 4 -date: '2024-09-30' -author: Michael Haag, Splunk +version: 5 +date: '2025-01-15' +author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk status: production type: TTP description: The following analytic detects the use of `reg.exe` to export Windows Registry hives, which may contain sensitive credentials. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving `save` or `export` actions targeting the `sam`, `system`, or `security` hives. This activity is significant as it indicates potential offline credential access attacks, often executed from untrusted processes or scripts. If confirmed malicious, attackers could gain access to credential data, enabling further compromise and lateral movement within the network. @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save* OR Processes.process=*export*) AND (Processes.process="*\sam *" OR Processes.process="*\system *" OR Processes.process="*\security *") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` AND (Processes.process=*save* OR Processes.process=*export*)) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND (Processes.process="*HKEY_LOCAL_MACHINE*" OR Processes.process="*HKLM*") AND (Processes.process="*\sam*" OR Processes.process="*\system*" OR Processes.process="*\security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: It is possible some agent based products will generate false positives. Filter as needed. references: @@ -28,15 +28,19 @@ drilldown_searches: latest_offset: $info_max_time$ tags: analytic_story: - - Volt Typhoon - - Credential Dumping - - CISA AA23-347A - - DarkSide Ransomware - CISA AA22-257A + - CISA AA23-347A + - Compromised Windows Host + - Credential Dumping + - DarkSide Ransomware + - Data Destruction + - Industroyer2 + - Volt Typhoon + - Windows Registry Abuse asset_type: Endpoint confidence: 70 impact: 80 - message: Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ + message: Suspicious use of `reg.exe` or `regedit.exe` to export sensitive registry hives that could potentially contain credentials, executed on $dest$ by user $user$, with a parent process of $parent_process_name$ mitre_attack_id: - T1003.002 - T1003 @@ -78,3 +82,8 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log + source: crowdstrike + sourcetype: crowdstrike:events:sensor diff --git a/macros/process_regedit.yml b/macros/process_regedit.yml new file mode 100644 index 0000000000..c611ec65d8 --- /dev/null +++ b/macros/process_regedit.yml @@ -0,0 +1,3 @@ +definition: (Processes.process_name=regedit.exe OR Processes.original_file_name=REGEDIT.exe) +description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ +name: process_regedit From c91f76b9ab7c0c09f038ca00eb25b677653cf772 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 15 Jan 2025 15:55:51 +0100 Subject: [PATCH 20/82] Update windows_registry_entries_exported_via_reg.yml --- .../endpoint/windows_registry_entries_exported_via_reg.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_registry_entries_exported_via_reg.yml b/detections/endpoint/windows_registry_entries_exported_via_reg.yml index ebdf080905..b8bc479897 100644 --- a/detections/endpoint/windows_registry_entries_exported_via_reg.yml +++ b/detections/endpoint/windows_registry_entries_exported_via_reg.yml @@ -1,7 +1,7 @@ name: Windows Registry Entries Exported Via Reg id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 -version: 3 -date: '2024-10-17' +version: 4 +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Hunting From 8ce3783394d06ea752b93247c3b861be26d8910b Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Thu, 16 Jan 2025 10:02:05 -0700 Subject: [PATCH 21/82] Update windows_exchange_autodiscover_ssrf_abuse.yml - Updated detection description to better explain ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) attack patterns - Enhanced search query: - X-Rps-CAT parameter - Suspicious user agent strings --- ...ndows_exchange_autodiscover_ssrf_abuse.yml | 19 +++++++++++++++---- 1 file changed, 15 insertions(+), 4 deletions(-) diff --git a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml index 233ca0702a..92afbf59eb 100644 --- a/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml +++ b/detections/web/windows_exchange_autodiscover_ssrf_abuse.yml @@ -1,14 +1,24 @@ name: Windows Exchange Autodiscover SSRF Abuse id: d436f9e7-0ee7-4a47-864b-6dea2c4e2752 -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-16' author: Michael Haag, Nathaniel Stearns, Splunk status: production type: TTP -description: The following analytic detects potential abuse of the ProxyShell or ProxyNotShell vulnerabilities in Microsoft Exchange via Server Side Request Forgery (SSRF). It leverages the Web datamodel to identify suspicious POST requests with specific URI paths and queries related to autodiscover, powershell, and mapi. This activity is significant as it may indicate an attempt to exploit Exchange server vulnerabilities to access internal services or sensitive data. If confirmed malicious, this could lead to unauthorized access, data exfiltration, or further compromise of the network. +description: This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server. The detection focuses on identifying the SSRF attack patterns used in these exploit chains. The analytic monitors for suspicious POST requests to /autodiscover/autodiscover.json endpoints that may indicate attempts to enumerate LegacyDN attributes as part of initial reconnaissance. It also detects requests containing X-Rps-CAT parameters that could indicate attempts to impersonate Exchange users and access the PowerShell backend. Additionally, it looks for MAPI requests that may be used to obtain user SIDs, along with suspicious user agents (particularly Python-based) commonly used in automated exploit attempts. If successful, these attacks can lead to remote code execution as SYSTEM, allowing attackers to deploy webshells, access mailboxes, or gain persistent access to the Exchange server and potentially the broader network environment. data_source: - Windows IIS -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where (Web.status=200 OR Web.status=302 OR Web.status=401) AND Web.http_method=POST by Web.src Web.status Web.uri_path Web.dest Web.http_method Web.uri_query | `drop_dm_object_name("Web")` | eval is_autodiscover=if(like(lower(uri_path),"%autodiscover%"),1,0) | eval powershell = if(match(lower(uri_query),"powershell"), "1",0) | eval mapi=if(like(uri_query,"%/mapi/%"),1,0) | addtotals fieldname=Score is_autodiscover, powershell, mapi | fields Score, src,dest, status, uri_query,uri_path,http_method | where Score >= 2 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_exchange_autodiscover_ssrf_abuse_filter`' +search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Web where (Web.status=200) AND Web.http_method=POST by Web.src Web.status Web.uri_path Web.dest Web.http_method Web.uri_query Web.http_user_agent + | `drop_dm_object_name("Web")` + | eval is_autodiscover=if(like(lower(uri_path),"%autodiscover/autodiscover.json%"),1,0) + | eval has_rps_cat=if(like(lower(uri_query),"%x-rps-cat=%"),1,0) + | eval exchange_backend=if(like(lower(uri_query),"%/powershell/?%"),1,0) + | eval mapi=if(like(uri_query,"%/mapi/%"),1,0) + | eval suspicious_agent=if(match(lower(http_user_agent), "python|urllib"),1,0) + | addtotals fieldname=Score is_autodiscover, has_rps_cat, exchange_backend, mapi, suspicious_agent + | where Score >= 3 + | fields Score, src, dest, status, uri_query, uri_path, http_method, http_user_agent + | `windows_exchange_autodiscover_ssrf_abuse_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node. In addition, confirm the latest CIM App 4.20 or higher is installed. known_false_positives: False positives are limited. references: @@ -21,6 +31,7 @@ references: - https://docs.splunk.com/Documentation/AddOns/released/MSIIS - https://highon.coffee/blog/ssrf-cheat-sheet/ - https://owasp.org/Top10/A10_2021-Server-Side_Request_Forgery_%28SSRF%29/ +- https://m365internals.com/2022/10/18/hunting-and-responding-to-proxyshell-attacks/ drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' From aa6a3f340a71eb12cc4b6af6454e6d2f77eb5592 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 16 Jan 2025 23:03:54 +0100 Subject: [PATCH 22/82] move to deprecated --- .../{endpoint => deprecated}/account_discovery_with_net_app.yml | 0 .../attempted_credential_dump_from_registry_via_reg_exe.yml | 0 .../detect_critical_alerts_from_security_tools.yml | 0 .../domain_account_discovery_with_net_app.yml | 0 .../{endpoint => deprecated}/domain_group_discovery_with_net.yml | 0 detections/{endpoint => deprecated}/excel_spawning_powershell.yml | 0 detections/{endpoint => deprecated}/net_localgroup_discovery.yml | 0 .../office_application_spawn_regsvr32_process.yml | 0 .../office_application_spawn_rundll32_process.yml | 0 .../{endpoint => deprecated}/office_product_spawn_cmd_process.yml | 0 .../office_product_spawning_bitsadmin.yml | 0 .../{endpoint => deprecated}/office_product_spawning_certutil.yml | 0 .../{endpoint => deprecated}/office_product_spawning_mshta.yml | 0 .../office_product_spawning_windows_script_host.yml | 0 .../{endpoint => deprecated}/remote_system_discovery_with_net.yml | 0 detections/{endpoint => deprecated}/winword_spawning_cmd.yml | 0 .../{endpoint => deprecated}/winword_spawning_powershell.yml | 0 .../winword_spawning_windows_script_host.yml | 0 18 files changed, 0 insertions(+), 0 deletions(-) rename detections/{endpoint => deprecated}/account_discovery_with_net_app.yml (100%) rename detections/{endpoint => deprecated}/attempted_credential_dump_from_registry_via_reg_exe.yml (100%) rename detections/{endpoint => deprecated}/detect_critical_alerts_from_security_tools.yml (100%) rename detections/{endpoint => deprecated}/domain_account_discovery_with_net_app.yml (100%) rename detections/{endpoint => deprecated}/domain_group_discovery_with_net.yml (100%) rename detections/{endpoint => deprecated}/excel_spawning_powershell.yml (100%) rename detections/{endpoint => deprecated}/net_localgroup_discovery.yml (100%) rename detections/{endpoint => deprecated}/office_application_spawn_regsvr32_process.yml (100%) rename detections/{endpoint => deprecated}/office_application_spawn_rundll32_process.yml (100%) rename detections/{endpoint => deprecated}/office_product_spawn_cmd_process.yml (100%) rename detections/{endpoint => deprecated}/office_product_spawning_bitsadmin.yml (100%) rename detections/{endpoint => deprecated}/office_product_spawning_certutil.yml (100%) rename detections/{endpoint => deprecated}/office_product_spawning_mshta.yml (100%) rename detections/{endpoint => deprecated}/office_product_spawning_windows_script_host.yml (100%) rename detections/{endpoint => deprecated}/remote_system_discovery_with_net.yml (100%) rename detections/{endpoint => deprecated}/winword_spawning_cmd.yml (100%) rename detections/{endpoint => deprecated}/winword_spawning_powershell.yml (100%) rename detections/{endpoint => deprecated}/winword_spawning_windows_script_host.yml (100%) diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/deprecated/account_discovery_with_net_app.yml similarity index 100% rename from detections/endpoint/account_discovery_with_net_app.yml rename to detections/deprecated/account_discovery_with_net_app.yml diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml similarity index 100% rename from detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml rename to detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml diff --git a/detections/endpoint/detect_critical_alerts_from_security_tools.yml b/detections/deprecated/detect_critical_alerts_from_security_tools.yml similarity index 100% rename from detections/endpoint/detect_critical_alerts_from_security_tools.yml rename to detections/deprecated/detect_critical_alerts_from_security_tools.yml diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/deprecated/domain_account_discovery_with_net_app.yml similarity index 100% rename from detections/endpoint/domain_account_discovery_with_net_app.yml rename to detections/deprecated/domain_account_discovery_with_net_app.yml diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/deprecated/domain_group_discovery_with_net.yml similarity index 100% rename from detections/endpoint/domain_group_discovery_with_net.yml rename to detections/deprecated/domain_group_discovery_with_net.yml diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/deprecated/excel_spawning_powershell.yml similarity index 100% rename from detections/endpoint/excel_spawning_powershell.yml rename to detections/deprecated/excel_spawning_powershell.yml diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/deprecated/net_localgroup_discovery.yml similarity index 100% rename from detections/endpoint/net_localgroup_discovery.yml rename to detections/deprecated/net_localgroup_discovery.yml diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/deprecated/office_application_spawn_regsvr32_process.yml similarity index 100% rename from detections/endpoint/office_application_spawn_regsvr32_process.yml rename to detections/deprecated/office_application_spawn_regsvr32_process.yml diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/deprecated/office_application_spawn_rundll32_process.yml similarity index 100% rename from detections/endpoint/office_application_spawn_rundll32_process.yml rename to detections/deprecated/office_application_spawn_rundll32_process.yml diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/deprecated/office_product_spawn_cmd_process.yml similarity index 100% rename from detections/endpoint/office_product_spawn_cmd_process.yml rename to detections/deprecated/office_product_spawn_cmd_process.yml diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/deprecated/office_product_spawning_bitsadmin.yml similarity index 100% rename from detections/endpoint/office_product_spawning_bitsadmin.yml rename to detections/deprecated/office_product_spawning_bitsadmin.yml diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/deprecated/office_product_spawning_certutil.yml similarity index 100% rename from detections/endpoint/office_product_spawning_certutil.yml rename to detections/deprecated/office_product_spawning_certutil.yml diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/deprecated/office_product_spawning_mshta.yml similarity index 100% rename from detections/endpoint/office_product_spawning_mshta.yml rename to detections/deprecated/office_product_spawning_mshta.yml diff --git a/detections/endpoint/office_product_spawning_windows_script_host.yml b/detections/deprecated/office_product_spawning_windows_script_host.yml similarity index 100% rename from detections/endpoint/office_product_spawning_windows_script_host.yml rename to detections/deprecated/office_product_spawning_windows_script_host.yml diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/deprecated/remote_system_discovery_with_net.yml similarity index 100% rename from detections/endpoint/remote_system_discovery_with_net.yml rename to detections/deprecated/remote_system_discovery_with_net.yml diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/deprecated/winword_spawning_cmd.yml similarity index 100% rename from detections/endpoint/winword_spawning_cmd.yml rename to detections/deprecated/winword_spawning_cmd.yml diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/deprecated/winword_spawning_powershell.yml similarity index 100% rename from detections/endpoint/winword_spawning_powershell.yml rename to detections/deprecated/winword_spawning_powershell.yml diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/deprecated/winword_spawning_windows_script_host.yml similarity index 100% rename from detections/endpoint/winword_spawning_windows_script_host.yml rename to detections/deprecated/winword_spawning_windows_script_host.yml From 9fea5dc874673cabcee8fc433dd998d762e05d59 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 16 Jan 2025 23:04:11 +0100 Subject: [PATCH 23/82] rename some analytics --- ...uditd_private_keys_and_certificate_enumeration.yml} | 10 +++++----- ...yml => windows_change_default_file_association.yml} | 10 +++++----- ..._cmdline_tool_execution_from_non_shell_process.yml} | 10 +++++----- 3 files changed, 15 insertions(+), 15 deletions(-) rename detections/endpoint/{linux_auditd_find_private_keys.yml => linux_auditd_private_keys_and_certificate_enumeration.yml} (87%) rename detections/endpoint/{change_default_file_association.yml => windows_change_default_file_association.yml} (87%) rename detections/endpoint/{cmdline_tool_not_executed_in_cmd_shell.yml => windows_cmdline_tool_execution_from_non_shell_process.yml} (79%) diff --git a/detections/endpoint/linux_auditd_find_private_keys.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml similarity index 87% rename from detections/endpoint/linux_auditd_find_private_keys.yml rename to detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml index 36f223e8d0..bbaed9e245 100644 --- a/detections/endpoint/linux_auditd_find_private_keys.yml +++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml @@ -1,14 +1,14 @@ -name: Linux Auditd Find Private Keys +name: Linux Auditd Private Keys and Certificate Enumeration id: 80bb9988-190b-4ee0-a3c3-509545a8f678 -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%")OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_private_keys_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%") OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_private_keys_and_certificate_enumeration_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/windows_change_default_file_association.yml similarity index 87% rename from detections/endpoint/change_default_file_association.yml rename to detections/endpoint/windows_change_default_file_association.yml index 3335247e61..4203a9afeb 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/windows_change_default_file_association.yml @@ -1,15 +1,15 @@ -name: Change Default File Association +name: Windows Change Default File Association id: 462d17d8-1f71-11ec-ad07-acde48001122 -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects suspicious registry modifications that change the default file association to execute a malicious payload. It leverages data from the Endpoint data model, specifically monitoring registry paths under "*\\shell\\open\\command\\*" and "*HKCR\\*". This activity is significant because altering default file associations can allow attackers to execute arbitrary scripts or payloads when a user opens a file, leading to potential code execution. If confirmed malicious, this technique can enable attackers to persist on the compromised host and execute further malicious commands, posing a severe threat to the environment. data_source: - Sysmon EventID 12 - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `change_default_file_association_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\shell\\open\\command\\*" Registry.registry_path="*HKCR\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_change_default_file_association_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. known_false_positives: unknown references: diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml similarity index 79% rename from detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml rename to detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml index a0855e0861..647d330d1f 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" OR Processes.process_name = "systeminfo.exe" OR Processes.process_name = "net1.exe" OR Processes.process_name = "arp.exe" OR Processes.process_name = "nslookup.exe" OR Processes.process_name = "route.exe" OR Processes.process_name = "netstat.exe" OR Processes.process_name = "whoami.exe") AND NOT (Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name = "powershell.exe" OR Processes.parent_process_name = "powershell_ise.exe" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name IN ("ipconfig.exe", "systeminfo.exe", "net1.exe", "arp.exe", "nslookup.exe", "route.exe", "netstat.exe", "whoami.exe") AND NOT Processes.parent_process_name IN ("cmd.exe", "powershell.exe", "powershell_ise.exe", "pwsh.exe", "explorer.exe", "-", "unknown") by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process_id Processes.process Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_cmdline_tool_execution_from_non_shell_process_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: A network operator or systems administrator may utilize an automated host discovery application that may generate false positives. Filter as needed. references: @@ -37,9 +37,9 @@ tags: - CISA AA23-347A - Gozi Malware asset_type: Endpoint - confidence: 80 - impact: 70 - message: A non-standard parent process $parent_process_name$ spawned child process $process_name$ to execute command-line tool on $dest$. + confidence: 40 + impact: 40 + message: $process_name$ was spawned from an uncommon parent process $parent_process_name$ on $dest$. mitre_attack_id: - T1059 - T1059.007 @@ -77,7 +77,7 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 + risk_score: 16 security_domain: endpoint tests: - name: True Positive Test From 4476cd6bfa5fad0283d3b69bed543fbcd034f6d6 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 17 Jan 2025 12:56:57 +0100 Subject: [PATCH 24/82] add rename to auditd analytics --- detections/endpoint/linux_auditd_base64_decode_files.yml | 6 +++--- detections/endpoint/linux_auditd_clipboard_data_copy.yml | 6 +++--- .../endpoint/linux_auditd_data_destruction_command.yml | 6 +++--- .../linux_auditd_data_transfer_size_limits_via_split.yml | 6 +++--- .../linux_auditd_database_file_and_directory_discovery.yml | 6 +++--- .../endpoint/linux_auditd_file_and_directory_discovery.yml | 6 +++--- ...inux_auditd_file_permissions_modification_via_chattr.yml | 6 +++--- ...linux_auditd_find_credentials_from_password_managers.yml | 6 +++--- .../linux_auditd_find_credentials_from_password_stores.yml | 6 +++--- detections/endpoint/linux_auditd_find_ssh_private_keys.yml | 6 +++--- .../endpoint/linux_auditd_hardware_addition_swapoff.yml | 6 +++--- .../linux_auditd_hidden_files_and_directories_creation.yml | 6 +++--- .../endpoint/linux_auditd_preload_hijack_library_calls.yml | 6 +++--- ...inux_auditd_private_keys_and_certificate_enumeration.yml | 2 +- .../endpoint/linux_auditd_setuid_using_setcap_utility.yml | 6 +++--- .../endpoint/linux_auditd_unload_module_via_modprobe.yml | 6 +++--- ...nux_auditd_virtual_disk_file_and_directory_discovery.yml | 6 +++--- 17 files changed, 49 insertions(+), 49 deletions(-) diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index 536a69b3b2..bdb33137ab 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -1,14 +1,14 @@ name: Linux Auditd Base64 Decode Files id: 5890ba10-4e48-4dc0-8a40-3e1ebe75e737 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. Base64 is commonly used to encode data for safe transmission, but attackers may abuse it to conceal malicious payloads. This detection focuses on identifying unusual or unexpected Base64 decoding processes, particularly when associated with critical files or directories. By monitoring these activities, the analytic helps uncover potential threats, enabling security teams to respond promptly and mitigate risks associated with encoded malware or unauthorized data access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE(process_exec, "%base64%") AND (LIKE(process_exec, "%-d %") OR LIKE(process_exec, "% --d%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_base64_decode_files_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%base64%") AND (LIKE(process_exec, "%-d %") OR LIKE(process_exec, "% --d%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_base64_decode_files_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index eea26987d2..e844e3cc50 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -1,14 +1,14 @@ name: Linux Auditd Clipboard Data Copy id: 9ddfe470-c4d0-4e60-8668-7337bd699edd -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects the use of the Linux 'xclip' command to copy data from the clipboard. It leverages Linux Auditd telemetry, focusing on process names and command-line arguments related to clipboard operations. This activity is significant because adversaries can exploit clipboard data to capture sensitive information such as passwords or IP addresses. If confirmed malicious, this technique could lead to unauthorized data exfiltration, compromising sensitive information and potentially aiding further attacks within the environment. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") OR LIKE(process_exec, "%-o%") OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, "%-selection %") OR LIKE(process_exec, "%sel %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_clipboard_data_copy_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%xclip%") AND (LIKE(process_exec, "%clipboard%") OR LIKE(process_exec, "%-o%") OR LIKE(process_exec, "%clip %") OR LIKE(process_exec, "%-selection %") OR LIKE(process_exec, "%sel %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_clipboard_data_copy_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: False positives may be present on Linux desktop as it may commonly be used by administrators or end users. Filter as needed. references: diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index fb2cb5fa5a..3201e7e0e0 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -1,14 +1,14 @@ name: Linux Auditd Data Destruction Command id: 4da5ce1a-f71b-4e71-bb73-c0a3c73f3c3c -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host. It leverages data from Linux Auditd, focusing on the 'rm' command with force recursive deletion and the '--no-preserve-root' option. This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred. If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host. Immediate investigation and response are crucial to mitigate potential damage. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND LIKE (process_exec, "%--no-preserve-root%") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%rm %") AND LIKE (process_exec, "% -rf %") AND LIKE (process_exec, "%--no-preserve-root%") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_destruction_command_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: unknown references: diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index ee0c06ce7d..de934eb8a4 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -1,14 +1,14 @@ name: Linux Auditd Data Transfer Size Limits Via Split id: 4669561d-3bbd-44e3-857c-0e3c6ef2120c -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE(process_exec, "%split %") AND LIKE(process_exec, "% -b %") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%split %") AND LIKE(process_exec, "% -b %") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index bcf7f46933..60d8cb7835 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -1,14 +1,14 @@ name: Linux Auditd Database File And Directory Discovery id: f616c4f3-bde9-41cf-856c-019b65f668bb -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. This behavior is often a precursor to data theft, unauthorized access, or privilege escalation, as attackers seek to identify valuable information stored in databases. By monitoring for unusual or unauthorized attempts to locate database files and directories, this analytic aids in early detection of potential reconnaissance or data breach efforts, enabling security teams to respond swiftly and mitigate the risk of further compromise. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.db%") OR LIKE (process_exec, "%.sql%") OR LIKE (process_exec, "%.sqlite%") OR LIKE (process_exec, "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR LIKE (process_exec, "%.mdf%")OR LIKE (process_exec, "%.ndf%")OR LIKE (process_exec, "%.ldf%")OR LIKE (process_exec, "%.frm%")OR LIKE (process_exec, "%.idb%")OR LIKE (process_exec, "%.myd%")OR LIKE (process_exec, "%.myi%")OR LIKE (process_exec, "%.dbf%")OR LIKE (process_exec, "%.db2%")OR LIKE (process_exec, "%.dbc%")OR LIKE (process_exec, "%.fpt%")OR LIKE (process_exec, "%.ora%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.db%") OR LIKE (process_exec, "%.sql%") OR LIKE (process_exec, "%.sqlite%") OR LIKE (process_exec, "%.mdb%")OR LIKE (process_exec, "%.accdb%")OR LIKE (process_exec, "%.mdf%")OR LIKE (process_exec, "%.ndf%")OR LIKE (process_exec, "%.ldf%")OR LIKE (process_exec, "%.frm%")OR LIKE (process_exec, "%.idb%")OR LIKE (process_exec, "%.myd%")OR LIKE (process_exec, "%.myi%")OR LIKE (process_exec, "%.dbf%")OR LIKE (process_exec, "%.db2%")OR LIKE (process_exec, "%.dbc%")OR LIKE (process_exec, "%.fpt%")OR LIKE (process_exec, "%.ora%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_database_file_and_directory_discovery_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index ec265f42cb..4aed31144d 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -1,14 +1,14 @@ name: Linux Auditd File And Directory Discovery id: 0bbfb79c-a755-49a5-a38a-1128d0a452f1 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. This behavior often precedes data exfiltration, as adversaries seek to identify valuable or confidential information for theft. By identifying unusual or unauthorized attempts to browse or enumerate files and directories, this analytic helps security teams detect potential reconnaissance or preparatory actions by an attacker, enabling timely intervention to prevent data breaches or unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.tif%") OR LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, "%.gif%") OR LIKE (process_exec, "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE (process_exec, "%.jif%")OR LIKE (process_exec, "%.jfif%")OR LIKE (process_exec, "%.jp2%")OR LIKE (process_exec, "%.jpx%")OR LIKE (process_exec, "%.j2k%")OR LIKE (process_exec, "%.j2c%")OR LIKE (process_exec, "%.fpx%")OR LIKE (process_exec, "%.pcd%")OR LIKE (process_exec, "%.png%")OR LIKE (process_exec, "%.flv%") OR LIKE (process_exec, "%.pdf%")OR LIKE (process_exec, "%.mp4%")OR LIKE (process_exec, "%.mp3%")OR LIKE (process_exec, "%.gifv%")OR LIKE (process_exec, "%.avi%")OR LIKE (process_exec, "%.mov%")OR LIKE (process_exec, "%.mpeg%")OR LIKE (process_exec, "%.wav%")OR LIKE (process_exec, "%.doc%")OR LIKE (process_exec, "%.docx%")OR LIKE (process_exec, "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE (process_exec, "%.svg%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_and_directory_discovery_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.tif%") OR LIKE (process_exec, "%.tiff%") OR LIKE (process_exec, "%.gif%") OR LIKE (process_exec, "%.jpeg%")OR LIKE (process_exec, "%.jpg%")OR LIKE (process_exec, "%.jif%")OR LIKE (process_exec, "%.jfif%")OR LIKE (process_exec, "%.jp2%")OR LIKE (process_exec, "%.jpx%")OR LIKE (process_exec, "%.j2k%")OR LIKE (process_exec, "%.j2c%")OR LIKE (process_exec, "%.fpx%")OR LIKE (process_exec, "%.pcd%")OR LIKE (process_exec, "%.png%")OR LIKE (process_exec, "%.flv%") OR LIKE (process_exec, "%.pdf%")OR LIKE (process_exec, "%.mp4%")OR LIKE (process_exec, "%.mp3%")OR LIKE (process_exec, "%.gifv%")OR LIKE (process_exec, "%.avi%")OR LIKE (process_exec, "%.mov%")OR LIKE (process_exec, "%.mpeg%")OR LIKE (process_exec, "%.wav%")OR LIKE (process_exec, "%.doc%")OR LIKE (process_exec, "%.docx%")OR LIKE (process_exec, "%.xls%")OR LIKE (process_exec, "%.xlsx%")OR LIKE (process_exec, "%.svg%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_and_directory_discovery_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index 4c46e7a037..a9bc8b21af 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -1,14 +1,14 @@ name: Linux Auditd File Permissions Modification Via Chattr id: f2d1110d-b01c-4a58-9975-90a9edeb083a -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects suspicious file permissions modifications using the chattr command, which may indicate an attacker attempting to manipulate file attributes to evade detection or prevent alteration. The chattr command can be used to make files immutable or restrict deletion, which can be leveraged to protect malicious files or disrupt system operations. By monitoring for unusual or unauthorized chattr usage, this analytic helps identify potential tampering with critical files, enabling security teams to quickly respond to and mitigate threats associated with unauthorized file attribute changes. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%chattr %") AND LIKE(process_exec, "% -i%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permissions_modification_via_chattr_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index edf1c9f44e..81daf23272 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -1,14 +1,14 @@ name: Linux Auditd Find Credentials From Password Managers id: 784241aa-85a5-4782-a503-d071bd3446f9 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects suspicious attempts to find credentials stored in password managers, which may indicate an attacker's effort to retrieve sensitive login information. Password managers are often targeted by adversaries seeking to access stored passwords for further compromise or lateral movement within a network. By monitoring for unusual or unauthorized access to password manager files or processes, this analytic helps identify potential credential theft attempts, enabling security teams to respond quickly to protect critical accounts and prevent further unauthorized access. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.kdbx%") OR LIKE (process_exec, "%KeePass%") OR LIKE (process_exec, "%KeePass\.enforced%") OR LIKE (process_exec, "%.lpdb%")OR LIKE (process_exec, "%.opvault%")OR LIKE (process_exec, "%.agilekeychain%")OR LIKE (process_exec, "%.dashlane%")OR LIKE (process_exec, "%.rfx%")OR LIKE (process_exec, "%passbolt%")OR LIKE (process_exec, "%.spdb%")OR LIKE (process_exec, "%StickyPassword%")OR LIKE (process_exec, "%.walletx%")OR LIKE (process_exec, "%enpass%")OR LIKE (process_exec, "%vault%")OR LIKE (process_exec, "%.kdb%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_managers_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 602f0ad3b5..6dfab9fc46 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -1,14 +1,14 @@ name: Linux Auditd Find Credentials From Password Stores id: 4de73044-9a1d-4a51-a1c2-85267d8dcab3 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%password%") OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, "%credential%")OR LIKE (process_exec, "%creds%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%password%") OR LIKE (process_exec, "%pass %") OR LIKE (process_exec, "%credential%")OR LIKE (process_exec, "%creds%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_credentials_from_password_stores_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index 9435ba0ee7..23f64f41be 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -1,14 +1,14 @@ name: Linux Auditd Find Ssh Private Keys id: e2d2bd10-dcd1-4b2f-8a76-0198eab32ba5 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects suspicious attempts to find SSH private keys, which may indicate an attacker's effort to compromise secure access to systems. SSH private keys are essential for secure authentication, and unauthorized access to these keys can enable attackers to gain unauthorized access to servers and other critical infrastructure. By monitoring for unusual or unauthorized searches for SSH private keys, this analytic helps identify potential threats to network security, allowing security teams to quickly respond and safeguard against unauthorized access and potential breaches. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%id_rsa%") OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_ssh_private_keys_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%id_rsa%") OR LIKE (process_exec, "%id_dsa%")OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%ssh_key%")OR LIKE (process_exec, "%authorized_keys%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_ssh_private_keys_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index d44992d250..3c8f5b1bba 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -1,14 +1,14 @@ name: Linux Auditd Hardware Addition Swapoff id: 5728bb16-1a0b-4b66-bce2-0074ac839770 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects the execution of the "swapoff" command, which disables the swapping of paging devices on a Linux system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because disabling swap can be a tactic used by malware, such as Awfulshred, to evade detection and hinder forensic analysis. If confirmed malicious, this action could allow an attacker to manipulate system memory management, potentially leading to data corruption, system instability, or evasion of memory-based detection mechanisms. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%swapoff %") AND LIKE(process_exec, "% -a%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_hardware_addition_swapoff_filter`' +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%swapoff %") AND LIKE(process_exec, "% -a%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_hardware_addition_swapoff_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: administrator may disable swapping of devices in a linux host. Filter is needed. references: diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index 1b748cba78..4a11ae5b48 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -1,14 +1,14 @@ name: Linux Auditd Hidden Files And Directories Creation id: 555cc358-bf16-4e05-9b3a-0f89c73b7261 -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec,"%touch %") OR LIKE (process_exec,"%mkdir %")OR LIKE (process_exec,"%vim %") OR LIKE (process_exec,"%vi %") OR LIKE (process_exec,"%nano %")) AND (LIKE (process_exec,"% ./.%") OR LIKE (process_exec," .%")OR LIKE (process_exec," /.%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_hidden_files_and_directories_creation_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index 9f9601d818..f537d137dd 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -1,14 +1,14 @@ name: Linux Auditd Preload Hijack Library Calls id: 35c50572-a70b-452f-afa9-bebdf3c3ce36 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the use of the LD_PRELOAD environment variable to hijack or hook library functions on a Linux platform. It leverages data from Linux Auditd, focusing on process execution logs that include command-line details. This activity is significant because adversaries, malware authors, and red teamers commonly use this technique to gain elevated privileges and establish persistence on a compromised machine. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, and maintain long-term access to the system. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%LD_PRELOAD%")| stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_library_calls_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%LD_PRELOAD%")| stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_library_calls_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml index bbaed9e245..b30b4049b2 100644 --- a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml +++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml @@ -8,7 +8,7 @@ type: Anomaly description: The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%") OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_private_keys_and_certificate_enumeration_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%") OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_private_keys_and_certificate_enumeration_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index 7eba7152fe..0f231adcdb 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -1,14 +1,14 @@ name: Linux Auditd Setuid Using Setcap Utility id: 1474459a-302b-4255-8add-d82f96d14cd9 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects the execution of the 'setcap' utility to enable the SUID bit on Linux systems. It leverages Linux Auditd data, focusing on process names and command-line arguments that indicate the use of 'setcap' with specific capabilities. This activity is significant because setting the SUID bit allows a user to temporarily gain root access, posing a substantial security risk. If confirmed malicious, an attacker could escalate privileges, execute arbitrary commands with elevated permissions, and potentially compromise the entire system. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep %") OR LIKE (process_exec, "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p %") OR LIKE (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_setcap_utility_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%setcap %") AND (LIKE (process_exec, "% cap_setuid+ep %") OR LIKE (process_exec, "% cap_setuid=ep %") OR LIKE (process_exec, "% cap_net_bind_service+p %") OR LIKE (process_exec, "% cap_net_raw+ep %") OR LIKE (process_exec, "% cap_dac_read_search+ep %")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_setcap_utility_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index 004c43ae77..352bdc7cf4 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -1,14 +1,14 @@ name: Linux Auditd Unload Module Via Modprobe id: 90964d6a-4b5f-409a-85bd-95e261e03fe9 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: TTP description: The following analytic detects suspicious use of the `modprobe` command to unload kernel modules, which may indicate an attempt to disable critical system components or evade detection. The `modprobe` utility manages kernel modules, and unauthorized unloading of modules can disrupt system security features, remove logging capabilities, or conceal malicious activities. By monitoring for unusual or unauthorized `modprobe` operations involving module unloading, this analytic helps identify potential tampering with kernel functionality, enabling security teams to investigate and address possible threats to system integrity. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where LIKE (process_exec, "%modprobe%") AND LIKE (process_exec, "%-r %") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_unload_module_via_modprobe_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%modprobe%") AND LIKE (process_exec, "%-r %") | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_unload_module_via_modprobe_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index e5af078c4f..282728f5e7 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -1,14 +1,14 @@ name: Linux Auditd Virtual Disk File And Directory Discovery id: eec78cef-d4c8-4b35-8f5b-6922102a4a41 -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-16' author: Teoderick Contreras, Splunk status: production type: Anomaly description: The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. Virtual disks can contain sensitive data or critical system configurations, and unauthorized discovery attempts could signify preparatory actions for data exfiltration or further compromise. By monitoring for unusual or unauthorized searches for virtual disk files and directories, this analytic helps identify potential reconnaissance activities, enabling security teams to respond promptly and safeguard against unauthorized access and data breaches. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, "%.vmdk%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.vhd%") OR LIKE (process_exec, "%.vhdx%") OR LIKE (process_exec, "%.vmdk%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_virtual_disk_file_and_directory_discovery_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: From c1bee7dc5864e2e0a3ea01aa4acd6782cbb41dae Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 17 Jan 2025 12:57:09 +0100 Subject: [PATCH 25/82] update additional analytics --- ...ding_dotnet_into_memory_via_reflection.yml | 14 +++++++------- ...ew_default_file_association_value_set.yml} | 19 +++++++++---------- 2 files changed, 16 insertions(+), 17 deletions(-) rename detections/endpoint/{windows_change_default_file_association.yml => windows_new_default_file_association_value_set.yml} (65%) diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index 35211ae96d..44681b760d 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,14 +1,14 @@ -name: PowerShell Loading DotNET into Memory via Reflection +name: PowerShell Loading DotNET Into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 -version: 5 -date: '2024-09-30' +version: 6 +date: '2025-01-16' author: Michael Haag, Splunk status: production -type: TTP +type: Anomaly data_source: - Powershell Script Block Logging 4104 -description: The following analytic detects the use of PowerShell to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. -search: '`powershell` EventCode=4104 ScriptBlockText IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*", "*reflection.assembly*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' +description: The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Reflection.Assembly]::Load*", "*Reflection.Assembly.Load*", "*UnsafeLoadFrom*", "*.LoadFrom(*", "*.LoadModule(*", "*.LoadWithPartialName*", "*ReflectionOnlyLoad*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: False positives should be limited as day to day scripts do not use this method. references: @@ -37,7 +37,7 @@ tags: asset_type: Endpoint confidence: 80 impact: 70 - message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in host $Computer$ + message: A suspicious powershell script that contains calls to reflective class assembly command in $ScriptBlockText$ is potentially trying to load malicious .NET code in memory in host $Computer$ mitre_attack_id: - T1059 - T1059.001 diff --git a/detections/endpoint/windows_change_default_file_association.yml b/detections/endpoint/windows_new_default_file_association_value_set.yml similarity index 65% rename from detections/endpoint/windows_change_default_file_association.yml rename to detections/endpoint/windows_new_default_file_association_value_set.yml index 4203a9afeb..d6f71a881f 100644 --- a/detections/endpoint/windows_change_default_file_association.yml +++ b/detections/endpoint/windows_new_default_file_association_value_set.yml @@ -1,17 +1,16 @@ -name: Windows Change Default File Association +name: Windows New Default File Association Value Set id: 462d17d8-1f71-11ec-ad07-acde48001122 version: 4 date: '2025-01-15' author: Teoderick Contreras, Splunk status: production -type: Anomaly -description: The following analytic detects suspicious registry modifications that change the default file association to execute a malicious payload. It leverages data from the Endpoint data model, specifically monitoring registry paths under "*\\shell\\open\\command\\*" and "*HKCR\\*". This activity is significant because altering default file associations can allow attackers to execute arbitrary scripts or payloads when a user opens a file, leading to potential code execution. If confirmed malicious, this technique can enable attackers to persist on the compromised host and execute further malicious commands, posing a severe threat to the environment. +type: Hunting +description: The following analytic detects registry changes to the default file association value. It leverages data from the Endpoint data model, specifically monitoring registry paths under "HKCR\\*\\shell\\open\\command\\*". This activity can be significant because, attackers might alter the default file associations in order to execute arbitrary scripts or payloads when a user opens a file, leading to potential code execution. If confirmed malicious, this technique can enable attackers to persist on the compromised host and execute further malicious commands, posing a severe threat to the environment. data_source: -- Sysmon EventID 12 - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\shell\\open\\command\\*" Registry.registry_path="*HKCR\\*" by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_change_default_file_association_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*\\shell\\open\\command\\*" Registry.registry_path IN ("*HKCR\\*", "*HKEY_CLASSES_ROOT\\*") by Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `windows_new_default_file_association_value_set_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records registry activity from your hosts to populate the endpoint data model in the registry node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is typically generated via logs that report reads and writes to the registry. -known_false_positives: unknown +known_false_positives: Windows and third party software will create and modify these file associations during installation or upgrades. Additional filters needs to be applied to tune environment specific false positives. references: - https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features drilldown_searches: @@ -32,9 +31,9 @@ tags: - Windows Persistence Techniques - Data Destruction asset_type: Endpoint - confidence: 100 - impact: 80 - message: Registry path $registry_path$ was modified, added, or deleted in $dest$. + confidence: 50 + impact: 50 + message: Default file association for $registry_path$ was modified to $registry_value_data$ in $dest$. mitre_attack_id: - T1546.001 - T1546 @@ -58,7 +57,7 @@ tags: - Registry.registry_path - Registry.registry_key_name - Registry.registry_value_name - risk_score: 80 + risk_score: 25 security_domain: endpoint tests: - name: True Positive Test From be154a1bdc5439d2184fae0779593aa24ab3a914 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 17 Jan 2025 15:45:43 +0100 Subject: [PATCH 26/82] update 827409a1-5393-4d8d-8da4-bbb297c262a7 --- ..._http_network_communication_from_msiexec.yml} | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) rename detections/endpoint/{windows_msiexec_with_network_connections.yml => windows_http_network_communication_from_msiexec.yml} (94%) diff --git a/detections/endpoint/windows_msiexec_with_network_connections.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml similarity index 94% rename from detections/endpoint/windows_msiexec_with_network_connections.yml rename to detections/endpoint/windows_http_network_communication_from_msiexec.yml index d905f866d0..90fead6067 100644 --- a/detections/endpoint/windows_msiexec_with_network_connections.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -1,14 +1,14 @@ -name: Windows MSIExec With Network Connections +name: Windows HTTP Network Communication From MSIExec id: 827409a1-5393-4d8d-8da4-bbb297c262a7 -version: 4 -date: '2024-09-30' +version: 5 +date: '2025-01-17' author: Michael Haag, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment. data_source: - Sysmon EventID 1 AND Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_msiexec` by _time Processes.user Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ] | table _time user dest parent_process_name process_name process_path process process_id dest_port dest_ip | `windows_msiexec_with_network_connections_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_msiexec` by _time Processes.user Processes.process_id Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id All_Traffic.dest All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ] | table _time user dest parent_process_name process_name process_path process process_id dest_port dest_ip | `windows_http_network_communication_from_msiexec_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: False positives will be present and filtering is required. references: @@ -28,8 +28,8 @@ tags: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint confidence: 50 - impact: 70 - message: An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination $dest_ip$ + impact: 50 + message: An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination $dest_ip$ on port $dest_port$ mitre_attack_id: - T1218.007 observable: @@ -65,7 +65,7 @@ tags: - All_Traffic.dest - All_Traffic.dest_port - All_Traffic.dest_ip - risk_score: 35 + risk_score: 25 security_domain: endpoint tests: - name: True Positive Test From 0d36a4ed1a08cdc992c6b9797550180039ec95a4 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 17 Jan 2025 18:45:32 +0100 Subject: [PATCH 27/82] update 048839e4-1eaa-43ff-8a22-86d17f6fcc13 --- ..._via_set_command_from_uncommon_parent.yml} | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) rename detections/endpoint/{windows_command_shell_fetch_env_variables.yml => windows_list_env_variables_via_set_command_from_uncommon_parent.yml} (67%) diff --git a/detections/endpoint/windows_command_shell_fetch_env_variables.yml b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml similarity index 67% rename from detections/endpoint/windows_command_shell_fetch_env_variables.yml rename to detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml index 156004d4aa..c2ca59a1d5 100644 --- a/detections/endpoint/windows_command_shell_fetch_env_variables.yml +++ b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml @@ -1,18 +1,18 @@ -name: Windows Command Shell Fetch Env Variables +name: Windows List ENV Variables Via SET Command From Uncommon Parent id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-17' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic identifies a suspicious process command line fetching environment variables with a non-shell parent process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and parent process names. This activity is significant as it is commonly associated with malware like Qakbot, which uses this technique to gather system information. If confirmed malicious, this behavior could indicate that the parent process has been compromised, potentially allowing attackers to execute arbitrary commands, escalate privileges, or persist within the environment. +type: Anomaly +description: The following analytic identifies a suspicious process command line fetching environment variables using the cmd.exe "set" command, with a non-shell parent process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and parent process names. This activity could be significant as it is commonly associated with malware like Qakbot, which uses this technique to gather system information. If confirmed malicious, this behavior could indicate that the parent process has been compromised, potentially allowing attackers to execute arbitrary commands, escalate privileges, or persist within the environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*cmd /c set" OR Processes.process = "*cmd.exe /c set" AND NOT (Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name = "explorer.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_shell_fetch_env_variables_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="cmd.exe" Processes.process IN ("*/c set", "*/c \"set") AND NOT Processes.parent_process_name IN ("cmd.exe", "explorer.exe", "powershell*" "pwsh.exe") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_list_env_variables_via_set_command_from_uncommon_parent_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: shell process that are not included in this search may cause False positive. Filter is needed. +known_false_positives: shell process that are not included in this search may cause False positive. Filter as needed. references: - https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg drilldown_searches: @@ -28,9 +28,9 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - confidence: 70 - impact: 80 - message: non-shell parent process has a child process $process_name$ with a commandline $process$ to fetch env variables in $dest$ + confidence: 50 + impact: 50 + message: $parent_process_name$ Spawned $process_name$ with a commandline $process$ in $dest$ mitre_attack_id: - T1055 observable: @@ -55,7 +55,7 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 56 + risk_score: 25 security_domain: endpoint tests: - name: True Positive Test From 0e32902df21945df300357d546782f1090973e6f Mon Sep 17 00:00:00 2001 From: Tapish Jain Date: Fri, 17 Jan 2025 13:41:30 -0800 Subject: [PATCH 28/82] Input playbook for the new Talos app --- ...ligence_Identifier_Reputation_Analysis.yml | 27 +++++++++++++++++++ 1 file changed, 27 insertions(+) create mode 100644 playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml new file mode 100644 index 0000000000..ce15527c7c --- /dev/null +++ b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml @@ -0,0 +1,27 @@ +name: Cisco Talos Intelligence Identifier Reputation Analysis +id: 9cea2ec7-9e6c-4861-b828-336410cdc1cc +version: 1 +date: '2025-01-17' +author: Kelby Shelton, Tapish Jain, Splunk +type: Investigation +description: "Accepts a URL, IP or Domain and provides intelligence on the objects. Generates a per observable report that includes the objects threat level, threat categories, acceptable use categories and score." +playbook: CiscoTalosIntelligence_Identifier_Reputation_Analysis +how_to_implement: This input playbook requires the Cisco Talos Intelligence connector to be configured. +references: + - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/ +app_list: + - VirusTotal v3 +tags: + platform_tags: + - reputation + - url + - ip + - domain + - Cisco Talos Intelligence + playbook_type: Input + vpe_type: Modern + playbook_fields: [] + product: + - Splunk SOAR + use_cases: + - Enrichment From 3e8a43b4a3309b420b4108e6807651e2b609103a Mon Sep 17 00:00:00 2001 From: Tapish Jain Date: Fri, 17 Jan 2025 13:42:21 -0800 Subject: [PATCH 29/82] Input playbook for the new Talos app --- ...sco_talos_intelligence_identifier_reputation_analysis.yml} | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml => cisco_talos_intelligence_identifier_reputation_analysis.yml} (89%) diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml b/playbooks/cisco_talos_intelligence_identifier_reputation_analysis.yml similarity index 89% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml rename to playbooks/cisco_talos_intelligence_identifier_reputation_analysis.yml index ce15527c7c..cc5b04bcb6 100644 --- a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml +++ b/playbooks/cisco_talos_intelligence_identifier_reputation_analysis.yml @@ -6,11 +6,11 @@ author: Kelby Shelton, Tapish Jain, Splunk type: Investigation description: "Accepts a URL, IP or Domain and provides intelligence on the objects. Generates a per observable report that includes the objects threat level, threat categories, acceptable use categories and score." playbook: CiscoTalosIntelligence_Identifier_Reputation_Analysis -how_to_implement: This input playbook requires the Cisco Talos Intelligence connector to be configured. +how_to_implement: This input playbook requires the Cisco Talos Intelligence connector to be configured and a Splunk SOAR cloud license. references: - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/ app_list: - - VirusTotal v3 + - Cisco Talos Intelligence tags: platform_tags: - reputation From c26d1397763dbfa16602dc13ba9777794a5feee8 Mon Sep 17 00:00:00 2001 From: Tapish Jain Date: Fri, 17 Jan 2025 14:11:25 -0800 Subject: [PATCH 30/82] adding the playbook files --- ...igence_Identifier_Reputation_Analysis.json | 752 ++++++++++++++++++ ...ligence_Identifier_Reputation_Analysis.png | Bin 0 -> 152705 bytes ...lligence_Identifier_Reputation_Analysis.py | 596 ++++++++++++++ ...igence_Identifier_Reputation_Analysis.yml} | 0 4 files changed, 1348 insertions(+) create mode 100644 playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json create mode 100644 playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png create mode 100644 playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py rename playbooks/{cisco_talos_intelligence_identifier_reputation_analysis.yml => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml} (100%) diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json new file mode 100644 index 0000000000..827ec3798e --- /dev/null +++ b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json @@ -0,0 +1,752 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Identifier Reputation Analysis", + "coa": { + "data": { + "description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.", + "edges": [ + { + "id": "port_0_to_port_2", + "sourceNode": "0", + "sourcePort": "0_out", + "targetNode": "2", + "targetPort": "2_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_2_to_port_3", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "3", + "targetPort": "3_in" + }, + { + "conditions": [ + { + "index": 1 + } + ], + "id": "port_2_to_port_4", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "4", + "targetPort": "4_in" + }, + { + "conditions": [ + { + "index": 2 + } + ], + "id": "port_2_to_port_5", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "5", + "targetPort": "5_in" + }, + { + "id": "port_3_to_port_6", + "sourceNode": "3", + "sourcePort": "3_out", + "targetNode": "6", + "targetPort": "6_in" + }, + { + "id": "port_4_to_port_10", + "sourceNode": "4", + "sourcePort": "4_out", + "targetNode": "10", + "targetPort": "10_in" + }, + { + "id": "port_5_to_port_13", + "sourceNode": "5", + "sourcePort": "5_out", + "targetNode": "13", + "targetPort": "13_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_6_to_port_17", + "sourceNode": "6", + "sourcePort": "6_out", + "targetNode": "17", + "targetPort": "17_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_10_to_port_16", + "sourceNode": "10", + "sourcePort": "10_out", + "targetNode": "16", + "targetPort": "16_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_13_to_port_18", + "sourceNode": "13", + "sourcePort": "13_out", + "targetNode": "18", + "targetPort": "18_in" + }, + { + "id": "port_17_to_port_26", + "sourceNode": "17", + "sourcePort": "17_out", + "targetNode": "26", + "targetPort": "26_in" + }, + { + "id": "port_26_to_port_1", + "sourceNode": "26", + "sourcePort": "26_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_16_to_port_27", + "sourceNode": "16", + "sourcePort": "16_out", + "targetNode": "27", + "targetPort": "27_in" + }, + { + "id": "port_27_to_port_1", + "sourceNode": "27", + "sourcePort": "27_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_18_to_port_28", + "sourceNode": "18", + "sourcePort": "18_out", + "targetNode": "28", + "targetPort": "28_in" + }, + { + "id": "port_28_to_port_1", + "sourceNode": "28", + "sourcePort": "28_out", + "targetNode": "1", + "targetPort": "1_in" + } + ], + "hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea", + "nodes": { + "0": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_start", + "id": "0", + "type": "start" + }, + "errors": {}, + "id": "0", + "type": "start", + "warnings": {}, + "x": 1000, + "y": 419.9999999999985 + }, + "1": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_finish", + "id": "1", + "type": "end" + }, + "errors": {}, + "id": "1", + "type": "end", + "warnings": {}, + "x": 1000, + "y": 1520 + }, + "10": { + "data": { + "advanced": { + "customName": "domain reputation filter", + "customNameId": 0, + "description": "Exclude failing domain reputations", + "join": [], + "note": "Exclude failing domain reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "domain_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 3, + "functionName": "domain_reputation_filter", + "id": "10", + "type": "filter" + }, + "errors": {}, + "id": "10", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 840 + }, + "13": { + "data": { + "advanced": { + "customName": "ip reputation filter", + "customNameId": 0, + "description": "Exclude failing ip reputations", + "join": [], + "note": "Exclude failing ip reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "ip_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 4, + "functionName": "ip_reputation_filter", + "id": "13", + "type": "filter" + }, + "errors": {}, + "id": "13", + "type": "filter", + "warnings": {}, + "x": 1380, + "y": 840 + }, + "16": { + "customCode": null, + "data": { + "advanced": { + "customName": "format 2", + "customNameId": 0, + "description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.", + "join": [], + "note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects." + }, + "functionId": 4, + "functionName": "format_2", + "id": "16", + "parameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "16", + "type": "format", + "userCode": null, + "warnings": {}, + "x": 980, + "y": 1160 + }, + "17": { + "data": { + "advanced": { + "customName": "format 1", + "customNameId": 0, + "description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.", + "join": [], + "note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects." + }, + "functionId": 5, + "functionName": "format_1", + "id": "17", + "parameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "17", + "type": "format", + "warnings": {}, + "x": 640, + "y": 1160 + }, + "18": { + "data": { + "advanced": { + "customName": "format 3", + "customNameId": 0, + "description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ", + "join": [], + "note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. " + }, + "functionId": 6, + "functionName": "format_3", + "id": "18", + "parameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "18", + "type": "format", + "warnings": {}, + "x": 1320, + "y": 1160 + }, + "2": { + "data": { + "advanced": { + "customName": "input filter", + "customNameId": 0, + "description": "Filter to pass in a url, domain or ip to it's appropriate action", + "join": [], + "note": "Filter to pass in a url, domain or ip to it's appropriate action" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "!=", + "param": "playbook_input:url", + "value": "" + } + ], + "conditionIndex": 0, + "customName": "url", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 1, + "op": "!=", + "param": "playbook_input:domain", + "value": "" + } + ], + "conditionIndex": 1, + "customName": "domain", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 2, + "op": "!=", + "param": "playbook_input:ip", + "value": "" + } + ], + "conditionIndex": 2, + "customName": "ip", + "logic": "and" + } + ], + "functionId": 1, + "functionName": "input_filter", + "id": "2", + "type": "filter" + }, + "errors": {}, + "id": "2", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 564.5 + }, + "26": { + "customCode": null, + "data": { + "advanced": { + "customName": "build url output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 1, + "functionName": "build_url_output", + "id": "26", + "inputParameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "26", + "type": "code", + "userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 640, + "y": 1380 + }, + "27": { + "customCode": null, + "data": { + "advanced": { + "customName": "build domain output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 2, + "functionName": "build_domain_output", + "id": "27", + "inputParameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "27", + "type": "code", + "userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 980, + "y": 1380 + }, + "28": { + "customCode": null, + "data": { + "advanced": { + "customName": "build ip output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 3, + "functionName": "build_ip_output", + "id": "28", + "inputParameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "28", + "type": "code", + "userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 1320, + "y": 1380 + }, + "3": { + "data": { + "action": "url reputation", + "actionType": "investigate", + "advanced": { + "customName": "url reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an url", + "join": [], + "note": "Use Talos to get threat data on an url" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "url_reputation", + "id": "3", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "url": "filtered-data:input_filter:condition_1:playbook_input:url" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "url" + } + ], + "type": "action" + }, + "errors": {}, + "id": "3", + "type": "action", + "warnings": {}, + "x": 640, + "y": 700 + }, + "4": { + "data": { + "action": "domain reputation", + "actionType": "investigate", + "advanced": { + "customName": "domain reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on a domain", + "join": [], + "note": "Use Talos to get threat data on a domain" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "domain_reputation", + "id": "4", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "domain": "filtered-data:input_filter:condition_2:playbook_input:domain" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "domain" + } + ], + "type": "action" + }, + "errors": {}, + "id": "4", + "type": "action", + "warnings": {}, + "x": 980, + "y": 700 + }, + "5": { + "data": { + "action": "ip reputation", + "actionType": "investigate", + "advanced": { + "customName": "ip reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an ip", + "join": [], + "note": "Use Talos to get threat data on an ip" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "ip_reputation", + "id": "5", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "ip": "filtered-data:input_filter:condition_3:playbook_input:ip" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "ip" + } + ], + "type": "action" + }, + "errors": {}, + "id": "5", + "type": "action", + "warnings": {}, + "x": 1320, + "y": 700 + }, + "6": { + "data": { + "advanced": { + "customName": "url reputation filter", + "customNameId": 0, + "description": "Exclude failing url reputations", + "join": [], + "note": "Exclude failing url reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "url_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 2, + "functionName": "url_reputation_filter", + "id": "6", + "type": "filter" + }, + "errors": {}, + "id": "6", + "type": "filter", + "warnings": {}, + "x": 700, + "y": 840 + } + }, + "notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables" + }, + "input_spec": [ + { + "contains": [ + "url" + ], + "description": "A URL provided for reputation analysis", + "name": "url" + }, + { + "contains": [ + "domain" + ], + "description": "A Domain provided for reputation analysis", + "name": "domain" + }, + { + "contains": [ + "ip" + ], + "description": "An IP provided for reputation analysis", + "name": "ip" + } + ], + "output_spec": [ + { + "contains": [], + "datapaths": [ + "build_url_output:custom_function:observable_array", + "build_domain_output:custom_function:observable_array", + "build_ip_output:custom_function:observable_array" + ], + "deduplicate": false, + "description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories", + "metadata": {}, + "name": "observable" + }, + { + "contains": [], + "datapaths": [ + "format_1:formatted_data", + "format_2:formatted_data", + "format_3:formatted_data" + ], + "deduplicate": false, + "description": "An array of reports. One report per observable type.", + "metadata": {}, + "name": "markdown_report" + } + ], + "playbook_trigger": "artifact_created", + "playbook_type": "data", + "python_version": "3", + "schema": "5.0.15", + "version": "6.3.1.176" + }, + "create_time": "2024-12-11T22:12:36.759275+00:00", + "draft_mode": false, + "labels": [ + "*" + ], + "tags": [ + "reputation", + "url", + "ip", + "domain", + "Cisco Talos Intelligence" + ] +} \ No newline at end of file diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png new file mode 100644 index 0000000000000000000000000000000000000000..60ac032a60c35188c809fc36e4cf7f458f7c4175 GIT binary patch literal 152705 zcmeFZby$>5`#%f_f~ce@27+`WO1F|C(v5(Wlyv8c3JB7OB1$Sd<+bXvv*`9lrb<) zGGk!i%Ho{_Ex+h)e8<2zBW5lxu6RdWoJ!H&=Aro`6ATQQfG7=IO_guw<8&gz#LO_U zKRg@8CT7C?@T?t6W|`+U3DryT6SwL@SeZ-Ct4e(F%L!z3j-kjaVBDF*kUa@Z@!{J|DnPR35dhoyADg^Ai$|e@nov zx_8a_+$#2MjIJ3XkLd}y$y@KR^0*6$Z?Sfpet;)L!g*V|4DJyyc#$_xQ?tmzpWIjC zF`YuZ2|?)E=hKOcuo|d+Bf^!wJAG!&nZ?o~?OdkVAcNf5(8rpjV}w|7->(|JjJS3x zBy!;W$-(>Qzh7+k`5E4@Lg@PwV@%Az*){r!!aY*#{A+$J*s<3djT&xeonA5YwiXMj zei-R$QCNMUKaBn%C)qxKh~|{W+`JDhOGtV z^BOM;y{f^@9IB^eBE~eYB<_y$`t!wboLP;WH`*~D`(oznbw_@w-81jrMJ(qMtmU@m z=VxC{<64f}8?V%Se(-wd_QSz20#RPhM`r9om9WR2OPYlG*roGOx(geeqPAF~?c^!5pXurD$A zDNp36W@aoGp1Q2YiG9H|3?tb7qWASouuRwn-YECUbB{%@jXfP4we!x`6KV9{?=?{O zF2Xg>ANK5f&ieb@*cBrD{Lu;t9$CHxwyQ!uLBA-6`9Inll=pp<-9reA)_R*phn-Tn z9&s(yvFO@eLyV4ia=A0K{l9igc$WhFzh-h|$@86Xp^Ry8@u*h0%`i$lDvTuquRQCfcOP*& zV+g*8t!*`u{wO8Z5Mp#sQ_xv8&|jmMv~TXx>Up*o45#Pt;G;G(-(+vTnb(~DIlnDA z{JJ6jnwRv69@P%HJSt(D(AH=A*dnoP69Pd=g8TyfC#Vi88};>Vl8i^rN~9hL7XK#1 zC=VedAh-%|^}T}oApY_oyk&&n^5niF;|bfGH!Q@{&HVS>uYD_+rX?RG z!!LXx9}YZ>YgAaZPiU`Sl#0jf{Y);0TksW2@r>+O{EsJ9p9DWR{S(vq=|KYV6-jPouumJ_lQ1IY+v4j)MzvUZ;_rw~js;^=8OU%&Jo`X3`{mg_28NH=)t^Ke zacc_qV8ySgWu2a{5gC(s=htcHQS#*J3g5dI3N_PXcUNRRafcrlk7}&=yNbet#puY1 z7VxfO^IQuLlaH2Xq<=~JiI{*`zNVt}$enZ_}8DCXaorIZ;If`XbRUpMt za`w#+(|m!xCkwYisMZ>9erx`w^Nnrd?u7NKY2eAaz%j{yWMk#?ip-1~FFRj)yyR_a zYD#HZYEo*#n%rq3Yx0O{V-i(`rzNEuW>zb|NuyTMO3BxqeAZ+Y#jDEP9Wi(JUdoix zYbDF{)HK30N>%d=f{aIMadSf5%-tuuSu!}f8!gUT$Q6CFz_FOL!0lpB-$;+_X6x3P zyRz|lPHnDbj<*|^%j}X77d4kX*DH&KF23B3_ji62cAaUTFh6f@-652`6YbaW-Hi3p z>rY{yqMT!TvL(Cne;8VtSVUPY_RO`<_4af*_k{GuCF&-7sg~Wv?ab>km^Yqh?d{8T z5TEYEt0DeQyia^rsw=eQ##qIYjIO?JrFFp4)uH*)`1KigOm{7JmW@jrOY`HqpLUgY zJ2!Y|;(L}ar*r>spmj0+)_6d(OrCJ^)5(sL1!q2y7hXO?e(B=Li-Bi)FUH+ixcP%~ zmAi>c+sg5KT5t5j1uNF;dRCr;+x)t3TR)g~vdmbmdy}4sd_WrT?O`NAWLt`Qid~9t ziih0tTcz*h56vHDwrIEPwgk5{ylvyjy;)^+>(c{GW6i80KFgKiA5AyD+J~FGHwlf( zAsfi}lF>RB$KBoE;2z@?yup1r>1+*s^TUc36P>P}I-Z(OO`8!E7Sk3CA9ZYc`2(*v zdA+n%ZAp8($-F7I=eZ}a=T9I&U_jtY5KO=!{WetoYK8rJU&qK5-75tY#R9_=@A>JC zlkcrpZa5hd%lpZEfyGqNv~um_v<^Gh>lOAF_qBB^OG`fo>dxzW z41FI`9?TfBzEMaX9+Vv9u!QX*y5+VcJt*p4;y&TFu(jRXIefF(A=R{vFVk+{PNzY5 z^Tx)QtJUV*YKljytIg`tD(A}RcGtGhD)-vtj`f;XeWAg_8!nvsyZpNW2LwA6rfwgn zKFV(!!EeFo;1rlKn0A;^n1opOPIR7_$J%>(|H(s~SUh@c|C70AD!=gomPxi+p5Ty?>knEi}R5C-wWb2Z{Enr!M+$*UpMQj$_? zlET4PNreS>ADv-)DEqxN+9l6Bui0q1UaR5GnD%)07(;z;eU-v*1;)EGvR7jH7*-4; zyd$X6nclp-5?{{d_TcuHXWXQv45f0cajr%Y-5)MSwkq_*zZ2e>IakE=jtN&8kLeVX zph~4JH6QmoA5~`yCkxTnb-K-7U)LtHr#4nAwoUd;&GpPp%!Oz5W;1_y-1NNBbaNM* z^;YsPwTHG-_20L&h_wa^P8N{nZ%r^xewg4o&F!mI{V82a#Z+$bTwg$-q;98BO7@!` z4gxZpW=VU7NuEjbuarB^0YwuRzSVdx?`P~2c8;e~MkjKL^S$>(x6szO9~BRBjhENFnD(p}2!}@8AKN9s6Y9Rsi5H5~ot3Hi?gy_As?SOJ zkkUF8Hq~>!?UlGc1%ZvIq5X%sw9Ssm2F8ZKkh51g_(W`PJ0>j~?|y5@R?%LLlNEBx zX3NMPcbu7ZFvV(nC(tb9vH!03GtIPcE3f{8`)1`c?s{XO=wu@#Z6VB!qaBuGGo4p!n`hzKtuh zXBR5=J*(H2E+k!u-wQ-^Z5Qk&Z!|xJ?ZCT-0Z;J*D1Ii6Xw?Q;QZf5p64IdP}_|)4-S;MR=%E?w5T&^<_Bw_cqQ(H$4{7 z9UQ72iUgwug5Jb}n1%aHY!a>nKhJG&b2E_bzoiy+fD>)Cv4v#_JdGcKVG1O9T2yD| zPXd=B&_wgj!+ZBIfRllNhk=cG2?Gaw!UX?BFfXG%OJOo%ocPm@g@NI3j)8sDM;`oz z{tE;DpfQJkPek}(;DT=?;Gb&(7P9wA=7bZ-&$zPSH;h{<;&<+VzbZ!dCMMPnW;Tw4 zx#7=1!zo)CEe8yY^K{TZ%sa}ozrp-J%~drWHSfs@7};2{8yMRdny|ZC*+TPR2)PP? zk5(p*22`$AkE|U8T!pFs^bi1_p=J(hsy|&EErqEy?@vvWKzfLWJPenx~ zWN-XXKv_cSXgK&LOl{`qXe+?M;o{=L?sAje#@>{Jlb@fTkukYexfD zHfsl(!%2|yNSHVn*_+!sn%h`YLGv0I+Bi81Q&U3^Lj8BRP7_yi^pmU|jye*}d6L4Gau1j5`vyR9!I_hEA31s(CTO$sz_lzSXv1 z(;9?5K9zvYiA`k3*aOclQs48;)pjegc=2RiMMqNd-N%q_(;{l-z|I=DS9Z4eBJHbb z47`gUurYB{ut{X_Xlb|nJj6+cgf#_80>b3;Q1*D2Sq|l{zq;{AvG72W&r_l<%>{?WAN+eExL?Fz3wk#}bm# zKPg`Rw+@V_WK^G@_?O53Sx|xz76}=}dzT0QtpnAHMBVCSbJN`Ar6KZ@CvlrP?*#FQ zAjnO}+BQ-TI^gx2Q~`-_X$0xG9O6Bq12F?L^a!g}1fK)!QvQ5j7tIrvF-!xWYxz3C z@AUl$8C98=wazr*i6OGmWGC)PC%=y|lO{7t=}X*{-Xk@V*?SLW-u93Ad6ky43!3uX zENoqLm-0a25n%-R9Qe%H3ckl@t&5V7k&xvL$r`7r|R!Ecl^RA8qBFcF+m0 zBmV(6M-;-~iOipH@0{5HL�RG@;Of2cFXUK~o0Z1m8`Q4iv@$0^^qA$Wv=-0^-cN zrS8dreK!3jhJ71O`wYJi%c**b)la$D_SMV`5xuFgr*qK+d{r{N^(V7-1qumhAa|;S^(Ou_S6ir%Aa}|IV>uOW3r` z_8Q6f693N5*!eV6O5w4k_9_2l^*=3CE`ZlQXDZ`RA8qkj`_K@nJAp8lT>LN@0sjOM zE$G+i`vrcmS2G^EeCkA~@cEOtxb{l)zNkIn-AcNB4!J;k`s=3h%eE2Jrgh3!00*m{ zdKp0`=(3a+WBLTSORBfvseM_zruUAPoyJ6UM=7#S4h!3!nMy0XGf<87kogmAK~LXI zdmQ@1^{p~1x({_4R5+|@3r&JGi{0~)c6qdQDJ|y4L*yahPDw_kdllTB^M{ge9Nb_~7UKezF)0pKF)__y$KLB5M2u`hA*j>mxlP zK@-@42|f)r-Z?q3q@)LAIVFeW{+m6{sezx zyHu zPNmdQ63ce#pLC;Tu01+GF)9WyKYzMR9hKOFAK+soeE}x&Fx0^J^b7(9)ZyL-WV931 zA)yMh0uOuC8(+Y1^e_Nvnw6efT3$63mutTK5_1y>Aa0nZ9GBbw3@;SzA3>vcQ2`=6 z?Rk?QV48agdP%ntnTX)t+k$%|u0i4AD-3W$x#yw?_^%Pl{XKCA;U5-({$Y%F#&#Jg zX)-U!e#W>L!dP{=oBX!5>QGv#lGFQ315ecn=$N(B&Go_g-2rQKw%R!u-I5MEQzg0& z|GihU9EyJay%cD^wC8q_jf&#QiGe;mZ~U08I~Nr91FFcy$Jz*s%HfKUY0ou2U&F+b z1VEdnJH7-PLew|fBIe<|xm#77_0j}Iu>LA?(*CN2LRbI;vwNwB;kz@0k=Be9@h}sN zz$#+|B~FfLZ~Xjn!eapa4%aVf^U^DI2;B9c7NgR^+8`lY5*>o6OXcrzZ0Sd>v@hBH z(HHgLsN$Pk&9+?C2jXi<$rf|)_K+uhOoqDds)iw{Ow{NHc!_83n-&s=>d9noDCHT} zF&V|R?QRr@d@heVU3|!mI-l?EfdxQ%{$l3!)VoK#Lw=1)i4&`q7D@L^tUL6~@B{s- zo9vz4`Ut6#-FXC}WS+b1iG*aqlTQp`UV!=wy@@18>|1v}ERE6mfJOLlf-oAN4?qS} znc%xLl+j^>1H&sh?MtaFw9NFXWa`vmmSFUKjofPDLlnUw0;9#~Sf~$2E1vO@r)Ab# z9~;RG@EFe2Cu{ZCV5!;Ffn6Qm+`Ma<)0y#xge*IvkP@p80z>N|eupD_MGTPs_7$W^ z*;9w5NJs`amiLMm&6&S&W?+tU>%Uq3LVrKW_Iro4zc`^V*Mgg;0y#N39-(j{nhW>qq7%-pgCwysTbLD%Im2l!UKgQx0m)5$_<`uF2Hjz^(Bwhx^6*bzAn(ySX+{ zhou1mBn=WsAtC59_}+YHG3-dh+AsPP(lL*zkZo}Nh)d&}2ota7g)do-eu$LM(s=g! z)r%40O2h%BDqGc3L$6;A!CTTe*Rg<)V;3_sUeWQd1ZwPiyDpcF@Ow7G_O_M@h5J?~ zTqCA`X<|o^gr&*I_S+$`Y>^m%NN8pSk`YKQ$mk?dW4)|2SK85Vr|Sw-i4$2*TiO$n`D}73P5o|WR9cDKP_RLNp*e+uYWabc%|-Wvo=iUl{UpOI?Lt;Uz%FiS zk|sx>AIJ*S$V9(}^Wm{mX<(V(Qw@@U&xd+nCk+VPHkO#(cUc~$$l0%cU7amHGWZiw z3%3vVwrk)J*N4Go7KK?^H9u0Z>J>72POU1udX1R9%+4CRJW^aWw{bVwxc*cF$60{* zUG1dg{=Su!aNB8J7hl2U^33vk<`dCIAp|cjaAd?3yKnS=gdrlQ?fP%ZQ|L{L<{pf; zi|kgf+N%5JtrG8E{oC2HC+D&NBC~1lXUPiuqubilY9TR})&;;l?q>yH zM+$!i>{2omWAaGe?12H((Vua@c*?K6yPLbb6Sh4i>br&L_Mf}@E0^6v!L_ehPus=q zzHL)_YD0(O8$71AE0<=MM<_)0!>b5Jc9ypMOkuMbZT@Phxmow=UXoDRRBf}3ZYN4K zykt`GdtH|*X#LsEiLv67MOM|1`3%|lJ({o!Ks3s`KG+{Iu_WMdMvE2}-Xp;hghWF& z*Cr4)?;ppbSq1Om({hQ9VqnhM35A`KzUo$M%fGqMM_MWPk`FA`OK{M6VDWuZk4)0o zZv6erQ{Ug*w9rq!n4C%%cks@^KRzriDvi+#K~2v%MnKD)^vr-5Xyic6`6jtTUY-CF zMXgYj&U&QQ6LAE>)5uSWgfGh*(|+oPq^p_c2Vx14xtG3`zri& zbnFGksbu4hX8*VaM&VQTqd3$4fWT*ScQf@51ojU^_l*Ww2Y1&7suzn#l;U`9Q_TZ9 zYvtaWRyf?^IbEPHW{4B^kG5!y4YtU5P~*DK;zd=qzV*qa-10jEOMXNeW7Om_qOG^) z4g)(!aL6u;@P_T^Te#4DSdBt+v+POzs$G`J*(MF)DAN#fCSf(Zrq1~DtwIjnwh=Uy zpJr`DHfDb(b9fb%J5Q2cO@5=lGlw96t$kB?U8Sa^xALXYrRt!?cF<1YVqEDIZm(aJ zXY+tx!vUd>5HQ9j^3|TyBel{>(glQG9~V89?6((98n>e~ z_^#Un=zJ3pYTmFWGM{y`Iur3bYBZhU9npCmgd`~4eDcVJwdZJ`m8c6OOMO-aZ^Wfv5DM>=xMyrSP;5iFi{XTjP`7fA zRemzcq7SeBZ5bykI8fo?!ndZ?#xV6+!9dyzERh2NO zdeWE&Vl{U(!lg3Rb5NUxgse#Qdvhi@6+KJ!&qo$)60ptAC8tD19v)g_g;**n8Qrfn zy@QEPoa9vcdO$v>l~2X`0zJ&6dasO=k{p%e;R6cKrbU;((TdN~46ta#>WcIlh42gP zH;Yp46VzQEc2z1FP33*{x*`0s&9+@MzeD}+iLENc)8CtShq?FhQ@eTfG~fhvnz`P) z4T+)dRm=H#k+)%p;7q_Wv3#CE_ulgOU#QqlUis~ZZO;JCu8diY>genqfV0ENw5>bx z_*PlM{3Ik990ve2Pf%PSgz-|pGM9}e3E>-iZvP~atEz`38bXhq4aHZOLAo$L-nKU>JP3%5T|oI)0p59P15)kDg@AM_NqL7C_Sz+{a@_w*L;KY^-$Q zoxD}Val2ilb4!Kmgz(&*anVz}h+a0edCxr^7-filX`zMQyXTa>IiCI3*e~;6neSF0 zbxTTGw+iO)ga?L~QN*ze*R230sO0eG4R$^wIF>qXht@-B#PE3v&IOk(=*U#SzQG2e z^4wm(MlLh#MUs6Rq!BOk4qq7Fh-If~oNH-?*W)LWzL48LT8p)?_NsDk*8N&{eIC{f=|d zCm|4CZ+DFz9d)VPtN5McQk82FcM3}j*gK8(i~KH!#Ct4;M?#i#r2VP>nCP3T6G0bm zR)0@Kq!7|kIg9L?&Ak2PUv`&rSg*wPRVICaJOr((V_%yoNI`u6O=B{<&SSo}9sD+8#0-JPL`jVC82mSl(}qmDEY zKWKuV>Y~QGkcL7eu?(}4l0YgDhm4Q#o_PO_d7IepOrK1KoW11A*cdERvGEEe0WPv- zIm;gHO9ps&)SMQ$NPoRhgX)`vq{rPGpDXUF%C$E4W3NKAYtUAsKVoSa2o5r=OpaLE z9*{14eol=K3%edzeB>t@sFBBa5(E=&DBh6|KjO9P#DLcV7`6N{{%7<9;8^NT7J}i! z2_~ukl820Fgkgd?&ZtJHAOmW065v#*WqYoPQH6q)xn-%D9PK5L78o=i`qkAB*F)6{ ze*T=J=Sw5@;0&0A)0P#vX=5>D2#ocA41s0E9)wCrs`Ai^C73}5|E~UlP5Jr$K197y z(3L>Zl?z6<_jk5%|F}9(nCyBc=du?fe_USek`t)9sK{hU;HaK`2C zpH~a*8I?L@??FcVU9id`%jRXmDp5n@ZQ$qb=CmHls!tWCES+z5T z-?&um-ahmnQ`oN~CxLmVO>X$dNJy49ojpaw7z6Ng@sbPV;Yj)I>2FoJRUm>nMeP4X z&Z67lCaDK^g_Jrvhe*ebU85bvXSerRPAKlv?I9R#51@z`E)L|oJnd*NMq~u}JBM1r3PqzhQ~pH7#LF5A`VXUFlBj4{LK?(3*>02c zV!%Coa^}b>c`U{Q2%N8^&>Df{65x;5l}M;liBYA3A^h2zbw_l<2ezA1bcVX(5kZ&1 z&u+N}lQd!pabTaq7uS%^bsylwMk!(byGN|}r37>xC(-i3@OcO6-9kgM7l)5y3<4t! zGPG|U>D}_va`Z}eKMnkS`wC2_pGBXqFz^Bi-hB!z|07N3f*YMSa4j+-g2Y#+gx1^&J zOV9==(_eEAc}|w#7p+XrX{2YG20b0O{?Y&Em-+F*=;&yecuJ3!1rONFDid%`DnBkJ zX78}RQ%0T`J~h})SfDxxH$qTMg}`!{TK9_+Cv1V;ih|rlGAt;}>AW-Zg z^I_YYn+&Y?OA;*f3P^$1Z8hV8C79`4;Nb%MSqy`93z1@5;4i?a|2XDXcG>HOy*w;) z4Czs4u?d}phG{EO3_v8d8Rub344Hb4(0hxj>A1c9-=-HT@}T+SEB75n`z>LbMQ@$v z)%`0)5N+Gc=SYv(6-iO!sQg9=202p^iKQHPQ8g@0Oz<4+v3^*gWzx;0?wLPLS!Ypou- zGb0sc<(Xc4o4)fodrEHoc*q?B8rOlK6Qf=%3n!}0Ck87u&Ru(EF;=H&LHBi~*G!aR zs#=Ssqv25L+ZtSv?T(BVmxZ5Ktv^prWw_BJsR?$<_zJ*Q-kgp(67jI{y2$u;XN;5pH@oFw*0jwpXewS++MBv|)GKU>IHw+$p*g2&qtL$>fAQu+Kef!(pldo;Uqzg|puc}%^ruk>d)wQ_M!(=K-%zgwo7+rUoU1l1 zF>kAvh7M>hJa)}MIeqr$_;CACO% zgBh1%v!I!M?aEME9Z={~QZ2zTmy6I*Nt0v*|5UV5ja>r;r9zp|!qO4}Y<0Ky*~os2 zL-ShwrJb*YIcN3D=Q0g!ZPznnmp)JDe6$<)%j2>6b_0YNIZi68=Tx~?W|IfPRw&11 z_V*6Pw?apbW!v7$A!wAYDG`s;hbQ{Uij$qNx^Y%*5M$99C2nrNr}QbNXd!{H3XuTzLuArA#gn zm!-k>0gs=*7bpa;o`w9%&$8X?G=!p8tPghB)Ykg>ufgkJCZ6}`;Vi|Lj`u-;x9KM_ zYze_Uo;WoACtnw24w)k${<Xeo(-olFDV?xY3a^q@h#7wW2_De#gX<;4_A29oOsLYzsGBZ=dmdyl4zB6EZ-)!0mOTsCO`2Yg9tf}0k|yTbX#6b7w3*Q%3w>ra@QKIi z%4K9C2a;~c)-~)Z0IK0ArcY${;!D0sb4`-uUB9h^FDKqs=X!56f4b5jj|LN>#$2!$ z?|Joa$Myn+R2FLqkkbGS^_M{a`nHRJ$8GlY-$WnkUrsw%hS+7W#s0?@ua99iusW1J z;%nSTV|F%_JV{RRLaJGSdMRL0ob$Tr=!F&n^FN6$$oV!Bp2ZT{0si>rc>5wF>|jyv zz&Ho*Pe(~VXiHSs0r*PjojewU@-b&S`;gIH@RQF8&~zJ_qJbKq%-f}u0+2vJEgTo@ zZ$xa3U5(Os|!K-2;c=UBrf;Aomfw}M;=3Wl!$OO6QtSOXUb$97zg1x7rI zZhTZ!O4rVz#}JtT4=~9<;4+%DRJOoLyv>LnL)HEf?7hYj_$#Or`t|s+gs&oMTEJfh zfM|ZRk7Q6?9)AIT7Jedn%>REt|7Qnuq_yft{#ROScsG89gsfk5F@AIT4(4Ljrl`## zto+mb*&;+gg8cHIAKI#_YBwKbB?71No90T#s)@DgU|Ma0{rfSgy5PXeQE25e3)3C} zbr`iX8Nyv~Gnk>V8EAk@47iI!s-@l!!sD&fk@&;f4fCu&2{f6pT~^8(-~OMz+9w~` zKNCfOgk0B9TA7l|`>T)^*^T$y0u>oX`jTU!BP*iLi~b4lZdefU*2q%T5UdOlvUrO` z98_B{)N8%kg_2#uL&6>AkZ-wo1@_#^nW}3teWU?JXmrpqL zcU6tc98n2qNOoy~phhS^Y@jqlH`m3VY37vh_qybrFg| z*-r91p_`b%>@s&G`Oc!7v;Z_V8fNpGqMK%+tdWKn-(_^u8_?9K>cp>wZb}COWlW0r zn9xms`^rG|nS({hI4tt+-9ho6^CV%IHS%T|+m$fsXlp6u$wwX%^bHf-WB^x=9P7m_-Y}4Z4X5EJEfM9p5o{ zy$D4(U2z1w(7j^8wr4(68lm-Kqd$N}kvSzMG@Lp@s)S~N02vwsN{>94R8nDFoF1<)&iU902pM>OU*iR(lXZuhZK9l#(gnn<0u2ZkCAgB3+xb zgI;*U&%+>4;;9l3+M8?5J!f%d`-=V z%N7mO`WGLMar9lr0m$FB;i4!8s@eF-&n{AS!YyDd@3XoW+gt;BqZq~?9gI{ozHe%FNt~}*?y9%+=<{mYxKf&Re$d zAM5oRG?mWP^d0N<5;Ub`G=D>{R3;fTF=y7@Ikv;UOFZz1WC}p97|Vvw=w32V-9Zye z<1D(V5g2fiCz-!79h)A?lxbVmyB+KG&uT%LSkP-OqxRIXUXX1(mGS-5u?>ZSCil7O zH^(-V0h-h;TiuTJ@&Qfw%wL&~^(p~P^(^hP=w34)Koi3T#apyTB?2IARVh^VSjd0| z5QxISBPdFMJCm`jFaLRgy=G%VYk#z8A3!=eMksL5hwQA85^s$>& zfbGrSTSTTf0PuBy6$Gk}Hz8x40B3!{_Sk9*SR6zl;vwt$r~@yd@OFm? znv>6gs)wSJsIr}GejT;KJ6Ohf<_y8h z)JSqWPdI05ZT!3f0G?o!iTDN-=|&dAP0J;GL7XM^z(ZMVFZZBLXOA*>(On#}f9w7J z{IIsnkta-U$p}InH`F}~J>Ni>%b7NqR-$AFf$*{5Pkaw#pK_L35Eg;V1^LDP_?}|X zj!(nwAo%biZxooGI|s8{riWm8X&y$)4A`m!#ByvCd7KkpVZOaG+9v83cG-z{4l;Zj z{(w5e2!QCipBmxYZ7%zvx_j5sU>lT1wFkv}Hjv?KgsO*rl?;bqQNcyQ@zPcLAw@w@ zUyN}M)E6_B{CjAV4Kvvs6Sb08T>+YMdRXyv9<#kx&}Eft56iU z70ls5XfXqodp^K(=wpvXmF@wtq&fu{mi8sZQ?&5O10k~4&I?3a0aUj@C+s|mKy;^J zNJ7=$Hz5lI!Ax$T(?ko!F+R5jo$OVj@Q-=kMvxf)N1=HiWQ%!IFe7UZfu$f1gwL_` z;1wmOr-i^I+-unwG6^&;v_BuODiZt$ygH6wq`-O;;XSNebp- z1_PC~*yNAx@b9D(=oJHc{kSjK8jPN+2^y$(OCD9*`&jJnoF*8k4Gq-3*?N>wf{Y($ zu!wvWjaGEUzStbJAq_ftWFiyvnu3<9VIqGl=^}0+5!I zp<;jrB3c$OF01(cF|F~RrNt1670Ud2UK5JvFBhxsVk3RUPJ(aYN#80E=CTc8#o|maHif-fL_-H?w0fo6zoV$99S+aDBQ_{VDqR$D# z#}i8973f7BqiHj?tb*D**B_lR{UaPpB`uxj?w#sKj}h|*=dr3&EQ>bX6HKsJG~$RK zw!XWVBKPJ-x|awPPphhe&6o#vNA|Zip^pyl94MVn;&aOWfNr~V-fSuzUqOZIyY;bf zk1v#yli+4SmR$mtpTeQvQ}s<{is3EBMIZfN$veo3K99$>3U$=Ru(^PKj{Se;+5TAk z=b~p+$l_AWl1q=p$NntElJpo{ zJgOguI9U%mH0^>WG+rd!!yklNiE^gYU$y|D22QE}Q@gtu0V=;ZEqk&uuFuWSpPui@W^YqL>|`VC z=|VY^K>Xtj;Z{6U`df-PH0h!E#~V0K<$MGws*hF!JsBp)vr1HocL9^X3UovB9=LDe=yZ=znvI`_ zRlA%|?k!KYg;qsCg~yg3E{_etmQ6p==7L-Ku*K9dW%PGZ5txo#;la1D_tkcHLkU$< zLO&1iupj>138~bhPW#sLSv1b zy>Di!k!d1^($Wnya1b#*2VioGS(_7W+R3T^I!rIbi%vas@bC~{ZigjTQ3yIeTNFnG zZ)`Qz5c=!Dyqh&MHPHg{SnMmnSbX)-K(rb6fEtS-e!cMH@82{QIquaUe{$j7-abGo zkW#6}QJWW9Z~yesdZ=X-l&l(*thJV9ys8WE|73ltc*IWU9oMk{Y{D-femH~}b?6ZF zb>&~61omtLh0A_pUn00GQ4V*?J;mWU`uY8Zp;hJ`GOxGk;m%UrfXV{A^Mj8c%a1O_Lgx)%!@stsI!vG5Y|XkF+V6{jp^W!1`e z{cbhSHdtux;5wbWd>Y)%$@i{wJsGob0)}}yDN>X1?|6y{R@I!=l6LZDniey z>wddiDpNiC%yRj}ScY4$yyr{}8!}b?kQSG9g5Q>2sw&KD2+-<14IY9XS<-kg@ zrr)iVUw4}8T3vl}^Wn41T)47ZDH+Xl>{e-em4}O)#@^=QX;3Kk9x7lywk%Lgs8lYX zVTf*ff0V~ogT))x1*%k=ESEWUm9~6$UEUKR@5!wyvbexI?CM2+Wj!|Vf6j@61UvV7 zVCv0`^YI=_Yc=t@>-8CKE%Khbt8KoPfQh@Ud$M&Xc6WC({->n4qQ-;GtiI7VEE;NT zu+h`{MC|3i6f&o{1?}ogtB7(wPl;wauN631R_9de{*`^c0xZk1uA&H(1;WL6-C@T3 z>8!49qNTgbQ;&~Y;W!{mM((^kciQ9Xh>Gz^6SUkYY5=BZ55_^C+U=QGUWF&OsX*%O z<;R~ZjWle1uVat-sL)NLI13dm6l!QQQ{CxMmKPMH`smbrf)&*c(%?Xqr+vA8EFg&g zQg4gPVQPWTTm~2q2M1-ht3v&Yzjub9M&&~>iUR>vEF{r<&YyO?w|vQcvUC6Za`zJ6 zm2u#MkLa+GPwH;ss5M$}>aADONH{%GYb=WHlqHv?}9|4L&$R-ia*>qR@;$K9l zO^(*)AW?J@wIsYCun%%f!~99e4`nDq87n?#fGuuZvic4bCLJzE%mdp~rtHs@Vo75O zzMRNiV1l8B$I?T1fNI24^g8Sx$HV<=;u^LJJ*%A2`6H?qpubiY_cSUB)9wu2Y3tfF z;uEujF0>_-_-fdrXQu&hEA==UwOJ}flHaPnd}go3V2GUdk>1{%p#kVJ+~KBtzMnd} znRLYk7g);j)iBtYDlooly(T&&7eha+W$|w9TZ*G0Ga|qz> zP-l+k*zNozc9n+n3qyOZt`nnH0at;`x))Dwy966VlpyT>-(H3--q|ef%zd08r+Od$ zrY-m)7YD5GZgcMQh%E9*<`v(vJ!juaxN+6J(Onz(t_{87_F8TbQaTfuK^3ZoJ93uDJ4G=z7lsPc|p9beQyN*%DqNwbDfFg76z zR;$sSejT;i#q%?@ED3XT%&%CrgfdEK;$whVO1_*4%GS9mv+jzzX$0Kue~J&MkGznY z5{r@&zYVR_q-7ismpNMA#VCbuT7o1-vZ|`BnXFcm{)Knf=$M(E`bC$b6c%}%v5{-= z*#~j7iCp<8l!H!n%ZE0CEb2}`o=8fCdFPZOm;-)CRn?- zg7Fz?a^MsToRv*I>N7h1dpWGYRjY|lv0Xm+<@p*SWF@O)$Q#9C33QOAFep5hd%IT1 zqLpX-ZS42z>xx1q!+^k)?K$fO^T1NB^XLaf0~J;GEIkXY2p)L)I9Fh00C`(!OL7l} z?n>Br?Ui-kyjLXgVEz@Zc0Q#bI=iN54AcsBZ)HBpnJB!UpsS!(xG%Bz(Hs-7YD_x; zTCYLs3lBv>Of0tZVOeIJX811CQ3_01=Tgy3patgrt{zK@G8|+w#d_Cs+68UAwH4aj zip0Kjo?{a$JdHeEOsu~OJA8QXTr-l+rZM%I94e&O5e0UaP%?u3PqqINzi_^$pNY-- zntU@$Jiby3J_=OAAWdHVivUz#9!jp_6-))SiQJruRVJ8Ih6HNbSP(v&@uc8Gg?D|f zoR(3aNVONf7am`#N`hRjk0W5-51AtG&Z3Zj0H+*_nKEk5JkYc2y)ueKAAplU?d3EU zggQlg`mmx@W?-+KwaWG3w(KRKG-`=)vJzEiA^3HoKU=Yo5cw2LtRes}7G=?BpC}<2 z3jl*}&g>A|kg1^a=47S_rFynN1x4A_qBd^J9>3no%7Z)MO1N#^*F2#DWW@Yh6w|rBRJ#X-1Jg3T07Y1$|EPvn_qvx?bD1#eqZy!u=#Uo#K0c!k66jaw8 zw^X~Oe_Y6bYVX8WUO$qC!ruQ`aWUdpRHc%taQdcct2L~S*X~*PNV=J1eo{~8C3A#` zyHaYRz#_`^*NCqt_kv&|?4D*?7Lba`mlT_BzJ)iZCS;)@@&5-i;{fFUp1 zlFGNfn>wc<#=RDk60TtOLHLeRMzp%nz3@4FXM2>OU@L=~-|(a+TV_;K9dTo|3K>l# zS#UX)1z1417cB)DWU<5a^?&#~9TlxZ66gyhV;*(0p!Oh^ibEi3sFbQ;FgVT|nPv8H zz)m6S9*gUw%CT1zh&}#74p7qQmnI5k#1dk$v;a(~!lmK@$=`f1o9b3t%z7HWx7m~$ zPMv~g{X&p#N;;?yLDyF$d4|NZroq#YwPX5moeowsgjXV^9_YM=b+ky$5AkbYWz^r%94AHvy}6+_jRK|YAAi|~NJq^PfS>DmN%U$q zIy?E#EXo&J>>qJijp9kwEb;WjVe06K+aH2?c}@%*U73esy5I1R%qIosg4&)oFsSof zfbWYFC}t-j2X?LDeQFleaS_SrQMD+j84D|Qj8w6#Z*9=&r-z_*DtJo?cuEW_>J25} z6+z`<+M-#y9Kbw;wZs&S7Ujakr-`NC`Dlm)V{oDrj~EpWU|FU#>{Jw`#S&hLX+y?= z44@uM4O#qwXUXp;yk`zvyg!rMdAmu;N|moN(UFaEp)>}bDo9nTJ|IVLJB-JNi=IV_ zo>@H>{{5px_pF+uf_`4Ug}_qPMi_75m;5#nxp9^EvD|6wsb&^;iquyQFKd;UbfQ%y6<<^Jb28zAN5 zr`KEGUMNj*39T~3vJBe4DmfcwF0TxP8tc|55qjnr;4GVAwWXk2B1mL9Rmh--(uK;E z{Z$vHAMZXec86++(2*sFp!f0j+dzOBZ|B2B$0F;?LC4yYrS-a`#+U$D%-_tkkXJrH zsM8cUz5?S*Y3RpYB9R&JFS^Vu@#M1A(5l!IX@_I=XxNuP!p2OZg$LbVfHv$?DziZC z^~4$wWOx>Rte7}q9FUtL7Yk+ffIzA}Rs`9&hudW5wp0&Ve8SEHmMZLewuWxHe#<9k zRyWaQc>h$6?)Pq?drIHkH7t4m|)HS0C_( zrOPxDpyb|4ZSS&?Mfu^Yp(GAp4YlPD6}^17_*35=QM;ieBBjpp(jGJBijp^P2IsTE zKQ9THlj1(i{q8KnJT*Pm$+%Xd6vjlWRzyoTrQ4JcbD~ndhdJ6I*kLO7@I6*HS3rFZ zP|$k30cW_oF3pjfU78Ev?dr(tO9TZn7mOM~ws=ikSX8u2SdCcc)6<&pT+bhfS%jhE z3}PL&TeZIqTPeM2`KLN)yB%%`5*B@C2+}{gx7OJZ)H^0Xua<&RzdWk{`O1)f(UgN0 zmpv9OyWf{C?Qlt&2S7<>%B+KaqdENp4RBBIfBo_hP~Odjnfus1zg}A8o>C#7q8^ew zm{|W(EQgB?C~$icw-D!eh_??awNUrsKbFkl#&Mr+ISuamSh6?oeb>(QZ1Q*$bu0@S z2bgwM^=%U>_p7MsLoKQ{8l~WS)&mE{ZH-X*&4$-?4y51$-54k-2}Bn^T+dDw6moAn7_GFl z$#4s5dea;##Bk-NP2KOT;Lt3>D$n1gO?BK2ur-&^vv(C1&YmdS@^j*SbgFo$JbTK0 zyk)&9b>$f=YWY-QXMs>W>WVBtho!C?_((;NF;wo-8O$!jrMfwAxjNK)BTA`xc%`GD`eGZueb@evAjC!-_vkL=qm0j4 zJ-|-rQsz8HRvsvNpk>n?41|86A`i0St$}4mj0#_KS z{Sny$OnHuOHrv~;TrupZIM%l{GsGgCSfp zrqty3XGE6><4Ye|O=iW6>+PuidD$3}Ro_4*M~)l(ZfNouotC53;#~ePUZb^K@o_4I zN6$fgdq)kyXVKSWq<_hKe&U5x3rEW~eDSrv)8$G*i@qHjVeayot1BtJO7c{qBiR;AnrZP59E-vhnDaeTRn^uQnTDJ?UnPAdp=%FWLb2rdtC&6S-iBIpt{QsT2% ziliK?gzZ@wG%Vp-WUF)Mu2%$(zoIyQ(s}tT??@r{!jeb1geeM@9#Hq z{b9=^x6>#mvd33%=VecfogNx0w88z-j!V)W=*U8tg-?KpT6q0!pzkkP*72j6!wjm4 zn`d1-dJzX;P_Yc0{OBxTU}lIneLL0>LbJQ%i^pm+c(CbL4HmhgjOSmiRJnzxtU0lx z7l9|I2kg4lho8_qAExEQDh$Eoo3l3=&?V~+lz}8fj^!USa~Dn%Q0Bwa8ktB(F*ofFR>o z2+Kdi^*}+}6|fD9ecQi`%g}^l<&y`@VZLjs{|u%Bn0yHUBl$Y^Ph8Ajk`Avw8iQLp zCiyFWxAh-T#RV<R zPxz*BeSweB|Fx+fGuKki20b9^U<9P>b?G~OCZfj2nV=2u`;%c%Av-XR`hMB&Koyjz zy}bj6zq@sRWmFY2ixtQsA(Jo@u243YJ% zVFvAowwym~06iWuwv`lDYSbJv$Z)&fy`ViONHkWZ_GZMk^jCRYI9y_C1Hu+bwc(TS zfzllWO~T;IpmoHdW@6@YcHuQ^FdFlAiU9~tG&CSlnC6V8hlt;88Jcu*#_XXz4SZP5 z#w8@>|C{zaBSh5xFKxWLuP4rfX}wc@M}v-8t1vw)MG(65-w5*KU8Q;S3kA8)vBAK( zf83DpGQeE@KSKWriAgdn;>g|L8b`KgM^lLYtL*@f6Br+yw?h8)F`3lwSe`zIm{OmX zk?6lvI0v8?Ma{UVe>p25m}uzA)(q7N;v|yeO~zk(X9)KKuMcWRQ2f>SV9uADk527= z*>~ij!-^vG+TZFJET{%xu*?#@q(7bRz~Ad8O7iI+_!=#Jk&qNrSoBi}!{0v*OvxIh zvTvBLh}|6d7dMi%egt5K^KMJGy_ydd_4AmSsJJ&+V%7}WjHRq*U=7}z z)m*ldD{a9h7tsH5JpR{m0#%M%PrqY4vG|zMuh$!@GOTO*g8Bz2`Cms;?fhwYecu1? zZnqZz6w0z6RR5|o zt{A}LkD=;If1%3Z_|;LoHX3T_qDu&DX8S=Sq|mJfIeb_Ydq*q%Rm&uV5lTW z*=K{x_=06pG3VbJfc5`RH2`y-?{09(tEhv8wMiTrFy$V&^rz2;Q2(7i?d7E9fL!(L z*tni+C))>S{o{sLk256vkgtrfHRChihzf6g9tl8A)y|uZV){)tYv^OL-~EeDRsUBE zUuFTLRKk4#XTQDXE=Gd3W^Cn-5 zM8fxY`D^(I>XY?!jcdNNv9U3x^Z)M={)ZYmP@$4?M^wytF)wcsRJ#y=4WKy%o%sDXS|H6gte) zqi>1rd_(=0p8fwwzbC7fujBbGwF;e&vn9wuX3*eHQC|=yPx2O3a6A65=nPSd7zdq()MYD#`>N@A9V0D#zJ#oA7vh6W0aVqMY?~U(3 zN+>2O?1*U$j+Q=wd4PFJBQs9UqxDa{|I1lpO38E%3d{cP@H?f)QoE)JC=}6LEBlc# zUM~KjF5f}>XsqUrW((iHkMTdWK!0qUlf8CDS!8EHt;2XXa^_+YWXk4YS88iWe*ON? zcHI_oB1d!UsCmN#WR+yQ1pgKe|0nRkKo}LscwQ~tTR`OUJ(lQ58d$^Q$3IfMH%Ty~x-!HQ?tT8+ix%5?Kv4Pd z5PM_A0sXMjn{>nkWeuvHJz&2 z?Osqgi5cr@O>KfkAx&D~8*}M)`b{Q*T|7k@XEtCNWbr&BGy*iJM%^=SaYxfXeTdFR z4`9MXex{3rkGdXw9}M`YfI;&j6^yT&HkGao%#89?{z zh1Xgw#*AxQEI{~!*F8DuNcf&v7%ep-xmMgBR zhE0K^rIsp3t13nLVg_W8A4Pl&de{He4F-Pr|1{IqljeQ-Gn18+JN%%gnk7nRs&;v2 zdz5*iX;ztju*>Y6h!qYq9_V=p(U}4@(&wn&4@^)j@rnt!xT+}BH8wu=ZmQr$O3#dp zMV&aizBm&f47|XP@XVE4#2AdwNuo|+FEyPL+8&~}+Jywf$_7_2#>b-Qk0^3OP=Rz8 z_3e+%M?H|^j$5P-Nv*7y(O{SkoU@ED0}IY_{n3$Qw}Uu~*nCLy+_p^VV<#;NiFXLW z^$Td%fvoNMtr-gYqXt^m`t&=$Obw_UNHi-Zbe{jUnJdug>}yn7Nrxq$_Rm?eIX7OU zgE@3G%~hcH>Kt1tQ5i2S=X&u71OS`#y-BbmSkRxPg1E?gET)PvU#q_1-4^6^$N8{` zju7I$*flrPaFFkn|NeJGOaO$s`|whf&VDReiiE?`q5(xDY+U00eXTO2Ji+{zum|}OFccVSu6Y(7=(UF~8#vt; zLRF>=Y&MyhqDMY&Fq;e{9K;K0v&p5k{!<-k^5W0noCx9QWJ$(z-9DRra}eKSmHPBVz)=%6pc)*sS zqt%M{Z2Bqn<2Il-XFYpFEAuENPWs9<2SD+2Yh~ky42wWsKLpj>r|NshJkQ?sPa!*G zzovd(r~jIA4`Flj&hO5S_aTkwr(0sPFxCVtamv*?IraOLWK<8-@MJV7y|)aDGg1wU z4__Fr*B!n#m92@%BLFo*Fy^`u-YCn^$-0i(-ADubEqaJkn*~3Zi(QxKDLQ6|Llxi4 z#EZv(g-syIz<@(CQ67OyUwxZl^_a`;I>&ZA1G@K~nzO$ia&^Wd2xq3}j#+1r?)Y76E}I7I-4biGwfhlOZsf ztCVMZ&J(g-=xa9KJ9kdkos$HbLou4C>ugn_d5X38L5A3TT?hU?$ZH~<9`BUl)8T#Y zh3=MG1S4mWd6Ii)Am5xNJim4A;RDaJm0LlT6&2{lro{Xd3o6CdYgSoNg035}cxCdk z{NiVO5yLFSD`N%niy`Bve(&ijZa@9eKf&)8iVs$J zLU@Dtu@H-L@?DuMrQ{z5yM)*Tm*r=JD#N1PYVXR|y4h$IMKxseL_Soqk&nqsgdryb zi_lDvQxWZ-Lq(j+MtvL`%U|1%TpJ`7D?0FBXqL^CW)yTr;4qxj}BiZV?mHWqR$y)C&|^OsMO-Ro{1 zIa_P>?2_Rz%+f>k?%3$B^^S1fefu>Zk3{FDQPm@AZljf$02gqQDulKZSt+0Q+n!rl zNmwpDu3nAoG2cIgwCq++KXHQAh)6S~sgT4#3DbA1ejxGG)?>di9 zTFQ1K3314_QzZ-aWZXWNMY`&;UnG!hynus$ZQ#L03G=tnF}l^Jh1UiaW#aj5tcpKt z=4pmQ=e^_uf*0RTIkWj}kL%c2!N&U2p1TU8+q*aQb(3ux%?3#mU$C+e%2j^WJ~?G! ze%;M0M|lWN_yQqlBVdQ)@rr*_b;QAbN=TM-tHLVxGTw*#lDL!`Zr1c9=Dj#L_Ok3Ru`qzpv z?`UO2Hl`HE*9Uv$xzs-x)e88feM4*}_S8dOtoIAMN-nkBf4dMhGM4?dE7X|)@4o*c z%geN2MS=$}v7o`v%5e208-;MLrU4%3-&rG3oX1jQBsi5#`w7=qcsUPOdfW07)?wb? z=&%7MVP9ibe|@TB`>=UdlrCmQf|mVGf5q) za)f{c5RM|DL0@e(l~7LjZt=N2?bgoKw=gN#ZhwiAuP8c9I=fwlt59e-Vz{xD#7Amb37ZIjx)e%(a`=s>N}vA&%;m8zzOEA>C;52!s~FjZprT43XhmZtE&n9x-wO6>E-z$N6DWWaT_m>_+&C z*e5?Ty1PuAf$~o#aBJJ?>biTXI&a}nO>NaY)N`3&&eG3<68YZJ{lqlo%VBy>pN$J` z$i8*WJ3=(bnc%WQ+J@GY+42&;!djNMeDkhmNTDSqCzt_8c}39fO-Rz9iUscp7ZGPV zF5d3z#ukYrdv2u09XsEV!YPKQvfbeU#9Hkmsi%y%1?U5hpHuVZf;JX1a)H`uUkMF_ zdfcpzbMC3nkMg@ku5FI>$nos#oj#q3P#azv?~YIkmrA`ZVG(NJI2jmvSsVcC4}cZE zmCwY``zAmV6kF!BV!H&t@^8bt6z6kQ#3j6K2xd>leh2zc)Q%Tl%t!jWlRRyX&`AKo zd~ZWP*!$(?w|kryz1Q8WYHVuX+mGRK?$3pJPc!hhgj6n?QDpYwFNdbGr=qvC^v|Ou z8#RD%TAAL&v3ksQFwvaF*J@t(8hsGqb38!NS<-6GtmBd6OwMlx z?}YWIncNxkJj`-K4doBZEf>-k_o&=!cxm9*G0oDxL!@ClRr2w(VCJ*$i@}RFu#O5} zTj83bS3FbEn{yYnLQ*_6Yr>ir5j8WZP7{l`Kl-bH{qlmb_oE?V)bD*~9>MF|j~T;3 zEhwkc{bWAIC%3TO(_V~Go);9*+2t9v5j)pkz?GS-*rJmv_-mecI!%`$6x&C^6&#--efV}09~JU$#A?hZRY zE%l7HJX6{$)7lu_>>W&V<0-okRMLooK{aBeD{z(gU|X^m5*oRP5C6M7pRXdzx6ct-(hT(lw(pAA zeJz3od}wf@W&|Aq9ufP_t%o##_(6w?tOOHoOPwl1IV^#!HMG$PAsAJgD$c&xG?0BW zTK%F&mr*2#?h+W{8IHNaj66BD(!sJO-t9xDU1dHmFT|^)9P-^Fs1m1c^ZAiC-_FP} zG#2VeAo+v>`%oeBCb}$$*pjT(5}fsJ^+E4-9CGIHDyk66?Olo`{^z!yN)W-UaDKQXCq(?Q8dmBqYx>%x91v zw)GMgonyEXL3S&!k&U@0a@>^@R?xc;gqGi0!*6{yVnin5JeMF^({^`aDC)`pO~+g< zP1h|Y>YS?O8th#Zm&DsrwgCPn)4hj7Fq46+@M)U72ibLra=bRo8{7#)^0`r|S5TKF zRJz4~_)5qy5#x|Oy5CrLN&yX~{8U8(6=Rf4V^XoJWbfT#i9Zi=k{_-{Ym=i{w2sM{>20wDYix@m2~Ew zs>WlTUhVpQeZ*pE*AN3Q^zvdmu8__XfwsUYGa^b?Ry1aAcv zCDX77s&J`L2h$eaDxCo)mjLj1mY!_cN?|$KkYpc=BSIW8Q>Mt4MZ=d8l zEG|Ra_WhD@&^74TTU4aCgb1gTS2`Kq2dT8jFmXIc}?xTh9>&Anm)d zgaXGX2{o!-0ehQ31Fz@(B?dAuzk|wzB3q2$vZB9az?XLlLsE>6v(kd{O>jFY4lZM& z0hvh_z=8O0b2Q}lY<=R z`=v%Tj3uq}2+vwz+TfzsI(4oA+oWrZbe_@o<`4+Dr|zIL@rpzXF4-FqsG_C1ZS=bm zkK=2))fTyfh0_|G(M1M%oEKA%A{0~Z>0KSP<(V2kV2`;eL1$FvQ{i*_giwEwZX%gM ze|Y8#X>om<&L`Wf$sH7SeVa5Hp5hJ1zVhUSOlNnZLhG7WgCc7XLvd?tR#K zy3c!GM-8Y{s>#@&;e<#~y6mZYN@FblGLu|tJg56uvWzr?90LM42NSl;h-uFljgN*+ zWqIZrsWTFE3=-nIrVo3(%an_L=ugr6u$CZ;h$kV3AF(@%@tKvC|i^YnrNdPTiQ32%1Cw zf?2-7Baobxz!4&HIY)3LowlTqI*lMTVvQBs2tQ`}ilNOKWG*a4?e_DfFuv#C zw>2)WBUbsY!6(-G-H+<5+HO$b5ydy^qSqKKjVtnZ2|QC)$lXj z&rT@<4!zwe&($*Ief3A~tZB7ZQcPF$xKF_y`{L=Gsg)uuwCW8jgdZ&Nrtr*Xkwh-$ zQ_CT!@#P0WjY%?|CZQava`uis+sjslC|mXYG!<0sTkKT{52ERSE3 zacS{Jc-={8r#=XdRrfqCrQ`EEA>*=BsNRca+-;w=SqPk&2{U9P8vcBuSkk0>Vm1Gr zWOp|$e70TNjFAP}7(!KhGhc6Y;avOslQCiMNAvHuLtim_QR~kg@OlREK6- zPN*RtzutX`O#iONUY*^Kez5^z84#Q&g^5hqvbgHoao4Q61z2ms6vs5mr(GH>3YBPG zc=c-(hl`9WS1kxEH+N~!wW_h*$-Hl~y2GpI{o;lc;_yFW&q&lml-WAUGmIK+y@j*p z--U`;LF`AXjOvdMxINbr6E`et$~PEWHl9BXf)bH98KB4MO04br+-(JISiik6FD-~C zVYa)XoMzfMO0$66+A0~iTQoG8K+^Z{p~^{T{l_w0&FZaA@)FyjuR7b34(t6t$h?PN zl)ArOnlQ=tHUE4kU#i2|!lyvL;USM-MLBoA;T}>(@DlyW+8Uql^pTDuEK^cOO&9-d zcWZC_4X?@PyH9eBow*Q`YpEJvf)!s->b*Yi{LurJto@uNYY%fP-oSk)BqAz*H(zT; zvBFASJ#SEltNf=%G!a$P#Oe43#Ow#Uz^GbzsoRJ(3Z(;Fh|cJt{1MTv_kC;Rm zeSTu)lG3CJ_%ZQbU?0bw zAAfoh%!9qynIq(NXw+YaJmzz2AK4v@Tb|hM8C@1%9X!!FMjak541K9vFPqMW@KP0G zedkrj9~~)7)Vm*br^9UJXvDm?DsH1pd^sd;F`uT{jIBFI$fuHPVb+i*wwY^5zDPSb z_L&H5&9EP)q*iCkNQd?jDGBot$x|t=tr?8s0dC^`G$snY9nUFbLvI6mF!c&|0sEKW zt2+(hUyR~Wh>j!aHe|~_oVOZ&icBurp!Z7q@VHt2xi5#Uw9@gmySwB`YD1_grz{jh z^!1QLf^Ee7)>aQ|Nm~!*;*XXoey3yPgx_1=exnmPS7n2{t1hApjv>*-CsxhS~{S{Q$hPrh`Y0z)HJ2rC{4M1!=w1?_m)lGbw! zW|j9$wVZ<7+36Rh$|GS6kefzxhv52g(J{{oB=5eY4Bw*MODw!jhVXW^TN$x~IKKke z;rF15cL&^h-aIR9Hgfto?XHk){ceEA2h20?c#F$Zxi{l-O4FZd&xJUJLA7-dYCdKT zvAzdtTW#+g*17lM6f5JLMJf?b-BNO$AraH`*Q` z3hwLMc;@(;EhfPD9M|8v>GeX1xW8R5@HqL}=2jh#YO)xQzr-x@J3Oxg^ebKm%_>>z zIbZ`+rzyvi-HOHveUVP0P<|G`Z`8)AQ@PGV)uAoNu~*JG((c|+$5n%FB58qGaA%aQ zUP)Fz>3i9}ytL-hT0j(4d_I|ZI8J(SB$uaAz(KED(r~(JrSEnb z!0_lL6?dWwWwKgC*X{Mn5!lwY_b*=#q!~a;fWRMXo)lYB<_4YzR1M|@e@Rum?n%UbtC0e4`JKwoLtWDfU%4{6FM2c+;jHYc9$4FQxTo;l;K{dd zL>^gMcD!l`Y=()_D5psYR@5VqP00&YJs&4hnbg09Z=jiE`;flZur?6+MY*V6755}pA8Q!#iGGs$Dw2;` zx3I4T5C~q(yMKoLOacSfBkz9TDD=AMmD%sZkxmUfcv4LA(G!rq71uX{= z7g=_}XIA9EvLvR6|9xb4q4T0sHftz}V*C zxGnIuJME3F@u8}Ov+S>e6TklA9xRMEoK$98R*QY-b`cT%yDF8}${t;xgVmVN;PCgy z#=8u;l}4V6gLetIevh!e0%s`v9)M(hZ0E+=Rw-Hk#1I&D$cvZIF8j=Uj+4aX14OQW zNXwDn7HT$pmI7x9z+$4T|CoYcAqgu~3QSl#clHj*-h8^CA#m0HUojXNX~wd%EEgtE z#{tk0Y05~BF_T+%pgIcf9izL^mu*Mg%S^_JvUA@%vd2gvJ zCV-g6YkK+o**3wHdV-bn6H^n048ZK>Da(`nP~U_;c~pP8N~l}r<91{JKH)EzB^fEU z-A_$Y?w~%Ug+G7nPOyLxKAwGw?1a!2vS+pP%8zT6lOJ=GIex)8HlOT)MSf}eO=#+b z&l*kt6;)I$w7Bu}&VPw2UJ^;i`?V!392tP#G&adJj9<-O0MDwx#QDa{*B(t&h{niw z^ERAzPF#R7wf_2nDmz}npcRX2zFi@j3|xx zGYeqnyUe}cw1bbm-hh8O@()uGgkYg$pFAVK0Br?KNM6l)ADH;~P}^ziCwFE1%DDAF zupNWP&je4gJVF7_JNd^Z3v$GxVW_hYn{?=g8Sa1mr z>P!FpE*$*M-;taIN`U!Y`gchx;88#o&wf{5&U5nncaap0D7IxO&Ob-;g}f0>5Xv3N zNJa&?=0pFb6>LnvxlNy>Gpn`f{6q8KRB{Pt6n#VW5pei^k+3Sx5k2&Wj1V3ZxN}_Q zMgleqLwEyTzh^#ljPiJ*{@HJM9zDcDq=pb#{Si%ga#(2QM>ValB{wli4qw_dY`onB zNfC!Tw-T9(5-%_QhNl@|) z%Wk>;W*tg4e#bx7=JZXpXw_+dzs7_Ot{fu&_|Fj} zfFtOA6+sG}#0W9k&1fR*d4e0>m_2^K!%y`aci+exQ7v<`zbz3gC>g;lmnf(?STygJu8rSUo@v?-VM8oiTimYIdcp*hq8GH57u5iFR|A2 zXu$SCAEQK*W49m{Gmt=iEAe9#aOO@(XBtjVP$uZ)ltd(31LPDXTo;IWgmfM+6i7Y$ z1{rwv%_(X2vKhJ!a{-?6R$KNAJq{I~e3Bn+JDWuG@v(HSvJ{X;a*OSnVhFjZ8rMwE zQj5p=Zrq|h9|GQ*wGZa*ZZ!~#rRr8Y1+2WDFgeGy0y!Q-i;1ef7JLR7pIPNQUdRy^ ziGxR>RM74xs;o$Q#Fi@86x*2_NZP)DSQb+sS2>|a_N+?pH*}tFzitmZUO>c69g?Cm z1nTSuO7|PqPi9zOz(ij{+)fFBOT<1U$lH{C{K4W-ri-l95^j6EHCg|1Suq$1pU{S{ zRfLsUm)rF_p^xTOuH16`bm8(X_EjWIA-45>>O+>gWp~qxgF^+<_MRS;3IZYRkJ*^l zC0v$ce$^L9cQ3nD@iR+$_5LYpv1coFzygL`K=d5WtV;WUS~JuFzFGkIrpC+Z(~|ErTFN&s5+MN(PMxM7kf2_9yQlTDDSa@plk3 z$QcQD?-+Q}mc$Iio&EFH5Jw_&e$bF%9?4SY@0)LU8UoDxEONLg-%nS1Yii|V1Cc;bDspUY=1zjN(}=2+3}N8x4sl^ddwg8L)6fE4LViYzE&%t+&_` z$v!F3rBaBy8F5?Uom0v7KeDqGFg+t~w$LBRgol2q4D3YEHcz#Wi?MB>b?|Z7_Gk`@ zTJ1{v>z=4;wx=V0NlDK3D#wR2=WeUf3ff1TG@WnxDEyBgF#zJo(Nq2EAM7$6(eL9B zNJ;_~l12}Z(@da|ry(cewtg*c+9WP{@ipzoAO)_CW<&QWwv2~iK@|KxM~5ZWLwQvK zJbz#&NC7Z=dB@7chKnj>+y@sAf0*kwFwaEfiekBf7W&cB3)-c45xN%*WG*u z^Nv`O^asIb`U;vxXgm7p{_sabW{_tGA(HrWlmc5m(P7A*7AFiJB^a^}KvzJk4*8>-f@zSj^G%yyPgngGIAmjOff#yMoe_OZIH&t1q z>+6t(M1pgehetq*Z_&!*#Y6%P$AJy9^+5iMF+Iscg9t^Ma?Sv^&2ZlJaF=gq3Ph5U z5M0t8Zl3mG^cLgKS4dLwyD}I>@`eCx;lb4p{zHvu_Sx^*KfxBhT)NeV*@CM3FhhU{ z@wGD`RE6+diiljPg^1#?;0=xwDG30A00k_Bag`l?Ou{_m0gR;=W8q19;3@7)fLzHS z#(z{YzQ()==45_iC(HeB63bN(>OxGsBP~`7oHF9QuWSGuN$~2K9`g5Zz8dre# z;(^0@LXXFZ^K+Qwt^;Mb*>5PK2|JVdx!QlG>oe*yAh-DHJbdkv>=)k1Rt)8a8{;WDQ|`X?+bnNJE!UIuV(dLh9$;!XgRJj$ zU_V_XJR=}VYV3hiQXDGm1LJD}{*6r3nD@RBzF%U0aLs*Tun8smQBIWr^N<~EB>hPi z87cUf?#UwzyFL;6{jsag|8F0UDqatG$i3DPI;AiF?z|>$Kf6#d?XW}i6^f zHb?YUl1#)Hp@9pq2?4phoG6PQ>@E!+q*lcf)L_YvqbghUOpvg|>-Oo<7+-)v>TJnZ zcX>6wpq6F$)6cxV8Nw%MU)kWs3xKc9u-+D6sPqEUlY}$!?~V`3a9rP*g87w-oGqEo z`!1UBC0l?#JM4_?$*>22E1cd%toaFj=2wCLfQqhB$V>#&EnKk6D~(K`;sXo&CBg4q zI{#qD!=o<7{Dw)nQ9zdQM-_869bCdm>4g;Lp%kM(lJp#ZfCpJ4dK*ic5A$);9}t@` z9}i#hp2bEe1Q1cJ;|v!Xa-~AX8oqta(=K8aEw|wUlR_hY4&}Ag9ITm*^_%mZWT%=p z?^5-b+r(W;b+^BWSkl)mdsgf+3ab;apB$CrfeYIV+g=g2b}{hEct~O%2N!LN)wi?C zR!K!wh7`A_3Oj4vG=|B?WFkEA%l-rcd)w{OOQb{ihJ<=-Bx#As4 z0g$YRLGlL~!ISYP=$AIk>k@E@s_6hTf@mO<8}=_m0GInTY<&#obqS4&X4a&i6UTFs zYZL%7Pe!tiP?quXr-QYTs1BZLcIBgtFbNiL<>NaAXC7s-Ii0cRfg8ykRXyoV^)W#Z z6w7jouZ2O)NHZ~S9cL7qN<<1x3Y*eZ!QFP&t2rL0ZI-5o6Xg?Xp`uId9O_w$H!XFEpIePS3F5Q^jw#V7j-vMV?_Zi z&m@aECntaAk7RI(_vgQ&-U858^&bWJ8v~~Gi+G@X7wFWI^w^Utr=+K0gLSX2k+pLF zVSKi00Z$q?N9^dwEVt@@ys~LbM~~pn_wWD6VJ5A#l%TBLF_yXv4IVGIZqw8@`U!iH zjOt|$YimIBuv6#g*mO}>AHZuj#PB%fAG9hF0QF)ODwR3A1mzn=KemG3~ z*>)Hfd`2SnQF{`Q<4c|Wo;Vo%Ci_Xz5iCUhl41T{6robLp70`#Rjhi`{F1gk_m(=C z!^FwshO75Bom%hXf9uECQ_QlVvAU&}9eJAh8~gF47H#b@T(E)7>rapOKU)uR!Vmh* zJIs!@BZ|F6noM%b&7yf&7H{5LOu5aD$-vP!Ap!s4ZvNlVQwUXi(g-YqbTi#w;44j96fPmK% z`06Mm)~~bvaQg<{SD>|2y02mm%d=;j&2>eA+5GFQ9Ew08`~@0{j_73pMFTf}3jlW2 zuaW`inVGv2<+19@;$Nr>O36Tul7@C2vX*>kc6vluEH#CVQv^#ljW=ZT!{?lYhWMrW z@HEL%cJ+>yH+4HLkOwx)*RRG-z}z;*pL=VpC{4BefQx!}oLf%rqNBR4mn6wBj$z@` z4~FcxRHKjvuTECsQOJ3sy9ejH8ORKQ1YWRHXNOC8ZpeJilRyP(6Pu-mVs`4gH77^# z3h)Zx<#SLX-%P>FV}9#A`7liEiP_1U931jyMA@pUDDqgU#8;H3Qu(S%%fE_ zGUKD~hu8=kb(LfDJJ0D7lw(s=&8IcF=Ah$sYLqG4VOJT!uPnjhwgtsUJkqs!{iZZJ zdQ(>|UrQ-Jba7#iw?5L)&0Zyq>ET-nf(MC!LtYq{HJwOLDa?Fow@hoyKUbpCg5p;V z|Gh;Jw@7l;feU)B&YdH2G8F%hKrn+011vb^haT5DEcGiVy)5I$c;D)(ofD(S)lO>Y z>O)jurqA)N)8b;>Xo>4gkm%-5yHr8zK~TgD!?JD&9&apVD}O^^Nj-05OmIx>e`^_>Ex2+*hAge+Yy5#{^pPi+XM0_wTDP}wJ28cvp&;m^cUI4^PKP*2jj6?n>eBJ=afGj9kD@t5hD_> z&A#D!g*>c;enKaDn4$$SUZL6zVC|abQ-&%Z(W5Hvpjuc{j_4D09M419FWu@ov%7hl z)V4{%{Tb#9aD9j1F2$ofG*-N5(X&;c=V{yhrr^cI6IIVMCVkeDOMq8qHR|YmJR?K% zjU#=vBbGM~#H7bpaq%xk6gN@FJvfw?+>4((b8 z!i5JTT)yuLnLAXBSrnH6xx?Bd8zO%-Cr7V5?_NGr?3l8&_Gn(gp6MN zI0$s2eHfA9i5%(FWdlJ1_lxH_uU+zyVn{f%b>xI=^i0r58(LuN%rs2Dx=(#S|0nsD+Bl>vwm0e7%60jr2t4Va)V1MTSVWwG#0>Je+j` z*yKUoosM@G-THf0pT8DxnC`4kvgiu&fLGIOI3G&TBtb%R42qhr=k$t+czkW`PLOHTO&i1Sl7P=`>Da#$BocT8R7Xp7NXN+ksxHzsR)K2tRp!@|@ z_s-n6N~w5V@&{>ObET~$xU>qM;B&bg!-n#;^%HgCv`j5};<&W667F&kIiB)AeQ2xo z$l`G;2@oR57#ghYadHz(dg2-M!CD@ct1N!od{W2cEnw@nJ;kh`!H;Lg0me z&>vJQIIpr-S*i;S5!-0VMB`FjBtG-a@POGV%lJr(wf#FPaWrobw6ge1S_5%37}839 z4TvKkmVgiGFB$#E{H|Q=S99#i>cwide+LhT6!>zU=#_H55C`X}bom&(Ie3PnWcR^+ z;Mo<*^x|Va7Xn7&oMTq>0x%LIof)aXGyl~;dwUA@cIpskO~0jo8=?0UU2549g>e*i<3W%kRi78_+JbIH-_1Oad04{u z%X3LI3jfYu?L;YZcbcF2y(1h3sv}Kqq93F&z3aYD4SbYm7=P`dpcYn46AB-TD&lNK zf3PCy)wU;8I}#V{4e~HfQyShce@*_`djBL*lUi>b`y{PJe*L?AJCp3{I4@2P)dHyB{)V{%IgbvL-qfds!gf+~5*&#A+NQOmqu=1u-=@b#m`74vygzi{P zYo0MN>`mMana(&=EPZoycnqop7+xky?>a4DhR>)Zv|=Lq;S%8Jjt8_@t%K1frumQA zFmUAlqJ~FPOS+2$O=_(VZd<|wDEzmHjLew$b&YVS+H%4H<|r?nZPi*-;%6}O@Ff!; z@Z$&;=z%UlmB-6nork<1Oc=xj`y@|((L&}7{K{fTLPmJiX%v6r*Sa{FhgAEmifLbQ zFSLQTK$@aUjs5-Wz1$C@kW@(~fM$Qm6cC(R)_r*;iw6~GLL%>q`A6n&Zz_Q#)vAJB zl&I!(ppRRnB!8jvQ)`)@(J`ThM+D<_;E7XWNFbo!-fxHku|*@d0AM3)<;CFAns=bA z8GWlzCYKZw7uo;iyFMzK;_s%qBYU4~_9lAaV~Dr2ox4}XG9G6MON;aBB_UMR(@dwu zb~iXV^TT!rAXhds7G8q52EeNn)IybU6!P-wKug~Glq>I;bw0OU5C}l)pC_gJnc?yv zKrYQSKeoSk-rg+&3`>l3pZ1mL{K3KX6&wJ$eG-l;37UEI;rCGd4nf7$(VbgX>ROlo zu#nA%6?UPHd%~JEu^-(kLl8o&w8fLpqEqF$Re)Px+I?K%#Y~EIYY4Do z_)HhrjmZr>zIZ;)HI<1Mu}j!T<{0ahK?(cDz6Fi-DkLo!Ia5! ze%Lh-qU9b-Z|dItvDY&iUqkENs`Y*qgpoy80$@ESTpqHA zqRDOfOUey4w)Ild!RUa>Jyvg*O*7)E{oQ=C-ZaKBVg(OATF||5iNWa#hU?R3Z{P#r_aY$l zdQZw$Wz%^%aCyiL0tks{if`?9rtlw71OX_|G?R6y{I-lbCZ)W1<}k zq;vYTFSO>OpSswg-D+jI-<*B(GYiA-{H6dTcFgM@a39E3WCln?h=)s_a}z_j z&B;0ciSjr+98x35skvQz{~YH&>EH>;&#^_tR8&}JlJJ1I!(fhyZPzj&h9I8oPm8ho zj{sIpMONG1kY_x|US8|-%XV{1fezDpcEoa*4kSTbuCTK`QyZ6*0k)iZ<&=ofhYb~3 z*}5EHNV@#|T-#Z)k6K+Wetx|F!D@ijN%9bB4$?Aw>xm9ePeiY{HcFGAcFjA?Cy$Ib zP7$sX+7_Mf8TACS>k}GGn~D1Ck;?E4T0z_Bx#8)HUN?TOI6j_UY>$hYcAsIKu&;fW z?7ooGx4Z7lJGy)lR(pNFMm~nKKX0+(gWZQ^G>;Ag1?#DnZP58TW8evRkG-M@mC&M( zk$FqqF;w@lwC5nTdAPjv@EcrfJICw5y4ZU&ssW8^$#YOMcFbO@F6k?OpoxAy|GndV zs$VSd2)~)z)Xrag46~*JV`B>II^%d;T>(J0Y}T#4Cc8Zn{6BV`v7s&i&+M7%mbsD!ZvRfR;nO-_l^TLyl`wnYe4+S-HRuJs$0 z$=a#ub`#gvU0SmH-r7}InH=*1@0lhw24H^dFxBfscOqqiW>{jr1<45vb$1>+wEfyr z*T!9gTDN2{KU=}CV!UO8!fHv;Y$Q)pU9ZxfimS=@2RwIjwY&PnX^OkS6hsEK=&#uw z$}Fe&fgFXtUitX2a=)L5!?e$;*}<6GhFkOu`aQe!>kC|2wFuAd3>je27Q)#D?0{Kr zw_^q$;9%?v{U7YTX*kv2*En1fqM~HVSTYupLZ%~gBt#@*2$3oCc#@Dgp=2JT%=7Fh znUZ;)XU9CxXZr8Yq5J>4p67XS-*28*_to{izQt$nz4qE`-fOLGQ|o%>)p+$+PgK|h z$DcRLHtphj3pYlJ&95bT?Nwxk{M}Rd=5OF6rd}gJ7oj$y-LVyQRmkFoiWpWQ`v{pZ zA>dT|0^?Usb*p!M@LNNFVFR^t4jt`1o(Z!G^u1S~R%sfTj@Ai96BOPrOR=AXWXFS3 zC;0}wm}{5?uxE%bd~W4M4D(Kg4CohP%g4GT24JV$<2-8@==ZCf2H75;zW1RfxAw{N zXMP>$WOQA3OS%!bx8)un$N+*{>@W|Z8;`NGE$XwY&Jz(gd8=;h$?sPmZoizcCT`qX zti52iFWhsHS2#dKd8>(8zS)&VclJihV4~chw;za7wyMBFLTbK$r`sXl8qkNUGr8n9 zb9J6R6w-&^-&+Y?4J6=PiaWo6ct!E8hsk}!=UV8>;F*VyBjfM%*4G598)?S#*tNTg z8^hz^hpwu{U)>*#r z@}M!+rnP2YoVFD<-DG1#Zx2VU?iV5x;*IxrWVZKf_r0O(u#fm);g6#?Fz7-o!Jkb|SD3s*z0bR`iRr11h_eyx563C)Ec&^B4rW zx33f6<|2rj*xW+41eqSCq;cxnB%iOFXvQoSm3F>37p2 zLd!btu@tG4omtu5ZeP8It1362lv+l(BWqqewRh_~v4_D&YvbGxiJhJ1GEjzN*og$q zwISg(j{s!oO2lI^{anOa%xAwqWjEC0X)!hPnEn2EzP8XfVh3m_9# zeAH)4--jjCD-n)O->F=aL*0ote5c-2e1{G;q%U_CJlc6=okeGz9svHpk<-A~F7J*HUVAGpR(IoEmnzsxrIcp|_a%9sAK9qIg}ui8t) zzrRqJhk5eyn*@QA*o<}48CSWJI}An&c@V7nN-KL$H(tas642PSJ-@WnkamgAmwuq~ zpGQl_=UhPRkRaa#o~S z=7A&0U80iVb<0I-hVL$Rqpjx#*rFWVGVO&QYkcz#OwAUOa>$pOFmxOb?frS=Jb|ja zWQ7p_p(MJPT*>S*`K?SkOWVz1r92jjhIvkie@L^bSPBmGA(v2f!rI*D_Eegll4mN} zUV@2;YksNfo*6U_4dhvWX~67WoarHc*-WFH_`wdgJ6-AJpWau6GZ#mi%6~-kI3{9N zy*|=rMqAAF2}#8YTBU@IG)1V0->mEr>y*~+j$7e;R<}c|R<8;vG*c^x0j<5l{+$*FCDa$!S^p2nMgfKbY%Cjg zwl(zKHx*ACRx8M?!t3VhRC;7GJ&sv58o;Q+5UGWj9x&i&=It*GZMUiTVLzi> z)@XV*Eld9&4ZnKDb1tVNQKHt%rBUdWbmJbUSM|xeKs~g%|Q`+l+}^;qP{I&$@MU5Ap7S=lcMhO0El#} zZ%CjVqU4!}ibp>ZDYlC(j}8{YISi(+G}7pM3|%!hFr_!$|3uSH@4Y7J>wZ65biMp( zs4!YpCwpKrWLw^`AUzRF_D)!&q5>{%_)*s`eZQNyUEqkg##+&9^7PoM}HO>>oj8{GT#nsuut@12w^7}`yilg3v{Kj6N1hSpFjAu7& zj6o>qXm()2wkW>cdD>s7vm7Pcop5;@bxz281!6V4jS=_b%s;3zVg zWs|v_{Hn@nv|is!0aw=-!VnL0=rbL6#?=={Hf&6>&I(vIPOtWNUvLxKULou5e15en z9F9Fp)4C5sn@{w>HA0Cv?ml}nPnXd^KvjA7Q+us~(@y2Q;{Dyoh!vgh1XSb_y-j=C zcg?X4X3R~$cdHM&2k$5r{JyKwy&EuE#B?uuc@x~n42rUtf(6l4_a6C@11HnL?%*#N?C;(ve_coKh}%xiw_T#kaP%xP(XwXcO)XF3 z;zZ~piByoL!8}&VMc4*;Ky#l~%H8V>;6;x8alB(04+6Vb5n+eSmE@m^ZWi8ump}7$ zX_blIHVjrBZW2Y75gNc3UT*a*f@4$Nz)6)kE42g}MRcD5w>l*e))K^5d-)5aD3iZW z5CM=H_`CN|yrK6xIAtVy`FWi@)6-(!HxFZcFJ;<}|9#XuQ)!tO>Tb-pS!<6OM==jC z->N!8MWg4T{hH`qJ9wC34jI3aqD1qwP%u@4_}6^~;-7hvzO{WDzm3Cw*PLF6oby<# zvDqKg35%J(XE-&xe{_pWb?TznLgUK;Jp@)c&~!;q>YWwh<$2cvifxDZ)PXUd)}N(Z!d8NYQ1{D3$kW3OH-ip zLD)QT_Sdr^+2FNQdC__}E?c+aiPK0;kSLdve)lQ)>EJ+Ky{e%i?9Pj_oB{1~BBIw~ zS@jYX&WNm)!6Ks41$c%_CU~sne0zuYgkfSA1oHCx-G0k>{YEW(PY~0Av;k= z?CaYd;^`Sqoo(8~e;-dKHba>+rLRb(_|aj8u@yH&*O)f=T5t#39f;WlW0k*(T`Vgu z-`vau*dwfyqE_>L21Oc>6>e^!P} zCq0ms$-pdb&eP`&b~%YV?`3w{i;p&n*>zTO%5TEQyaOF@hCIA%5)I<1*Eh*sogeQr z@5bc9^VvlmOq+W;#At+E>{?!G{h9nJy}IJ=IHc~ts)p?JzN(jST|4QzU5K@rHWyM` zX#bO`#(Bn3SgA~;L{^XR7akp6@T~1Hq38+_Q{)#MJ$eJ|h(0I4r`Q&^7bpq2*zo{l#_a#ULDab*N^lM6plX(;{fcc0{D9w03h?sk?MFbkB1?TSVCwF_ouuQ{U;Z zkM1ltJ9;nnJpCOOQ+bVV7weYa+Ry!o+I_OcrmFTyWftpWaOUz&t=z)pd93{M_oCCF zaZ#M0?bew6{_2~BYqClT_feMR2CAKNF}-}9Gr!2%i@wD4+UxO3dtTa~>ThWk>KWn_ zX>Ig0uc#!9C|c11RXzKSlYi3ct=*er?peMr8Ev(AHOyP(#I8DJefvy%0gmXd5tG(w z5Mygp5(2#n_85k6Z>5d??BKT4)!=er-7EJa*9QGYOurS*tVzm>xK%X~bu&gh6jBW@ zZ;Br71dcoKO{0u!p`}(_vX|d{l800VxOXfr?Eh*XdR*$-fIIbOjd+s|e>GpKKS4eo z4!O5v@%+Z$7+f}{_UPf2GGW{E1`oXh$tBRu%F{7fU68RXh(NW|^Q*OwBnK1;Up_;% zUW=)$@pvb(U>kPsaQ()nvg+81&cq{ST`Y?oD8_M?o=EAHu2^7R`C;=THI0sH?JI@I znC1ZKfOnvAjwg?G#o|%4IWkAX*8K(dY&!O6LD9?)j7ZG6H#C5YD)aWsamjFI?@cX zK1_r9Pc?w}9=C{q^u#0#xl**^fcWf1>Lw@qP@*e8`AnKq&T}VEYToBJ+#Sb?X?*JY z4jqWO?gqbM8 z(pg8m26t5+3UH4KT-ymJX7Z5HcinZ=fiq^m*~7dcdOs>~J6dh(U0g;6NDR2(58d8Y zn;k@m?4*a^d9iT={yvI@4Y(dhH&Bi+8HWk(c)Fv*4CV%O7`UsGUt9EqpG$X{ctgyM zKA|iiBT`XjUVAOyJUQd+KKzcs9$;=;BHFl}3TtgMjY*eSgAX=GqRBskvMk^%Jk3C%9Z^*tCUNHD>8=gB<}v#C97$NFe>jCqsR z^uwARw^jBvS{6T#`!hI2*6^3+hAlF1+k{6=9Qq7BTrX}K?|<~+WqW#gJdJX%<97~~ zuSVpgi{lrrDs+VuO1P}&3&|7I@&?^hwI=-Nrh}f@H zM!Efd|BQp}EH^J=2i~39L|3rVvh>}C-)Y?5#(nG!0TsVS+<^j!Z2siC>w8BPY-m^;rN>~#P0 zGPI%OfzOd$ZLmO63VoR6?Uwt+JOg{thx+8F>%ifAq_s}#NG>96-ZfZA)s1p?l&8ge+cUDT;+&$Kt3&nyUb8uroMRT z&(d+*&q+5_FV&m;J_iy`1gHZsD*Eo>`AZ;KypI5zmH|$z+riPh!XDXR`b79@oV%CG z;bzmN_Lp*ri=kE~MopBsewB1*LE}5mAMTg?9#O%c^SLc3`MP=i^u-n352o9d{+sv& z0p&X=?PIDMO#fJXGXWB;JR}TG8i#knNeQTGz0!T$QePmfQGe>m$Fx#%y$HE0ohMY7 z%GVPHb;uukA2sddGVVL@3LHHWQcac`i{)Uy`Mc(|_sAqiYnIQBJhQ#g>mKVe`-oeJ zZ)`-|qn2+uBxdxVw_w<%jUlD@u_zn=!3S43!nVJboA^iMCW5oysYO|-0@u}T z0`<0fbAH6>j(4Dph%V{@bnfKr+^pHK-kO~YSsp~B)z4X~94`1F%xb9CFHUnPcK@_A zyMX%*OQGCe^15;)nCQM(@35Eotk}hFl;}^un_Uru&t7i`h+CFae-3|m{-ylQxW%K- zO$EpRK872uS$w(+D{_p%otSLD^GnP^hKUD{3V|B5<>W^cX_vTvHZ@{G4zEhzf3?`` zv?T(;dN*uMIvJ(r!Wcxu7Y^+64zF{*lD;(Q=toUh4x6(46`QT@P1q;9`+Iw9PY~Mi zCS_Z^JeiyRG8ESC$)!2V5@W{Nmx8SPn-_J$e%__CtDEyt#<e1uXAs+x8p2VCJGz!-~n2&TEtpr1G{zb6EUnCDij;Y_N;v z|9to04{=7_NUf{1%AN%X3p9nAC72Kuy~6`}i0XeSs>EEUg&51+4?}z<>FXfHpk}D#Vm2_Kp9i+*ieh%ur%m;iBo8g~5M1Qq z=*%1iqa-P-;hO!?R})I3k5Jh~9T94&jm;IvosU6o3C#5718;WQ6fP`f)o`_Fm2U+q z84KLGOe}o)i|To!#f(QD*Gp2%#yxx-Ksn1jfh40ip1v}kzJ%q!{l7u3gP()xJx==g zK3A+S%}A@wkYNt|qUesHyQZ%Ine3c6YLskGf+~hXJ4vd?rbKX1Y}+V%-um8 zJ6PZCn5P{3HERXjIR>=*b+JO9^@Qgf#@mF?zSm z19Rk9fXH*KP>AnxUIRhftQ#ik+rX+7bTboSPj!51u)3>d5ZT}VBzO(cF}9Zj((9a< z^tk`r@69_xCeraw0Ao{X+o*}r$b%ZPal=4)i*L6bZ6?XL^uFd2>%J%R&nzXDwg?_D z_5IL{x(e>GLK~}Hx0U9enPg?;X64v~|EN#xVI2cjP}lafk}SCLQI^aULl<8HIS1()o=Xf%dV-o_*Tgkb! zo#cLDTeFWAnCNiNSMJ)@zYqjPm_w`dyTeoP*<9bzGuWfT@zcairt4wp60PN%i226_ zIK{ofnW3fl)#%_ORS=;s(m&v|L5zm~6}lO+?#I~SswM5s03w?B^eFjXY9u7LjEo6^ zbyx{MOAPM&-64Cvf+NP@sv&M0)GQ0S695f0q%`x8WEKWp-Iu+P7y#9G&N*LR*TI~J z(+u9!F2#FYXgTNoi{->`^$JR*pm_GX5!3>GNS-7l2nWgJsT5r0u1V*i?22<#p4UJ- zS(;!H{tw_nF{$xy{f|kop{^~*I+($3yPlHz9m14<8PS+ql=4#xI(uK*bb2o+MA$Z5 z^zwR-mU#W9+?U$?)q3@AOv#?z)2cl!1ADz;r59H?d4F8+?u2f~-V?Qde3y^&yL+Qg z;i2Tdh0B7s`>IDJ@>fAqV%!$p9mzTqfkH}4z(WqZJiq2{(9dBCBR&bqWiRTEyS zGEjlEHyUJ@;UfqV(ce>(EM6BFOMlnTGv`Wt+e<35;$VqQPim6EV<<6HU(i;yNibp6MUiA?xvEhcCzhCPt{#Z#((N;-DZW zhR_$v-vB_Nm`P1ZH(5aP*l9l#DCfivWJcp@*1zF@2mdd^{+CGp|6mMd85rNcUI71n z_S|584YGh`aVn0%wEWypsn?+LD3V}^(G8Q%Qw3x85idaQvw-Y%(5e^c6a?;3c(eq_ zHr&xpkEO)1>OGkSO>O?OBnDh3Rju|va2hF*9+r|1W?&<{)!is72Lz}*q^=}VxJZET zfydIJ*7;P@Kt>#>`^OSDQMY^tHWSN@u+%K?R17anNipNaJ}T@aG0GR-V1M znG8tE|EMhiSCx$N4}7k8!j_O+x@V~58C_jgBz^|cl0F7ge8g*|_ifQe`8cc~+unph zf&$p-JCGnm4w@9GQ`X@W+BhQ^K&C9dtNll%6GQ%ai3Ob{;y;?Dy?-hJu0?ac=B6g4 zU(Vk6A`U_L_r%QQv*Lm=;Lf1d`_2?8HDS$~LNdT_H^3!dgg_GxtT8T-5+8`Ww7T~| z6yM78INW$vkv4O1Cw+4UDBK6Ftk0&19Zi7X9fGp%n*AOWnvuRtB0wc(?-r@lW6e53 zIY75tTWHd4-YclY>b>hP`j~O`pwK`GWMhWXtAJyeIu_cXj1q05M$Klr#A$wM%~19S zTWX`8soK0CzoZz zqB>bMJq7t-c9^(mTN^ z{?{F#k1ccu_*c!g`?AuTy^Kx=0;&Lqa!|1P4&>;hQrzY1nKi~?tkjzNGm5@Ke7*DI&yd6)Kmex*yP@;_=+w|+ z4l37CBbWY%GcspyYf1}#f;1SbT=1WHwFG=A^(Ba3g1J>pe_~M+=fIr*1J!tqCI17| zhJnHkB9lu^jQ4jzTN2C5SD@@|3R199&SRcZb`b zEGR!?9zHLRQaGGCU>=0$F)4^Z73=oEG^!b)234)~RnE3h8O$j{Md>;jJnwmbvgor^ zh~j>#)HC4%bwmKgEWvewRIQ)|65GR)dGcLbtf~s>gyQ)iP*Ih2RsnML4S9hAa31k{ z39q@!8M(Cyt9CoJ2o3$qW|)F^_a$XPt#6uj4bi+8eI^|Q1<4iGjdgTIp%>=JXfZ~W z6VAzz<8itVbnWRo^PiJWaXI|}F;F@+LTQ_=-^H#}4`isY{F$|eb$3G|-eZI!EQdi}AqwU9~y@~9- zG(l*SmjOO018f=30%fOWe%1l}2omHy7|>hd=We`k%hK)0iR^cgTsrK$@noPfvCcHs zihVcx!qk|2&o||?Hm97ihv^cD8zbxZBQ0vU{Uq!*Uu0VqEtAViNVr`or((!pfQ210%!_jL*P3N8ZT_Dof-88 z%|4(iKZk`*{#>lP^Xm04`fh5v&tLH|EpER*&v>L97p<1+*9zL~&){E7fDT8J#RZBl z(y9MfubxfdT}->$p7oYumrP3esFPSJT?cxhkj6gDc&sd4f$t?q3N@i4uyO(MHx0tliQ1eJ71^5d*I#tI)%S+n^U8}~^AVBL zv4=?w^mDE{)Q#N?4`uaFn{#PHK=F9@(pr9;}X!G<3ql?7KGr75Q=1W^CH zO%{CRRS})!E&7+*ck4}xp4_-CaGq6;o~zq5-Nd=@@MHg(t5@2HMy!lu85;#VnS)mg zLaOM?LPiX2k7{d?j$_V=K!`r=VxXb+3Gce;_0vlp`Re zntprA`zt}7*KSt*!d|OZ&C*lKMEK-7`pXn%9T&zipK~-HhC9HWH#khixf+!uVphyX z;CqW1FwEj_kN@8E6$C=#2mKrKLI$F{hp>a*ruuN!GUYZtftkSq;$JZA3i2B@2D`7~ zyY6YTbus9>@86RbrazIDV>vkb@i0@c4fmuvZU zyFrXg=AQXjmrn@}3*R;{D4&_udnr^>Gn$AQ!qH$sLJUmL#$!Fo4z93#hI}Uh=Yk=xXnCVp0K6S(JJC#dt*l(eviL{9{=W@WYYc9 z1GxE>l1KP6@Z)B|(JnPF3wZ|-tYuQ1BP6*+RX){N_TF;BW9;wTo^CBiHBx+i9ILJ> zH0~ljI4n|LGrHJg#*604n0c|2kx+Y7l4nq^GtD6|0NcexOdagkif#)CoIHIvPpFHF zEgCp}nx6It*iR;F-o(j%IJq`Hm(}v1(f4e4D;z2suv?q!{_9@If;VJ3Cr`0A^G+Tm z#_RgvUj{VXAlM4~>3{02H)(mQQPP>b5yJjUv|~^Cj~t~LaUp9dv}4Lsu#;Vm0ZLnC zVs<}%68wmh1-CGhxkTyR0B9}9(?juX9j|xW0OKgHrmpK;RFwqR{$2$#VFatLVg`5l zHcI;WI(RG+9K%%_Ta1kd$;$EJ)5d`<*h=TtpP>O~?{aEE!rSrexXaYF5!k-HmVaAY z+ml#f_r2E#SqQi5Vsptu>D9N6iG7%J@@S$_tw068m81!<6|bXr93KoI|x5Yr{B9 zirTY!y*{JF7f+s%D870$QF*CI`gk1_SZ6IPnTg`rjU?3qg(fpXlI$C{W4l7{m-DJ# zxW`j+g!xBsgyt33`koxw+PP7Oo~ey*LV86tGk|+tTz0zTD+kWG9}^6TgQ6t1>-$t; z5uxHaPK`*TLW=BmmGP3uv7ggd;5Tw(R@17B%w7v4Qh zKnDIsJ$dlq_I$hyhBg0!@ZCI@$0HjC6iNrB<-G~7`&vKIhefh4nO^QIWWBsodx6ZBeFS{ z!1Sh^DQjIrvW5}bv}8^$BNJ@bPD4ghZ^itvqGEZEZdy7;(ET7h%`w1H+@-RQ&gbnFO_* zcs9ig2J^?@2;yo!pG&)}nyJ8MSw%?1nWV~J_h10LD@8&o8+MfbtcvLmkQ zO^Gvnjeav7n_AA;nw1~|Bs2Jv7(~#HXh%3E!eGVW! z+!~x3zsuY1IHs(u2NWKdCAKGsQ!;^i`tQ+quoy<%_n!&;^#}AgT53JT$Y}|!_(1q3 zvvFqF=6cXO;mV?nPH26#gfK%G6BN|~m{34I?MxC!Bt zY9@JU`K2!@ggT?(`#53Tm6>b1mjC{_vy5iNamwxQSR!Fagpr2B9QsR*s+!DJ%qj0R zGGHNHm^xavj$UX^#4c)ajJr!8>)jnK!y&+;s}%{Cjy0U}xn@|*rvYAX2SDD7udTjH zTAr12maJZz1nnY6JjP51N5zCoLbN-+ML%yodAK=A2+-t0o9Yq?o+cN9-=b3mq+iOP zi=7p^(>0Bxa>pj~m2fd|e`rz=FXVxA5TCICJ<-P z(7RdFs}iUV%fj>;^k+0lc2#utV?H!nS8dj`Gpg`6bE?o&wcF^{g$aBiB(HX z=ecAa1jgye{qmy7d}z3z=;5{zOYY(%qg*O@a%PVpSu^~b;dmOBoVRG!oV*-Lb15M7 z&N*6LR^Z%dMWDyybHcErJ)o>3e|sFfL3WIsF>q3uI=%l;_Y&~M98uq#6Pun(A99n+C=rcaQgRnjoFfLrpcXMe1amAz)uu`KZ|7^NX@0ES|j69b76hL{hw}U7b-U13DCTiim z%y|<~u;!mPCtK8mPEx7+ALkVUfC`^{X63l1cUeFY)wuL?0Q}f(>}kC*sxdX@XZ^!yg;_G*9+_2zaFc2&xdm-;+J_Z1Ob8_}S z{sD#@r-h4h5;OP+Ln~jylFyT*dX3@)_EG3#o?P)`R7qli*}S6yjt6f1L;egvDDB4N z@-fSrD*&py@YC`$9*^grNn-gYe-7-916=PonLECQ>@sNvM^ASAv9yr_X`>C#p~PDt z*8sWs2`?RuI)g3NhUH@~D1sfT*5?%Ax0pl)pfGQ^J$Mce#%<2ihfPU-I%dSzf!_V- z-QV_tgj3_Zaop}F{MyA20VGyeFQBB3E%Ix?B5xF4p35gJq~X5ET>DD?U^YN~3ax~6 z9!I()dt&+9k7(hoz-2N(@88E7Ps}R=n?J0et7#j)GE)8hfCk4e_~bXPkdO3t;(-z! z+-?MDC>3&UA9vWcz`L=l5Y2dGBYzk`E;r$_q72m)RPkKt@uPCV;Pi(`f6&=t>UgHCN za{_t5w`bLFxygqOvg<0_h8Nfr=?B3#4T6IzXW&2|0u-eOBc@BuYN)~U^|UmOiMYU# zgx%-p0ECh52ZS5h)2%Qg2W5m4)(*=hC#%&C8zQ5Uy#eSnQ_E00Ic2>6b;t=*Qv3qQ zr#)dH!X;ov_VQS`6UG3i!QAWo%IW{GJt4wPN&_sdD5V{IJUmkwCIfV2eK z){sZ=<_SbpgtN?48`+9U>EL@FM%pS_Lr54n_GX_b8;wgFvJa@lmrsT-lQhHn)ru~9 zJCSi}6uWz@FnUJ;aj7|7c>6>u`hX2sfG%and}qi8C|*&Qn!WQJnD+7ci1-_-j{z6P zMWml>;0Th!kls6nZw>%77k5iGNeKX?ca;aFXcz!w%w-m4Jj0zPD1o%S(-Zm=A^8~q z^!e0bv?MW*_aegPPG9T9z)G%n=1;!=4#_0Ney0-zxdH@1zg)-#XmM_8PoRtjmUHxV zexGBEE8Ln4diT3dQ03S@dIZd&Zwh}|I$gn}?c~W9&p(`;{OL3GBWwJ2Su2WMm+s;U zEFW`Nf$Z=_c8Ci(51A#nip1TwH(f(YoTwy{V8YLH%z5r(rY>!k`c)yjsmwJLUI+C> z_EWRW_OCpSr9H_N!lgD4IN887E&l4SxgnVp0v#a(6-vg?yRL1$`X0mR@bmoNTVd^S z5{yi42eGX*#s8G;e_9s^(r3*x(#IzTn%tsUPybN9Y+e8`6hz#VdnuYjbx!N-+PCNo3yBj| zr~ouG-i3tLlq3Zf6Y0~D8=a5AicX zP~-$M;DI$+Us^wbtQSDm`>RwX2|DumraIs->lj8EP?g6TS()BE;e)ea$EWL+PEZyE zP)1fHM{<`Ntip+CJf}g!xt&Getghi)diMC6$xm<5GoO65j+c~V0^^y?awyD!x=7)2 zUA>(7FzGLZFg423wv%%lA=o1KJ|T`-AUI~J2bjF80lHjkO5|7q>QW$>uAi$2!NcVJ zldKu`|9177fejlT@?08V@7587s_u%BlNbzSs5YnOt>ZyTq5}{KtUYJ@2vqcS|3X0$ z6N>0vXb&cD2ad^%HXjW5|L}32fdTyaZIsPyx0fL@X->~$JU)v@0I|25^p5qnWCTDg z`)-LcOFSSf5gi@&kGdedac1hrfC1G-Yir-GXMz>5ZZ@o9n_NT6aUh8}X$RD4LIB1aLbxU~-Ei^vY7C=nw(6hT|8 zCyJf+()tRynltj~R$OHy?hkA_yb9ZUIB^J*3)@C)!@soS_^q=Z#pB{|M(AueYy@1U zVmBic)?^Tz@H7ljt{=5nxtXDwtonp)O;g`_Oj55R`Tk9Z5=@uu(R{4U1ufmpnET>n zQ=Q2VxU9UklzN6@gTGyNP7w)5J%7Y9Frk zq|01ev+u(j7=FLu&b65l@ZXs^f{s{wY|y1y^g#T!0YlLbyc^&6aR!0jXG;Mm{_q=@~7Put64kpMzaQU#;EXWj! z6;IhGqB5pxjrUb}_BwsY-wT*^JZcj<(POlq0kb}v$tgSL?hAlx1cTpsvUFwx<}1QJ z=g3!`j0Z~PwUw3fEdk)&I(vbpF1l$S=;^3#N^G{kg&oZr7JD-4>&f8)yrzoB>~>xQ z7{{I716Fwc?o0w6&;t);N^_v1WtE72SyK%1n;e5 z(&pCe9R<9UBL}Zj%frO@ZN`KQ%9oYY$pzOK1n6oR;|1c}>NiFsj-$$#goKxK1MNG+Y1ZJAwdEhUPV~ub z09+lBuJbW)WB@oGTEZ&Hq_aQ}(?h$aJ&Th3ziKD?@*oft>uv)E ziP7+#=G7_n#G{-5*QXO6dqoKPHBl$rZ`0b%5EvPh+!iQru6Vzru|h*UXj!sWJyG5M>=Juv|`Pg$;|`*~oV01CoX05#s00TfRmFK&}K#|%uE zQYa*Dq5s)hvd*{i^p5wvMJe(8(*t?{-;sb@BP9zJfb$^FCUFy3@=0I7`uZ0wvqac% z=6$w`WRMV5uPyy zFKiPM0a62gzu8hHnw7HHv>#ah&w|<%@1NDpw6`EH;vtW?I$yqg4}3`tj*NQoAp0VK zfHAQ20YHiu_|eh51gn)0bZSVdQ6h*>%0}L{DygF%KlrA(o*2JeS_hHA>cv5Kh^`f` z1KabLMXK@XLw{As74X&ud(h^d?*k?(6oq*LeE&4nlD6Tq=pT?r!$4NO@vCCv*LKJD zvFD%;zUR6uU~w5ZjfAfRz?=)oU{C%&!=HFtU{Hw47uQtm6MdoqblcPvg+fV z8T1r)4k%ULyRTK)EWV*Om#dpFech;+1&s$*XsS|bUx;TE+`%|*1-uzW7z3_e?|z@? zD4k=*Fbvf0Dki7cunx~)SH_Bj0E<{u`=?%S$ipn5l-8TX_s27ysXf2B{thc>tZ$P8 z?DV7{03~ne^QwJqY}eXmfiqaf+y^XkA+9DLP+!Bfv>H%;Z?0SbQI<~^_t^^=vdO%B73{lo=5$M#| z8NuH*nwhlIna zJP3tO9UcPyPw%oo*8YJF-{;+fLbg`G@+@|Bs4TDndL}rcrW$a>waX%0owE&<&s;dw zGiguL45($B3(ks3{y2^oCAC7R3ezt_@#4(;4WPTC1z?1ywx$lO)V9K6b_b4@09j|n zYNxUhD31|n-x7)B(Fkr1Tm~24TVeGxVX&^tEiYF63@FcAR_{XbDo0@SFHti#?#(jS z)0zRV@vS5`*dX_imyH&-YkhOoc>N@F)U^4Zp(70TKxjAXozc%1QBn<@weW3YxU=Zr zv8UlP=84ubfgv?7jEyJuh}&W9h+J4MqQ@-2!G4x`E9^%X8!nT3aP(*^49kF9mI>cR zY=+s*OfX|HYI76JwYU%RpI&JLieFX!DK z?qRe$(jA#OmC-*8`+X~gZG_A>JH)s&R{C4^y&PI+E(qx(dXnIo2mXo!xa300zibA* zo>-otm3E`yeOa~heiCu;IcB@N%3lEgd#FtwA&+P}C_T%u4YiRVcN|!uST(_|TO2q* zw!7%q<9nXz;BZvX_0|0j*gl|!$Pe(NR}LI_CgLy>t>wagVAaG@suO^qD9`L}nt}Jbbi`)hK+x%RGi;W*!Q~mU1Z~V% z@*;;7S1vrBix{iMn(}F!U*1V7s~~)XJ?E$G8(4_Z$mG2Fbp4GAY}cfQzW5#_lvr#Z zfKcf96Y++RGWAn|F!N2J;9ZD>khObHl2h_nMf1Jp&`-UkWXs+y`_i=g(j>rZbwsW3 z#!3<;Amhj9)mb4HdanoFOVYjvQl6r|T9adr*|I?UyDVfJT|Hm*MA^{Z@+OcZdBbvw z+2VPs{4od=V%n!zKCvRzs7!TufAe!wan2w<5PM!57?-nMiDS-(O|NO}A^Rms0uZz3 zXV0Ne=u|$|`zu}`TI!B=??ctN@AiemT(ep;`!K+ zBD48oIF;DKz<#%nGCNgDb`$0sm?AekVD0*7*%E)lYYWEPwHPhr0TU_g6b4)YOG1!J zESHwuz?q{+h7g4S125BW4bXY_l7EhQn#mcI3L^2K{T>s`)0603QZ?ZH>ZgfcBH=r( z4!cmqa2167i)|jo46+`|Q!WiZx(1wgsXjq^Dg{gyfp4Ikf0@RNwd<`0lWX{0sDWLu zn#v2Y;T9I^h9INd0YtC6rhaC<8kl3g_h9(ZP3SIz|GZO*wRa?qrEg%ReAf7?>syVQ zgi<-kHkktwaxUknG!3036p-B0)fBuh!nKXZ?RQo)hTq(IfKqh>#+ z80S20=iq+W<+eXsG+cS}-rY%GOw7LvaB~nsNY=!0J<<71SB{WfX;vfv~FWd={ihR_w@H5LF);`Jvb!}6gw_@XCo8>D+V0aU9-fhm-zepIbcixb1}Y= zP&b=CwWB}ZfYKzjA7n%Ta|Woi$oESdMq6PQ$rJP-YEc1r7iS!lDw}0Kd!Emo1H_H0 zuJt8r6MVP!j_dpEdU!U$YpDetVi69lL~;w5l($YV9W-r)g_0+Y{l^S;UmVJN4bDd!7n#!vd$Kg_ zL=R|W_%`X@wV=BBe$BxuGlS2icR$J3@r1d?mEdi;WiUs7ndNfKR#<6hFb2A=@&-Y} z50^1t|G9CKu52o84LW3VKI?Co&d=&UQcbC80CL4%7^J6 z;P!4%H-wDux*L%0kGp3JXO-lQZ4C}57Z^i;-3A22PcMh%A8F8q7Gi-e1&vEnz<)s% zgfY;)of~2C#0N?Hd@u4!vU^3q0Y=)UuMJwTb zh9zJE|J96y|8?U30wQOmRLV=1RchX)69hvt$s*LKDx{xo1G-vBQes-wZoc zOPoxne8{XttxvZvvL=TJIjluiSsAoWd*-2c7dk~WQMBb8Xn zuFMiq#L|RanIc2RC_|=%%vN@r+9b6lBtwK{N-~d231!SYlR2|xSy;;&?$5QB_TKk7 zzjL4Gocnp6*ZHGA^4hyx-|IVmruX~(y~L4haVWkkiNfN5+kD5}`T8$QkE25~wx6(5 zaKK1ZVZ*?)j@J6-u`njwrUX`C(a_j|SCXXKtMZWs2Id|>$Pk*S@;Tq&W&IxSH*Rqq z(%XA6LN`kr4GkUpH`Z0Ij zT!#rBPJcc4Z4w#OcHhUz5fNaA=$?6NWse~p9 zA(SF`b2PKSfmGw=Na(mjX+qN`qS{YkOc?AO`H|a``5imjl6WPGDiW4g=DK-h3wDP0 zU2zG{)X6Zgjv4pzNF6Ii#h2MoB=cU(g)f(QzRD0i^avuy?9t%;W^G(J>{HA~!9+zJ zl4_ad5E5Yt))JeDSsv72=cjk3DAIHwx2Wy&oOUpxWykiG<{h9DLg}7XZjEN02#T1{ zc+$8y(`}R6WZ)%vKZRl@H}&9)y#(?Nk}J? zifMrS@vg}pA-`BVn}nc@FS#)en76upbSFg_(gv(yQ*`oDkap)GWLrNkH4@QO*)yD6aF;qjSzoJbjB(&buA7XRW;zfC;`!OA< ztM_L510D@qizmePgcqX(PPE_K$7l=S!o|?>pTHa=+%sq#uqKkK3l08qCa>>13Utd~ zS>MrLY~X~pmR(*Ml0^=+g3K{90jKAnH z1(UG+I7HFTAYK$F@=fQ}p{h-<_wN*JU;ujnJC346o!j5Nr6lfA;YG+G{yV`SEwD}6_7LH}VSMCJLAuD?>Qd4m{Ig0vDK%NByH_8i(tYjzd z28EFXqmi3V(%b%eQp)AF9b?9>i3-p^$;m8+`gB}lxWT)~J44`v#N|CNJ`C^7#J?-p z!JbRC=znlFz>HI7R~Pdb>%lL!aKJB?Wizl_MuBo^$DI;JGxCXB7Gc%ql{<2`< zADpd%NRSGkhQhg z6uYn?_41jFeTcRE1}s&<{wJRqz!@@hS0fm@BV`l?+^(YU%!y9|Z;SG{m*=`8UM01^ zh}6dlHR9kyx*yn-R(aDMPFA)!de+~|U_iRxa=~QMhQeTr-U>$c!WT(cMCynz9Xr^z zXAKEta8m7w=UKd0W_CmyJ^0zdm)fvr+t2R4_)A0JBm9IKc^ycI|0-M=u$-3r(?*@+ z$wgK>24CU}FVfaIW?PJHg_NDhH99nHT&no;clySb%{?9viV8^;y9_^8c&x#mOLW{? za2n8MImYfZe*>0SqM;V`39WY|hhd$O!nO8b1st24+$2B1u9v)hh!XzFz5HTV#dK%p z97`)LRw%NiD;rW7WpZRYy@8N*YM(GkRq=5?!;e+M_H2`GTnzO(;E+TIM@U6kDrOkQ zJK#iM&TL$seh?2m!Is3J%P7x7gxCJSfc71$H#dNxOpS;$>YSB8OWoUOFl`&c;!tdW z0WZ2+iTsp9bLmaPg{_Dq7Gd((l>wqswM|RiJciQw#R_pK8~m?8J6A4C^ZbdazabS? zVGPHlNJdHEtwFqcfpT?;h|1<5@A;CfaE`{uFZ|TM^EoRJWm~l5VPK~AE_kWt}$&A-I_b8znQz_PX{-SC$%b>2N~Na6=sy^ACAdzv|_kP0WH{p zTqkP5Ry}ih$K{U{!?Y{yfS`mtEjs75T-CoAxlY&qq64EK!PCzQ-Z7E^pdbU}{92k6 zMX_wDRA9LY!53naDz)Bzk5G`_CUfu#so_)UkkWz_u$E zn1q@(0eH`2A-aL%4JIMsZ4eBk=sEm(dYHYQ6OjL-mP!C4_puc1ot{jIH7>n}lq!*V z4u=H{{tSN*ia64d4kQTI3&ZqL{Yy7&II92a`7^p=%XncZmjaR8)kg)$8)n?~4;DA1 zBCIE9V@xg0%^Y zH0x=DsY5|*Y7Oi=bC?evf(I`ckW>>keR?*o;^p`yHfX(P{SUDGwv&+@tzXb4vzb*x3lj<=M}B7pow*xft*; zfcd&vn2y%G=pF$^8*m7aMhp%dR649>`kl7CJonGa7ebo4QZuOKi0Ref zS*{d>7UiMlOAGz$zxgnWp+dg4QwW*aM$MN}bvH-{f0Sl%`XPFdzC>DsFzpW$ z0UZ>4yp)tWGKfbdzM8MW%vd{%(5f(x*Z?iPY$$}pM6)ezq)w8Y%6)>j>&)O@3w|IKP)Ks#uPiJFRSu-g+D>tfowwu} zumL#q$dwwiMlZ_&Kqc8L8>JL+=%2nUT&W+%=#a=VX1@kDReSs-)_!_Be<`5y)p*Z#~U$DkuJ9aK7t8#LmR;@n5f(<=NYxo7M7I7n*d@W2)QzNI+&gQ1}G{QQ-LDr=1gs&o>alb?`Mfc-LreV4sF zR0X1yc`#SMZtUs)aPAzlZ;+V^Zb@fSdk~e(C~DhnpY!)B9z)-D2Jo;hZgT}kOB;m` z8h&AF#MF==@zt$p#`E_o5JP;3FK)NMF(^#!Vq@LU^$ko0Sd5=GU1(+ePCP<%4~djz z#+dBS0A@loJpN}OJlgKH>Q=sk#iY=nBsyWoQwtQ++#(7avY5jk%pD;FB^05F8^SE- zz!4#u6!&!29=~m)2nr@5sqmda2>YD@uBB?hUZZR<{-s#%ahP85dFPksKjPDp}ghP)hFMU#z)vN`(JpF%cfQQ2~4+wwX3i~ zX%^3qe$j*#@_U?aN>q;j!;IVG-dzqBRYu}=PZ{CA{gYG*fuu#w&;A3z%v*9)bHi$~ zoPrIlsYDdMvlPJCEg6!qii3?W7{j_(;RU@U_GMg%*90TwyIh8Tzt@V`CA?9b{mPc(!Lo+ zD6hcTEJg=<9oyjFR-mjzZ429^)plWhxZLoJ$hGI|BtxX`*7nMVm$g{Vmq$ zm48R!N?N@{O8@O8#}`DNQ|v*h@_i%EO&>;AYel?4JIAGKRAJ;0T6;_rPkkTmVl~M9JF- zzIss!`<2vf?m92CJWB{Yat69k|?CI376)93#h{Ym&Q{S&;|bIn1uGF=jP z`sHc2cOA~fb3M}^G|l`@_0cPQ^Bmm=sviO5g>G_bCs9Z>k&{;ver71Hg6VtD4dW<0 z+yKU%Xio;*5H0oFOH6GX=C6R~6TUMBfUVt$`8{o5@aj!h)7!-?J!>V4E{&REiWjvy0*HR9DQjIRfEI;+Q&{+)`KS8(<21qe8@ z_KKREqy?=R5%X4g=v8}vrV|Ga8sx?hd+-Hh2!tZJf1PgN#H7~@dbQ+q4mTkja@-pn zM10g9k~I-ZT#4maF8FsdU-H2PvnDi@RT|F}h_m?eoGkP_*5^~_z}Zh(HuLcwrWQL5 z(6%|n84zEwq1de(W264!-W)p(dugHCIFxx3TVanUt17SkgY8|!GVe2yi4YTq330Tg zv4wAzq3ZQU#0E)f9&S%#EOqGPtrX3;og8RN!yldl3_rY)r4szdcBgt`B;zE>fUiT! z%Ku=fMhbtYT_r26#SGFeugbX(@+r{+2BXOt^^X+hPw!VEe%Ab5(`T_&Cm2;iA6TFi zx#$oY)?<=DFtLcz0O12bxg06Ct0!JJW0yhld8EW6##J~J$Xl7$X^PISUmI8%SjZ0b z^Y9)3{joS_T(~cxiT15-s8L~_9pPjR&6VKfvwKo?j()(83`YMwKL`i-cJ(!8iluA> zX5L}nmbEi~GnL=`Mami`H1~5o;J`U}4@}?|s>0{fRvSX8{R`2kwNJ}rpayoenQ%|U zdP^WXlheU#-P>$OD)N6R8o%rTJH^ma+311!Ltyww(SeP}*$^DhHLUTA2eX+o+XV(X8LIFjPB*`LgfR1;Fgy4v%SZ=5#UH z4(2F!8Kme$+1s^=MTdo#mv_iyo;=M-2<0zQ^qJDZose=`8pn|pP}>1CTa|b?9K%($ z<2#oNV)c!>*Yb$0R zPnMs4X0zpq)6Dj+0@jC|5ADrhw1~l@xr9Q(<3t6_ob8HNPOOgeOjiKgE%dy9Pf2De zB3lJm3mnRl@9)G=#?H!x5U;shDqEHH1q2N?7fnl8_poPpy^?UerJK8#DhFSye@EvM zdA^18lJWch;bfb_WRs-cvau$!>J<^4Z;f$Vt+r~4nj11J_TY-8O3Q+(D0qpAC*^jbFb~m!Cc3!qIAaWYmT6i~kQObHcX~`{gg1^>TFv7>&|H z3qu8PzE&FG8(e#U)~KnO;RnQn4^$2@zhf&Ow|+liWf1%<-8$*U)GfOLGSU3U^><;c ze?lzu3+Vm*iL8zwhQB?V*QuFN`pv(GbK7$d>1h&Iibf23O(-VoW6z#-uk)9{oVhs) z;4JlzSkAMLG66z9sFBQ|ZwnkK@+JFsx%FL@nsy9op5t3TlcIB}RqNq*Ik+$K@juBx zK7yu-fyVT$(V$z0MHsvp;C8YQHh(uJ7NSm`bs<9thclo~66a&#*DWWBqbvrXNlP4+ z?l=X{iI3}K&YT%5F{TopeF=(U&8`0J;>=~RfMsCt{Xc;~{OOi!(opgEZv1r8`4#VY zudde62WqQ=w4VVuat*EY6DI|>>RdVZ>TFt$Cu+t%c_YF?Tp1-fpbbKZ%XK3{g&Y^B=%_ftHDjp0M zBC!~vkO(dj_>GKhAaLwobK(E8eDS#z-z=!XPMDfL1<{L6Hl<&`X#}C^%LQD*dI347 z8IA0H0`aW!{mgVmx8o0kdwIV7_kMvVkUAccE*xjq<&IpDnqw8@JH)V6zX&i)yrZdv#JT(Srk@Mk2U8cb8@tR z`Jo;4RXnswO-uXbTZ1Tlyc%087e&JhUXhy+7yLEL5>qY3qf1z>VlG3<#Kr*)pU2TXOaq14ZMhT`XLG|dn z;E(J<3-yhbV+5osL8}p%^N64xH25kiK_ilm-UGT&bJ@!~+_a+UyGBz7=xYvyf0zk6 zL-@z2VKLP3ApCQEW%_><{sF5$QNf#0VfyrK1S(9jPK*lH4t$o@757)?|3jty|K7Gf zb{7Z{`9W65HG=5t>3%gp?ZEFoL|fyd2dkRV1feW;T4j_$=lV}&^%n+*oe&WpLlYV7 z8x6X>V7i6z(k#VnrZ=M#A?c4K%)z{Hxur1m_E_xNs;HwkC<2etf}9W17X7qmRxdGY zRiLQHN66BWtBy`E<3fu&U8RD`@f!X&d8Xuh-!Y9Ru#Z6!b#UjuIcQH{KOaH>pBtRF zUp1~5)1d+YJk(uVna1be-~Rvv2rcV%>Il?Np$^KvE+P^DXChcoxXk_<)GmM+cB@t*tHkZ-`|;Nw7?St=rJ<(W^DoM_*$-m#owMqqOBWyV*SRQM_}{L`ZL`4 zu1^qAGPJUjVDVab?fjKxH}Xu`x9wjSCRYQ9{fb$=V*g8tv;>LUWJsQ}Ks0b}WpC|R zKUIIxU11yFf&SbHwhLAE0>i&leNEtrdPRUdZ(iW~GyymGoX~oVTLk?C;V|p1|_Q&pJM#TU3#^Hvf?g1sAR*fu;*pu9iI9I<3 z-^V;X6R44lP<+A6S#hwuaUAY1=OjY47j3-X$E+t73h#Xak-sHU1OT3uY;V_rgtckcXEvZxX z1G@#ZQYzkUa|5mh6Q>1-0eC6Ya2e+Bhr?iI;XfP(!xH}R#|%sOBi#9)XdKqHCn@^> zu7qB*YIOJ29{Mn@>F=x|L@Ad3*BvHL57EX@+V0D3_=(lvr%#7h|8ZXlfvPiDjseMW zqW3aW53K@PXwZ5bmU7Iw93#{kD`bM@d613R)?nhfuaGLKMf{vp*mRWvfbX5M1Oq+% ztua=f#z&VrPWGVu<pAlQ4N9kh*L@6a|5(UJVCwz)+<0+F%?TCZZXjvEB* z-oWSghmgY1hnpklaNP(hbT=s!p!)!v5N8wHspL0kkZXY31ZnfB+5VXW5m1s|6m+wm<<~?(CJl?#b^Ke+)h7Rso>3`lV6=u zFPU_0=GwjMi^&CL}@(MTovB6pL{mD9Y=SRA3h1*|%riBU^fehKMss3U1t5m^R|4o~$UbW1_{{+2-#l z`74LF@gybHJ(en}rISCyzR@-!^f62n z?n~jw`8z zL6Vu33SSfb&ft+3wHT7wcp#-yD79ES0a||pt;4MpjMmekb?txAdbvsfB@8o$v~R&^ zA5%s!qe_wX9imUi(8Ex^#865Eee6^Mtr`0TyAXVQj3{7ni?Xi)f3#Fv%DbW4axr^q zTYF@y)hSSM9ZAH&%&IWn6(ZEQ(7Ipu@u`&#JLO>H`HNBgHb$JCvfCM9d}A8 zp^4NP#eFpn6Ei(0D@h+Uvo`&N>*5HC!FV>IiK-LbihicFu?8G|*fMTtFb?C9Xfbo0 z@Nk2_$YwoRE&Y9U#mw5#MwWnklw zg|t~lWRW*mS>SSoGM|b#Lkk9k>7TVQYTpZb*OaNd#U=RtDJ=WBNg)^Di!tW$I}`V; z*Yj+)V9~GF>v_Ax<7p4~@PsP+Z43#bR3F;K&UsAhf%dlba$YWL8|un>Iq%^fEzJ4g zU{wL!J(UZ7mb=-1-?A55iQT+j&AY}j#gV#R%{#vhi%zJj5`1E&oOlSA&CdFPb$i?O zHkS2bp7=)M1KoAdGhuTZs(E;L_b17C?WcnVtSr}AewsRV%YS`-p2M_?{Fqh-R>%Hh zT7T@;|BewD3JKc0ZMd%1SmX@2BdP4=RK2Dg88}bpHZf?p0`|8&Cw*gn-%ld~? zIe=Jtw-U`5Oe5~N^c_&G7ax65izexVp(l`Z`js#`m}l1RE2-1CX-w3BPqqm?9@mb%u{QN3(mT+b^UIt?NVUS<_C8*4x1g2>pxJ%@WVjKI0aV_Olu7;|8GT zk(BLE>BL6*=g@MpDma401KM;OT^rri3sH++yQEIg9*wVZ4qzk8#%H8R2E>3{^|d9Z zcg10>ueFKO^_I{0Gv}t!cN)CI7{=PP4K6<~a_S$4F3#5nr-7?#PF3(5AWcxF>x0so zaE)&6(GlQfr6otrX4tA4aitS+g9co067yhviauB}&chhJO@v^ji^xDhP z@Kf&qy|(Yu2{&pKg`7zH6z&<8rB9VA(!81_Pd|#Lr{9USQKXXXbZwqpex_p>J1?i5 z-V^!9uoI!HtTn%>N3tOr=XUi~hPASP^qW#y>c|96!J($Hz>J=N$Dv#6`c&r`JUQ%}98$gNbQGclfJ zS>O*!x@!l9DD!@_toqEf&NU+VLo8N=EhRVBkJIgR3l}^V{N9epZi7)AvF7O49WxCKOG^x{b zqYJH}kDy6y_B^tkUP`uHu)IN$rny-?#XF5Z#$4b(No#edw4-A56NcjSG28tfwV@IX zF~7@+{G@rpPT*K!#dD6q!?P}5jo8edp7?$1%SGaRiZpI5_)Fw(OwM~6WEod~t$w3Q z-90V7A0evfipJBh9n!ZPrb2~modbVWPPB-89O$rRcb5%KZ}JZ|)VCwu2YcGtPSJ2X zHF&7wP3>7-`p9Z(^%+?@=7Y1C6sOmUWI<1cxCFb2l^0H5Y z@w87P`}6dOs?TyyRvwDimJ(C_aQAn1`?Z;)NhTZ~XVk>bEN*#;SwgkMp^5E28#AI9 zpo*>#jB1z5e*Gj`q>9fgq`&dj(0tR4bEKb$HCp_8c*9|+hd49ZccxU((DElU%bEif z9r_&P23w5%h}G%^)|u}vYR;S7=?=HWS4AZEI+hAM6t?dPp*zIt8M%bSc3dBtV?krO zOImhpqqkEpG%;^+JqX$1_U89{Z|k(7HnDgqAandXq=6r>Ic!%jH;(QxS7VhC2^>}K zdPHF{nlG{T`p7o$MJN7ngjx7wkLvX3dC$2O4h`Oc`EngE44zmzh#CIs`re6l(u$NP z`!XzcA!;SX+o8a`p1{8(al2!MCKp4=n#qu5v_F2%=Z3bK4VFB3o3bW83Iqj%9wo7LWIBYbAy_o#%p& zvx(4_y0cQGF-vvhYaRVJOh=3kxU{xUyd3l~rcB&aMa3evXAOTjvWU`_lbjp9((PFy zEM73$QrD_!MtLkOZg-H8Umr7pUQPaK#t$Z>jFx~Xb}E+GvFPNQvPWq&A^2v=(vf)W z=IDqdRfG75EJZ)U7D-2VyP}no0x$Ok!tgttM*H&euYat)Ztpa;tAF3BV6lveTSw7k5H2oE&z3@IE6c~2izt0DyV-uV*V+5p z_)<=5nq5Zoqms|}CqfN1cdxw*Yf{sX^>plc?c9oQxZ8a&Gw=P&yDt@-O2kb(tI@4E z4YKz&>k&^|LjT>%F0weyHKL>RQ9g2+>*A}y`Q?_vi6E+1&p{Mw#i!t?UoM@uU$=z! z(F9}7Y~Y{@=h<-)Yrc#o?Le5R{$7ykx1orQx4rfCp@dM(Z@6|s#eDgtTdNC(mM7Ju zz8r5O(wFUOcnQ!T+k9TLVtUEi+)~5Q^4Hzp zy3B*uUe{oT6>aBajgm{|ixo_~2QD;>1+Cr4XkC3?72%G#M!;7N(x!4vMpOo?23M9b zCdJpA$81x0(9*Mh6~WQ!!Et3|#aXAjGCa2^*3rHz7eh(kdRs-(Gv&V==kTBiwv?m% zjB=vhealLDZB|CCIDX!n{E<#m?zuB>($df=;b=d&F?H28y%85(Qnfi)`y=l>#y6+&^4Z)o`F@5IgYsvJJGp&l}jNO(!CsVRKtO>p`Awi8! zs*mh+WuDJbCR2tRrk(E2SNjT&r;yeZMI5qg&P7j)(xk&xs_11S=++PDm^Pm#U-y2g z%>3%9*_tsq>Ew6y&GY0eS3LfxERLGpX=M6zu6X3JD%Y%TIgU`P!}tcQS_DfI88M z{}6{!%ygeue?jPnepp?QR1Z2-9jAmJbA2ymIlrkzJfE>??p3(Lky=)VllJMf6k_wt zk1+O(^eOu6nhn&w9xdZ@h&o)6a+vg`XIUDv6Ti#rpVCfDaEWpxxDWVw%j2IorQk60 zJR_zOj<2bsO_*OYv*&t59du{NQ#`M;=BSUx2u*1hsO%!G)}G>rP>JC=gbdGI-@YwBA9o#!W>Xf@(1akZOhc6f8qH+P+!_+y*m3Z`J{6a}nE)r@Jbn;5WnjTly>|)wP%7e1uQ!wn) zU-6-r(LV2^U!?cWx6WTOQnV^=t#$(#jdVE&yZao)Tn^=nSI~7CDM5S=zd^~DI z>#R}KR|T(!O%GK0p7O(!IUada4>oz<8nI3@{Zr3YMn-SBGt;nHGc4hu3kAdXQi9wN zr@yCVnvs~AUxSms(k9fu^By@dI%s`i&7tH+tTEp=+RvJ-2`-vEb73c!fp2E_W)>=Y4&9mTg1r8YRnZv_*z9iU#CE)-3Hy7jMdT z3-QrVS@z`xg#}gB9HkhSa!S+8sp%v(MPhctgDUlRJXB)aI8`Pn`c?!+lHRa8#A8}^ zKHRx^p8n#EBSoy^W{8vJvz2s@VQX|`e&6)i7yV{(ZbaC%@j-|O2B!ZQvI^5Y4~;D157@Na6!lKoaOsJ_H%cd z`PdSAH&+!0IqlCVU%ocmz6aHZB7d8ZMe(d8d$gQEUFNm-9CRhwTBit_t(1=wO3KGK zPrj1uMN=07oHRO3-X81se!!OGi(c$l%Hq`2#H_X*Y`9q)ZObz)(oux}&7mc6fF4-g zkfU$sm;P!sUj@&pQ590?Z8+{15^aHAMh`|I;eqS0et8&;nkD*T+HXNR?g@=dFYkV2 z;uAIkUZ~I$6Es|q6pTyZTg0na4%fTZ<#nbEr@RWPu5RId{@Q6~C1HGetl<0$j^u^7 z1Ve4gjBfUTAH94fS3l|ICC9my*#V{m;2oUr=bchhp);vR7=h0&8^(#By>aZE`R@>D zsC+Z;ZhOzV?9(gSLP?qFZM}HpmhMaMHs{H%P3S>m{Q?-+ir>lEg*c79c67n=u0mYp z^T}K%`Y$nG3L`EQ;NEFFcW6Goh@sT$mx%uvOPy^>3K@5bNzSbg^$VwU74Ex>*O$=? zQn}DPBShn0!MmTB)5+E+(+C4!DAnij#?6lk$u9}P-Qx`vacgDtPKqIRv78t2+OBnO zoduoEo;mpO=;QQ>9*pTTKTRqQ=zdxSASrfjd&I)XOk0ulX~Z9YmZVJ=d4P5x*G6)P#OjVTW}dv-ibIEcrtl)dUMEVS%)m~3;R32~#Tx<2WzSB>l{PuVuf zm5DWAJ}5QRXwy%PO%GnO_FKUue)xl_j3UE%c>S98P1LQFDc@a!60H_yDdzNmn)!Y} zDw21bee>{7@tfteo!gYZeVfmUiF;BsFFM?{S6xmH7p~Ts*H>a6hEpO-U zT}17B$Ln;9wxolP4&$V%+eRIhOEOH)__M>n{Wp&gha!BMUCRuylb4XA7b6uMcMnN3 zb(}H5GIn|sm%1mmb)uA}@2N=N{B_xYg@GOTpMeyhZgWH``X}|n^GrR44wP2JQm$Yw zpSmfgX5NEzmAb3zo|=E=a=*0V;wGnu+lBRh@|S*m@_3BbH;&^O-6G5cg9t(6lzNI~ z2zWFt9)^sa44~bTsGRY<4rY5N{_P1*1fn5dTidmDhVWD_MI2SsyUQ_3{Y6j(MCIXr zv_Qkyzu3 z+K6Z58Ysv$(6=fH{KT4t1KWL3>4Jt9{7WJ`S+{rRL+oQM83@5CJs?Cb0sZ?M$( zj&7U$6aDgJ_aRdzGEQ}a0&;HRjbKj)cGl+uw=K!7M{zG{Zo`x3-ky+ULQ6}M@w9J)666>r zYz9jv5CL`W2z%o6RgA9Ft&l|Msg!(8?Q^T2yNE=|%e_j|e?)aS=H1^aMxkz*d@YH3 z>R3)LKBGTIWsV*RRL{8x6+1p8CyE9iWkekxVGmULZfJ)eKK3T-c-NzQ%J{3F*c7RF z+vpm_)0yvj(gfdD5eGkBz??coB~0MdAsbhrx_9t1?gD?r1$orqb;xoDrLr#|@6yTy zk9e&~q$8PzJ=-ilB@nNz{UFf>CBkXo)^MU_yhQOAhtgR}E^SYAa-OUKI_auviZg;+ z+7jFKoxJ+|)@G4XN_h7TlV&&>H{}LiI+o6)xz3^`FGs}qSQQhCr*i^x?=TY~=2eA+)B-NrFiw#{Szk|*?J}Fg< z{RTFf3dtYYg&@IbRyiI6JA;0A;8$}4*tvnkPhAo$zU+IkYs!Q@%-=8QGGq5h6 zUpfdYwyD909oAo^>Iq69S~Z>rKu*cO6whf8`|7^3;bW}FJ!MJgxM{A~C36|p54_yl z_S8Go8Na)&z3TKWxCwW;;{P7d{^o5kUQWY8$*5#arU0{oT{$gUj!&r%G_6L31bvO( zp`aaurM|?DdF#oZ(9)C`rMS?-_qEh18j%|4I1R-?s8v?Ay&~I8jY9S%G`M*N8{~Ne@MzJ>b-{9uF zOmw0p^;9PL>0cFN;=U(cu;HG=`>0uFSjK} zv?`Qggx|jNFRnG{Sij6+mk^w*MJ5=z>jxhE17-)a@q@kagT3%Sf)oNpZZU&nxHA0+ zG2>^?C5(Ff4oC?q(T_JxMgDCoBi3Y_bpZ%IE;r>tm0WR1NCkxVrsL=*3{f?;*LMo> z3Qe~l_QsKZlR%5!lO zanx1}0eDBr!gxT|KM8SP9FygcXArYq$%8&W@pN&2N+V_hFmkuk|KMpYnkBxTQuzaE zy;zgsb&%Gxp!Ey?s`dTci<-3X31~lv**>umL#!FKen`o3r)l~vwWASWec~ZmHSuiX z2g%xJo%bK6;;m(B;sCsvIbj|8xh73g*HUj_%zu@l(3;>#DtO1Sb@cznkD!I_(#90& zZKxRQl~qqtgdDv(IMg=~gP{TMAp1dsAPZ|6mqE9($xX58b*>OQ7gP>Be~^WcGCX`B z`vK_K&t(5k+Q@Jw=mcDIP$&Gf3UR(dknHD}B3xwQJvnbxhrU^~AHHtb_JGQ?+&r%;ek)VZ9eCPH>I#B;ND`pn0+Rp}Qanm~bFevwl%YT3?{CM7z* zsO&?FvDGf17VF;k(9Io^~~N?kN&q^d@#5{IUP>*}f;-wpSkZq2Zd ze{=k~+xNQ`wnFLc^baN}v&i}*A^VY#{Yc3E$I!{w>s<5gKhzsP)Emk_)EiI%{vnF_ zA&U8-HTo|~xPGWNeyBHoNc;ZZP)x=j_lGZjA9EVjZ&16^T27i9QOTFO6LI24;UDwz6 zS_54scINKulr(+Wc#^Q>-!as{1VAh5cLPu8rKJP&lG=*52;x7c*0qyG3MeB|jS0K3 zm(448OeFK&?Q)JM#yD3`(oVcr{%sv_wE`War4^r(H}f-Y4AghK>U-H;4>`YJALi`& zL-{7leM&mZU@~^*m;q$U@YYCe@VNWj3TMR_|GO7*I-$q%x&x!1=E=}6tJ)sM>vxmx>aP5ZSizq2nfI(KOF2|M#6C%1qmfTbSHXWp}K{tdzS z-PP=O`PafCh#bv3%i_#Z#+ZbM3KEBy)N*+s9!>eU&hj$nKm+FBHb0Nih4_m=Ruwss z8C)U5et8V(Tb0a#y$6{Lj}TxAoKPyfi+nqim3@0E3{Q>YQNtmvr=Wbj@I>#Nc`<7; zqjMI;j~^E@2NVkf^5WO`WdyRn^cl#U=;b&RG;Cq{c$&t&ImYWzr zys|jFDerW~UF6fh@TNR?6P6=1MDW-XfYlMW-TWl$kv09zP$t=Zy-A~;; zKg+=!lOK#}0VQap7HGC$+DcOyK+e&CmA zwRjGANa;&yK*h1G>kmCrt(9fY9vODSl#AHx7Ur9{;UVk+;oe{4<=~-#QZaRNENh2} zQ&}!vg*Rn~Tx4_*$uP$%q`SOizFeW-btGhx%)2MW?oC@AXDK;kG_sd<|GGeEs`}KHRe3+JXoQu`9Vwt%Eu1GQPHD4Yft8ea1GJ?;L1nKRV zL|sJTB3(ddN+%VOk|4+@B?)(*q#_^8i$a%~0;-Z^Oowm95whxIO`C9wzV|P$HK0Sb zhWvSE@y*1_ax_+v?Zwv}iTiPTU%Pi*ugUGWW~ceqTDT!vPR_v%x0bX+wlBV@en;ov z6A9D8VQqJzPHX27U9VkQO2WJFOQSF+8;~ z?p|HL55D%Ox8#rE&zV=Ueg7Mqt70JBukA;koqv1@N1e?!F~d23{?m2J_NcpW=G0L> zI_)v$YK=ddemp`YRZFbOv_f(0PdcWm!%1e32Y-yU` zwPIS}bdBOX^K(g>Opr7U&t9&oTq*%bkY+uEj=0IIX*dNk<4i3Ud49cvDJUs{y)l{+00#&Z;KmvWYU(ft5w! zl-OsE#rSIHChy;vmC49`U>u{IU(Pabg5P@t&g?P19ldAG$-o9pZZf^W61LSouf4-I zSbR>-Dr&g8I}81_-7K&%mNzOvcsgRK)9Cs?wVdz$ff76bu<-oh4SEK5Vo9v_C{JX>SMBwG1L!3_?PhBdtdO#1M3U`1`O)PB2zH5sl( zupo!}iwhjnFkhbOwk_yiK0u%_HUoWa@Wgo08I%uYBu?XK+?}b&_Lm;RW-TpAmugN= ztY7`Cg>bg0q1o%VxK|zla$dfmg*W@%fABbNw_19nxDJWVbuEWX8C5_jj304#lTPRZJUB$ImQZ2A3Vt} zd;JPD`uemfT(exEwzd8lIdM58h}bz8-~D>;XR+L7q`hN@{SyqcZ+zaNbFJen>mk_F zyK61LuA6&-QE#1=B>!#d;~iPt-k@*wV~?qI&g$kOUzm zN(|8YFmZ~z5 zp!Yo}e}pA|IieJa3?h|a;IJB{#vttGL`F$qoif0*6H1)<4ZW;@E0caV8)6{NlGmK=1o)I2A~ws?2*!_KGl{Iu~v#%ec+{CvI%7vLg1u zO3l{Qc!3Th8JL3Y!Qjaa9)GOw+exgcKRvgMyuvLVEh93@_&{dc#dya}Zkan9w|DJB zan;|uZ_fjU<_mPOd2^Kxas-(de;m_gJ{2fZX1^WTliNk0mtI;N^P$`eXU=34*gzlm z?tyuEd*F|#B0ku?o_(_?;5VoAFgCimcgSa^o76Q2T+?0WyX``apAUMj^iMv*m_?Vn zd`7D}_BtRpkf-f|5t!tK634i|5%04QRR>0{&qBiwVe!uY8r%vYX|sA2GT&I7a{m-Z zNRUe79@Ni17Hf*CO5U1fv?f237ch1Auhyr^CcqPBov2C6TT^$ib7_xW3 zMBVv(ZC)3)vyS#VWH?htwF=1R5)+;#&Koa$$?a5$?l@$G_FDd9GMD#FYE^j`V&#_v zk%d8RnvYWQH&qgX?J(&4Ga@6r3OhM%PhPnxG+1V1h_FD3yRk;pSK7^=8k&?whis$W zCfW{N;wV~pE@FnM>}?M5b2Sy-$(r#I99!W;xxYMr1U@|04)dONAv22y z7Msc6RQ6>~q|BXGw#~#-XBhF{l&qFQLgL}C_kU}aH_b<0dliP3_9w_%p(j+VClZdT zn8iC1AE;aqJbFST`K|?gs7LdK>wAT{LP0(v2InZ5Q!A3w;#e~KBES1qdM>`2Hwl76 zSrb?M2iFf-SoYS6z>k^;mOsrHC6R|1%t5?Wi#(wX(XQHq)QR`W=8NkEr~0h zx@-72`eLVRzguvt*K}s|vS*uMZxem83G-_(kJ+G~asAB7YEANq4ueFJaW*aSv65B& zG`Ovr+-|Gr5YIQg_tUe=V9e>g}lZiRUMN#$H(;u>v@T^z`@ojV<51fHLW@Leexc-~>=R5nftq6_cekCUJJ zcGuE8+96*<5;Gax6U?`=Hqz>ZaX0SqEih@(iKTp8CJZW3N+$aVjZSEZ{fC`ATc>+N zgQFzWY$u!wmtxR$MrkMv!!^%)u7J=+-^g+4$}ajkdq>-5t|Oi;fbSfREJwkrSReW^`y z18keyQLe+S9>6>t}~cX3-2BU(*ac-x&N>;kvagllBE` zb0bWps!b!c(Vsl3qhTkzQ+}|>zWbdkd9X>%E;CQhi|#!bW!3Pa-KS{PHhF};nv%O> z>Me_5N%Ltssze-|gv+`#K!6vfp>#OLr4ikFj{lu+5B{LSv*2Xurqc?(^ap7EPOL%x zOup+^jNhTMX+9@)m+_22Q@<*e3k65c;~O3~Vensg;QsmOl?)dJ!5-JvCCF16O?=R5mYUEKS6lOv5Nx8oeWJYttaEQk^#(;bR?!1;LLW z8URUIVNF8XDMW6PX8ewy<{cNAvb;gdC;b)ZRZ1)|agP<} zI2vxsM|0?#`KpsY&=qbNCngvy;FL&FO9Sq>#Qwd)vD5at8O2j+lZhxl41sv~lH=v{ zH^mpPS;x2qRkb`olkvKJMwV5$5ZMq_^=K*?jO_p; zGXAcLdL(H4+=M2&-*X}+B)KweQWHb78|mHe{d&QC)eUD*fw7syHY?raA#=W zWTYsMo44)Pi8hpy(B6}OWZYA}2m4mx9S8xN6{XWW^{CmmI9n!A?W19NyY^mSI@u7h zHf&^1Y8UCud+~z47Z6}AOF2>Ahx+{~VcRF2K%j9|$q5HJ=|00ac~A4UmKM20bJVTr zy80y!&$!T@(nw7%t;@Ym5##8uvEIg%nF*X)Rg=1#tcV0|xYjjJeZIf%al5{mVt8n9 zxcknwCf~-KmgQc>!hJagO<+Nu$C96o$qh&h`>uGS?aMnzK%m#yL10z6gt+gkWF;YR z!dHvh92B)tT(C-$-jCrUDiGPaqPHS@cBLLWZb+;ti+-X+#~z8x2&fQ3&L#5_0unA+ zlA|0xym2@!N@Yh|fBy2rd73~BArzC`SvoZa34pAV#Jgc%fq|vK&Lr=CyRdOPI=S=a zWSyC!YrULEapp>HD?Qea5*8>l8wy8!ZXP+r) zwxo7FBk?k7rqeBnf?+wO+HhOlXFn&is%V-g_{-m-M5$e-MB*{URO-?P#{N^FzdB!# z2ZKuWfI%U*v$;DHH7`>WY2RWo_fMzO7D5`&EY^5$IlqNDr1N}2o7{*kI(%3K-22;v z206L8gZRPO5JP+~XH~&I`8YetE-9Dy0X#`gK7@sFX)r6pN8|2-H3?Z$&xmm>bF(G) z{(3Y;Rmoz0{Lalpi~BpqU%Qu6#b@*Q=rw4$2^4;ztf$F$*~RSgx?=;y?9c*)(OWLd zXoa?Ebag$2v`rWD4cTK@rSy!a%1nt;rt=hdtyCj*w_lO7lU8JLiltR}-H@yMk!^3K z=uRk8W9I!ZeGR!zC9}(}oghJ}LC;C0+Ou-4gsgs1rRDI&7pA)5Ljs5An?h77wN+8l z$=caA%}JB*>auKTGp(hbb(lkG2FnVnK4@wp)ICIHMI6hB9Wof&rk2e-#$CqqK_NjF z3PH0`Gg*Y62FC8}=T7=v*uR+*2_U^x&HopBZypF`-}Vn*NmtUMlBHxRg~(PR#Hd6? zL<-qcNw(~}Nt?1wB~h|u3Q6{T8xf;~>^m2-8-RjO)7Z_xC){`##V6{{Hy= z(LZ;0b9J8QcR9Yt_Wc~6n>-(KIeb7g*}_$NOW4 z?sk-mJLGrye>+pGlX0teYDg={&;7gI9xm(SCxm45S={+jG}#AgM36zV{(l%dNK8nc zdp}R2m*0GS!7+5=hiGY<5^-x2xkdK|DB4luMn9k74tz``nq3H4sO{my%ijVC9V@SjW}@)#?fB?ZB&J9d2nz;jI7*DNXVt=DLHP&2XjOXk z{T8_n)1CnPM_@J?QCDemep-y$4C2I3VjR846j_jT0#%lZw-j*-T*0nj2f9*zku^!> z?Pu?*$*q}7?!z@g7zuXUE|H4)3d8>6Xi8NN=> z(~IXOZ(`pLkh}!Jt4{*&FVIJP)&AAsj#}!;lUd22R`{LZaK1Tw2Km4w=JwuC?@@4U z(Tn_~2g!LrF%t3? zf@r@b3mBy>`H^in6RKX>2f3X>GQdoUftba;=PF6FFC1Jc%zb3cqioo&s{4AVIC<%95_FxG2` z`-V?>q8|y~8w5oH$Y7C6o7`~2zWggxy#nFeXykozYlmvM-wB&oXth{cLw8hkvH}UL zs=0A-)(3^IURfz4K8!aX*X)Ifr9`Op{W+<`AM+|x8rBEWey2pbG$GPLZcJ`#rkVG^ zf_2R1BE9{hQ<DAZ&IWy76|Jt>8vl8U;)oY@k z%bii0dgtD5CfawWYO8HmcF&5%GfzkgChSL~jw{RP!c&l(YYA4ySN7Z2bZr((Vp?+@@9+{e+i z&mRKPb1_Z<14!mBS79pjXybWluR-8|)bt*;)%88!y%MmbRWRV}yVCsG;%l}4-&`uvy=p_q zYq|X~<7GOI_GqDlQ%4&wu)5lBIL;61Lu^fbq=5QhsAlydhMvA+Ps@)gaLVm7PYGfO z^5oc`eMNj+^P}|_a4MrIx!t!vhV{hEH{yg;hK(EfmndSYv&q94Bt(m!DPNt*tqLzO zDBrAXk26ymQXa5RUxF5++R8JfCL^+GPb;(;O7;?FIAzB33zEvo>UvA#oyr=*Uea07 zx@sLJcg0Vs&%MJ8QT#g6-d!J?A!9E)+OzmMIp;Qata|J7ea5C6Uh$n}V<&6MJLOgtD(IG#ZY3+dOlCpT9Y9FtNR z&x{**U7|NzqpIW;w^pkS&IO}1MZ7NqwscO~Dj9XuHIE<#r|kJ>HP_{QVgruv)O zkzv8qcy)tjnJhjd168XoAKLS-D{`9Z(HaQ5#<2*0^)0Z*9;j>8#U#^D*yKImS z_$twCn@lhByLJAqTKt;OKluUbZP_+CaksPGuuXii|LR*E6k=N(p0}Ggl`TBuC_`~s z_#dW0|I2}i8yQ~iuI0;(&*1VAkK<~>!UEmvDg?@TF}jjw#m5NQ zJ^dqfa1XNp8K!a0h8}Ui3m8;(nm=hoy}Y!rO4giJY>bF2wCHi|FZH%1mMv+Q5PTXl zE>noonDazmdQf*=^ggu&)S6~KF`Z$%6-E*%s zIDa;+&U8?U-VNDAAVKM(!p`6g>7{e2ZbaXKk45&gl8=YXciYGZG$brbpld#m6NXU= z1Aba7Uqn%{;go9Wn8tuNNQ2Ul=fVU`@JZNwA+l2tD0^l<+#vE zHk21H_x)192%hKPr_bZ*v$_)`Coiq}JQRJlGnck9_1v2KpU?qIP7>H)KoQ2 zTr5UqRfU!{Q5EKtybHaD%ZwvTbkl+)lJRw7b9%$Q4uXohbV&B(q;jweEL3cm;0y9E zqlN`nhwvn8&deA3vb=(3fzse`S=jd*JOiDxzqb80Q1p0h(?_S3G$`5jYs~MF!z)cR zt)4hiHrke9pRpVfze05T;)xqzxRSIr4`>dVw&-bR^h3C5PqINxO(4FxZTTQzW3*7q zgP0yCn$~atm(3gRE0d*qZnM{%@7Ek{IDXV&U|B@n+v3p>*|U7gKP=vM#leTVF5^Ov zLxDrLE2b|b8BghRo3EdESwn}jAG)yUSuP4mhye0OY%^zkro}2BU$xNEy)kLrtEGoL zW-n;N6Lq+<%#JwUcZ#3V{ddpC-}p%G~ZRSQ4mYf*iRx3{TPE3gO0sB^ar5k2t&QT=o6p7LW$ zwr(A`WpbnZSO|UB63%O)&O9>s(P^mV#|~MQ%)AP4{jT?+5OYShf(z4loceCGKvt?` zdM6Hg1hH2W!dsE4;^Oin8_GTWlxccoC zq~lI|bj$HCm0)8A7R30t&?tgay~f$D6tUMk1gXC^HV1^!UCsN6iKd2%k~A)>*^Etf zsIXxD$`=*4*pX;?pe zV8wB8qR`63y>MwKTWD1vha`lwsYPQdp7e#38r^#t`Q5iaEZ-a}^>*!Xk_u=`Tz21# zhI^_tL;j2d(&VT^Nk=XUIxj0UZ&S7(Ftzn|dUB*P14A2t44i_4Dg}>fys(NI+fYx2 zxm{OqpU%_E8Y(*y>^|U9_bJTxOj=tx$0Ln1-fr5PT2CXHHj-@7)$1}U~flGLou zDTdoljJED8*y)x+r?f?!2l0Sf0^A%zhN}fU>{@I(kZ6)j29|xgA;tMxLNZ{~7o#F* z?C^)3u*~|ubH~SKI4;u6fQ;j6vAr!hv-v|{v3|qiHyAv6L0C|`(QBopn|LVT-iPH! zRb?}I=T_=7&~1*}DU*iusQ&qK4*4j^0`Ib*OO#7C5i&Y7syCq(%l&g|t;5Lwz07Ty7Y+DvfSFk7?U;|K;&pYZBct~yLzQl-Njz1~T+Ya%QOFpcK zCeifJZjHE;@t4tC#E&mh2UceaT0A)V^T|K2)79LkOHS-pvplk9C9woPu88-P&JLJt z#&XNK>OH|uSL{ohG_0>IK94E~;-Bt``Y{(daUB(M27%AZ!mX)#A{nK8L}eyxH6J&t z$7+$Kr+31T_P{{aqIV00QqyQ4X`KB|k>1@=mgVJ>00J1eT>7fw9df`#`?>_o7fuFp zu=|{iisMoFS$VWs)=+Aa?0?Ds{>pH8t1eZK^0RWae>Gix9`dt&and&FCVu{_eCZ>u zh-)APu7P6`c;9Y~p||5MqeH0^Q&waOc3CsE8f7U-Z#VXh%_X%jX;u55uEYIpE9Tz9 zHNXGb&B%d!pqLsTeek<@F^y2S5iLt7TZ-dMFI;|fYWBjzIcY=eP|yHf$LGg=0i#C~ zN@lak@xc!RXgPxN=+jv}e5r*+`5I>wj2m~PXdogfCw_?hPr`dk)y56g9v@IO0hg(W|FZ)X>X-az8Xypm>$N(Ff8I8Q?_DT>G~?ai>OgrXQ_|AefQv^#%3oEhb4A zLmA+TUyMfJmCOr{n;D9}TZ-ZX_EgFKy5GB=WQd!4pF1W{M{k@~S7?#)Of2*s4zZxz z8x4#2HWo}j>bLA!9C1*YbXDJ+(lG$K1=g7<>&03%bFTPNIBT z_BV0c;V^~sa2az|e9zvNJnE$`&ARPEnWm8Te$5fc29Cpnxz=k7%8R-Vgi9u=0}hb= ztMAZf1*%=DthT20s6z;Jr3v@OS)(I;e-PyjjG1ml-KxVY`RJpfecm0h_2|PsPnfkAI+ow5+n8k2=SdEW)Ks}_fu1C`+$iWjHd$h| ziXayX5I4VkU#as|Rv&T#tej-f*^7`5xDL+yb*sGQLkNJ1?S?G;)VgL3B~GGp3F)?D zTNQRsxT#DJxi(8n;cmTK`dkC#a+Vj7LEiWALZ_)oBgwEN+G7>fL?k=HAjC=|=^%Ix zu7j|bY6$_%SWC&pEqSZF4qv1B$Kh8^(PdLJB`v6zro@2QV}Ud2>FF7hDi%xRr1EV~itNj;trJDo53;;$+Q|By`ZG1DSXx#?~d(-Ze*E2~g*rfGSnaED4F_c2}-F2P{@M<>gmuh_?lV6() z3UruxH|=Ct4kf(5Y4}yDtdy`73LbiD$kZhLYl5*81S3)B`;B?7&BygF%BIvKNyAeR zDRLgUDA#v^q-TR-Cn-`XC1II#FaYs7mer&zJ42*M{C0gtRRwu{<`)1%KP(9kUAo2NdjMf`isJNR;E8D5iCbJt zpsIvkA$xKCqWl~6iYNCbjR6i5(+z;9HUyrekXKyTeu>)KcsU-%LjVDT+F*016K&Wt_~ASw=Fe+0V0 zzPaV+pD==B(0MCb4wBQijHCVt)I+pmZ9jlU?D31svFQE{RwH2&Jp~_2uO+7IAAL}y z(<+;K^Gx1izQ)~(J1k`)lcw{!8D(6kMhfaS@FryJh#qhu;VHc*g8zWNUf@HGPR5^L zIuP}qA6Bf(T?91msyQ+zP;~Uxso||h_3)=#)1rR_=J&APhJ*X0ICYhB-fT)(W?G$J;j-hEEi2zrRNwX? zQuP**A`bUo{#QJZcdAav=6izk=W%PA7gRQqicz}?LI^K^CEKsnCOE93x(MkO^xq3n zdTSOX$JgOUy0j7B*&p4g&d-t5oAwyz&_oO>#4r9ufY)#y{9%{aAV*)Q+{s)Bi?Sbf ztfK{{R9Tb)X1^NrA_KR-Xhl?)c|$*MmP(7xc!P&6HbESwMU6A*>yGLfO7z(!hKD_V zg&w*2K%-il9{|p0CE?XN{2hy%)WI9d^M)wDy`>#am1qL(tc_jWeK-^M!yXyK)pO`e z_f6Y*-!t`t-pv-)>KS=Gp1NXwjoFD!VZn|{FX4ND14G(7^rV}^V%)wEaurMAdS0FF z_zZkKgTumVLP0=s6O_$c1}jr`eYBu71!QA>eqM})bq>K2K&!YYWlsJNJ?hj#ylOGI zO{Z_$_b2xp#gUgo{Kx6O?Wk-jC#V&ry267n;y92LH6<9kl8K1`+2Z-uSKtV=8a9v0SdhSVZ${-+c-XI#swfjll9WXE4jz<0WRMws)LB4V#lU@)_jovqn`KO+6`U}_#s85iD7nyDo&73EkD_|UG+j^j65fG@ zRi9x82sc*S*x`krZ1n8DkKhl3+Uo8B)m;S|=Fxn%M;;9JwhH{}(+$5)Fw;5j>LRZ? zc&Br^lhseL0>A0yJ;!-jIQJoDcK;8;braZd`7;L%q059!H`_Xv-LS*EpFSK%GP&oD zW+=lpUz>-Hej01Gll9!OC;MQCu8P~jf{VnAgOGNDaFz^htxYBni`Z`TKhaYTiE#;^ zvp=#XnIfk61;^MI{&G;B+g<@LsjdkK9zdCeV?Rl9z!l6E`8_wc0`~rD`$09!7fcPW z@#+HSt{!!jllN~JZqhD7H1Hw8h9}B?u$lZv{@MQjj-YubmX8mGjFpa=IOScQ_Y@ym z{|)7$IJVUYVYEGs=wgAnU!PPFhbEQ(kN?rD$ps>#B|U;GztHtdZ$Z=j5vYi4Xxx0D ziSuDZxqI-o{}*pu0Q>*V0%dkqm#~lK^oYi}xg4MU5-~P^ z5rbR{UqlW?kdl`K#uPSnG6+J0vJaAAm>Ab^mrUN2z&mHIxSCy}${HS;+VO7|LnI5a ztqCs3VTfGcWvLI7d_LEW6gkxZ9$Pm5^ieM5BwBQ^mB&-Wn*c8jairR}n=lFuBM@Wm z^BjL|&r;u$d$xPs@j$g2xV=>{8}yM}enDs!j4^bh4ZFt$s_cgQ)7u#sYo=2abuypP1X2W?Bu>)L@GpR>;M@SFKOBK- zPjV>A0K5_}Mydu!ykeXw{h?A(2u}EqKvss2xV`K8DVW;Mp>71zU4z)Un)^pLl)%*P zo%DDNQyX6ci`EI5Fxp5)fcy8v$3^p+(o*k}dlP#-H4#6R6ttK3J&g3l$~7eNaa$9{ zD6ReQ*Sl&g$U1I%Y=7h}cmkW89gy)^BbsUW^Q(Jim(bdug_PA{wr*?K=NnHY5pub} zuW)&%u2Li{8|yox{@E?O1Pfya-u-Q%(0W1kyg#x_GD>S^zV6^NWYdHK5us;Qmw$B; zcKt!2JhIfXa9l!X|I+@P4j5p|r~C+*yO??LKYpZ^8$8Cl6+aP?j_Z9E-Js%`XsLwn z(}S@C&VQo@oPFN+4E#QCEYof@jXX!fO`)gY)N;DB?2pkF1F!9rX$-Q|yx@q`c-={| z>;UkMOzk%0yqGbU-);Bx5O_?@(go2Gx-)0B$KsUrWMYSBQef=RA9OtyQhuTO7WT;A z>o7g$ahG$~87?AX^_A8=yCAabPNLAh^b5#Rhk|9ZK5_g~rrjjw5byOMD8USrVlIF2 zmTU&Au}l%eAN4$tAj z%QPwwdgE3@NVxmjx1qcd$R}~H8v-bw6u*dH!RChrZ&kRuv)uxHzj!opn6c4PEFBiO z{idD-IkTB2F_>NB6Tt9yB*#C5@1;N`C3fi-f@LbpsZv4KJ#%}YQoCTDgF#we`_(~@ z7>BH`A!aq-Hif4^tj0Vzl@r?J8V+jefxASXe&x zdE^bc81h5pQM%shM^tgx-5bc;A&kM&3scc^Z79g>7LA)D%W*Cto#DXDynFnx>Cdo? zz+j@xF9yLriSu!Mf>G0Qaq^2W;>rib#8%J{t(Ez@u#rv3{!B^xc!Iw6{XjL>D1xRN$*G>TwsU=x`|Px#Iq%yKGca4|xA z9(M||V4)70H@2*n)rUQ;WJbvW1lyNA!fujbYWgw^`_CLG!F<&f;ytwObCqIkuE_m_2@*k`#o2JW_)}NxVU7sx& z-DCGiI$-uFe_inEsOxTA|HL6(@0*1VZ4QJW{0+R|0C`i$Vr)8`S|r@f187}qz+-+P z#vFK+LBn=#eZs$AW+zn9KFi#E-ZHZS63SY`p5pRTMzaT{RZmRg=;i!%qrSt*D5|#? zeWPmg>@T44-cK3iz!Cph4H*^K_lezhn&*+vu+|{CAx0D&dIc`^a-pNq_@O&N%Jy6y zy;<}49HLK0$pg>w;d&Lpqu=>81xT-djiKo8hxggU``;}5`8-7VB~xNyIiT3c+NY-b z+1ffIo5;u#^tKlyh*>TUE5~qQlU4lI%A@TZ+^P|cWIn2 z2tOgHa~*T^S;%JgJ?-4b(glU$*%6!1TF$W8Wt4ezT4Ty?Qtx_DtO!x`Rjo?oHhd{e zuKfgUnX|HFV7@%_c3WyVzFM$Jb@q!z5MW~7TNm*matJDW0X)Ver|0QvzXX>uihz$o#}Uv)l``q9DJhd=ht})yS1d>;&AC=_f(}}`CQ(w zPfq9pqgH2f@=-dkRLKI7zpj@lIIKya5@pM*iM5E8f}|g2UVB4C5V zMRuJxr<5CP`-;*R3PPl|ps987W5va!wT(Rl%dOpYSJ{-gv46tG%JQ<7s9CbY#tN(P zJg@NEFqAAlRI)jBIV3*uaeNX}tHHXCL+mx4Jd7ayV8TMsQ(O39s>4oRCpajKsMPXh zg$SQh_i}JDf2D@j%kRZbQk&C@MqiH_s+dtRA4ju`-I=3U$8wUoZ`0a{dSM8?z|ze7 z3FdK&dPY>nDNvFRmF>UUOph)9DPVl-N+80Hn$3LI47GU&AJf;19G8hW2v$LY@W zE|8HI!^n%XjhJi;YzM$&V0eqdJK<|PN;6sY*`iY}rF4rhNAp7$#-@w+U;7d;M`*HN z?l~ZH751TNB}6AdA71|cjXWcp2k zWny|w)0MRiVJ3%eTv%I)J@9_H@cdJjZ=l$=#`f6s=D-c?(J4G^79XOcwkIo%z5nrKiIeV$ob>UFIbkt^W<;ddjn?? z{WXx4WyAW2TSkxL!st49V7I5xfxo!`Uj zD|lAl*L@Xd710L0UHRwtnVsXJmWea}@gy)8mej1id1OPjg7{0xo-9fCf4r{- z=QDn^GjVOQ^gl1Gk(Gv6Pq`nWkD#CNx%*M2!#{Prhl=_$j_(lC>$g4B=K03?jM~s$ zjks$)Wl|&Y6bYBpQ2cICFz+;p8S3hzHc#O?==+a~OfcC>YkLkynTxfQUwoainw&+^ zia}FJr~hii)jm5X{vz1le4O$6Z7_m1!Rm1j+yZ5ZB7FoK-bf$n^f5!IOn*M2bclT@ z)=Q*`0bQwd8O?_(dBpm;Ia*E}0C1)CE)x%r5H`PmQjFeHhsz~*SXeN+I}a%yIrs2d zR^#Tf7tquh22W@5UM~sylQ1x)>c9C)`ECSv+}|5D8vpeT8diu~`fBep%w^m~cl*-1 zt+V7Pg!fuuTz##(^IVpDi4-i4qV(kAiiK*vV+YcJdhARa()xO;p?rosMmB5+PK`&8 zIC#Rp{Ar;G-JSb6tK-nN@#sm+T#oOeJ2^_8elx^VY7m8@gFo0{0LEAceU%8VkHFKz=R75y;z&!#J*GD4pfteLnZ&8cD^qHfhwnSAXQhGl1yO%p ztlF(zDH{+EAKnJYZH^Dj|I79hL69Pf%?A$ELe2i|wIY^@4H}Z$*Hji%?VjE6due|! z?Qg05-=GlwzNygr*G+}1DX?HaLs+m+a^``yb#M5WKG)#4p#RIt9GU~3YKG#Ur$`(T zuAa~6^vKWx!s+1Nr|1S$8-W7d6udk<`g8X8*W!767)I>0`*%?Nvc-MUDs&Zk$oG`tdED`Q^C%$J;VIfj zmph;8_#y=rY-6~jm4P!yhkTEI*I@ySIl=p#a!h^RYOkKMO`M6ZnUi*)kvck3o}%Y6 zyu!8h-x^KNpOPLymjTIk6Mgr7`cy2Ps%b$L2FozJSC4+n;FiI%#;YNc5dJ;c=Ezw5 zTGS6j*wP04d_HV&`#w_I>GfVD1`1ipywGm`^?K2&uNWo;&R$ z>RWM6hA+*V7MYVcIcDMA1OE~QR%SCfYDqn7%%XcNeg#XJj`KI8y|2f04aI6LH#VYt zp($o(?|!v}^MNNh-6ON?kqd1^t!@Vc@poUI-xdJe;orvf51?#ghCRQH>uoBjY2-cpZIQ6o5PH)8H0Gao`k^k#)SUn5b3J^=zgd}JiXnOzL-C)W2Y)|1 zOOeR$o6?5{0{fv&&%Ca?GCc_*iasQw@TE#45d|G0iu39t@PPH48G_HgatD%VT$QmJ*erM>!27KM!Z zY+^M(*@(3HGQOsycY8cq5o!2#A5bsw%os&l(4=4r%v}^Te9NGZSWkJF(dy_f=8T4K z*)!8qap*YoNLtDY*|6UO{v~t_nm+|Sdi18rQH$hcni#6Y#v%%BJMWb5HMWyBKi}A& zGQL+Hz*s5zmOs>?QBTjB1I`9_MDL+!g{*!=+*|{fpto8s` zaJ8!Rf$^N1TbP6R$L0l=Q9@1Z_ zyLgZ38SbvjXC{8uu|Rj@eQSiUzt7VDVQ1-gg6((i@^@NzE#oe<25`~*eZ}(oiiMGF z`yB)PPOu@@V!!>C-+s&g4~6jiiskne%Q}|dm+b!=@eAKr<@?-PGRdPR3%&g{d`=9+ z@F*1l3IqG2;gadnT%Gi0Lo@fwjjMeOa4uY)J^r^|HaYHrC)vj;u^gb9MoS34g_F8x@Md`Lh1u>*5DD*zXnMAd{p zWeyEUv8;PFzR% zn9o3U1h(e>)DPw}(a1AymebsU!LU!__i}f$V0W%PV}KQAwu4~cv*U&*Q<%>jN5J~t zZqs~$4`I~~_x|8!3pGs`V0`Cil{HdB4DdWgYoEPWHZuDG)j*ZGY3~(%nvOiA3}#t?*nw(Eraid4a01quha?z3zc2V{`WKHdr5Y=O?Z#ut%2<;6eC)@8^}f+`5u zO6YrG<|`tg_C5N=v+Q`*M+lC(p{|>?=DcN9m^^!oQ@(enTg3Z)<`%$vrnKnPmU?-x z*e+wMp;_4p(}3!c`YC>i!oQCaFH&Q1Ai9kqDSrfRfbnx{-&)UF1GuGY(?PY{c1BBP zPKd-ja+vW-&UBk-?($qT&h{hE{VLep=yXgfeKO}|31jXcH~$s%5`ioxH)Tq*jtbrB zC^@{@#G#C|w|%?i4NhB-sXwxQK8_y6gu3O(i|FOy39FHBevKy?IYL`e0@-kS>68=# z6`RwfeWZ(gpj}4qYV0Lj_)wQtEUsfZ&>8fIg%yjRgi}&wG;gZJoK0s3iln(ufzHe` z`abffabZkqNBrh>p>59feclQS)?+a#r#DW{-aQv4C^}*0QRHdlR7UdMYs^+q($}2X z7fakL-{lrDs$^*4?tXl!biOjuP>M*7hUx;GQDWg^>106BHVi?+WiixGzJ4cCMMVgFXudjqLdr=P^ zxdo`aWB;J?TmqzDln{!28+G+hjGyG#!lCr*Zl-;gSxNYyu?5R;~dKtml@lpZwo$-Ze7WsWYT?b`j5 zWHXb2ddL_Nq+wx1F>eqoL~Zv&Gao7p_WF+lWwaYk28Yda3-8=EAEk|Bmnn6dj&CA& zOeyb%9!RTq#`i%UGC@qxrc{8BJAV0Ra+L+$r{R0asq}%gUlhQkhz=Y$LI1W|@`G`U z=6aSkw%Yx9e1@z*nFkJ*fEuakVhW!som-@ze2Ye@+igXYqraTrM{>_VRpDq*;9Pf} ztl&qxoJ<@LoUg}0>REhaUp`x_nPtlb`K=|rb{)n+MXUZEn>G1K*_n&oc8$du1NRV4 z#nNGZ;#Q=kOIlk1y`-h`vY~~XUC{=nv{twwm~y*Peo2Nl;DvrR_~W7Xpr6e@z}pPy zXEUID*sM6$Iu=SM3vh(6)4&BD_T^@^ggIF-N7XnBj?IW9egovIvMdA~2JW^(MQ0VUxz7YDu5x=#WOl&;?goak4RoqvT_Y^`v0K za*y`D`_aY|Evy5oc!XFvb<~MCVWt&grUb_S7r?g^cey5PqUt8V_Mom z#L_ybPjf)o9}Ktwx+JM=knhc$J>9)DLD@$TN5?0!^%6YAbrj#v-tX=ppCnY)GCM5& zmv&x5Qidxm_)G|QQ1#R&o_1rKzRc0rcH!Noehh=E_7`+4*bLP^myEotwhq?t`Ln06 z=*Of$m7m@kb;94v_!cRNlEx^*SY@8EwCJN-%k`jnk4U{pwffDsv5bmA#Z4fWKwhkp z?EXpp?*eGp4FKW;GcGN$5ip(K<+C1udItJgSE}BW#=~>Pj=E>?r@<%cXK{~9^A*hV zt%1t|*>LQ&c-Y6M8h|bZ4$cX9sC{L@L;{x;)o#B&fq3S|xnUml6YU-oGm$K#Y(A|0d|?0|uSh&&U7oW<2)ulGHnk3o4pOO~@sw?P$x%;5zA8 zmkmLvf2*pz1>?Xv^N`}tsKHl63VO3cxlX)`H%YkrFFp3))<%R5uNKGY69#E&Kn|*{5$@|WUmTUD)3DA}Y zyE*tw7krtCt*tOxt0Vomkd3gu2xS8C%!Ss?q+iRWP)Pcd#Eo#O41>9ZB8TV(D)^>j zh03=PtYPg{^@E=nNJU>YT$0`mW5V!>B*GV*T4WX?SAtK4Jfq~vW}KAC@K>f3x(m?7P7Zm~}Q zv|7S7WGGzoou=0Ut#pATc_+u?diY%^0x;H`xiV$|k25nq42nvPz$}bErY|3Nz=*!6 z8?*egY~+z^)z&Eg8$+0?b%>_ehZH~ZTpP?HZ+N5#=BXB?x*xVg2&6zbGL6uHh!4-f zDfp*`HDs$)N9NewnY8_14CCeI0CY7A{D!zhhK#PdGHtROv>{pHEMUAkO7Nb{{*NX0NlL$8$# zW$-c*YGwd}oR@JFQ9xm7_6E+|Xjn;mt6 z)aAlERFZ;QS>q`v1qFW0C&m5P%Q&oSq7WfEl~IZV0|ia+eV{>@2TBi(3axOGz!pAH z2(cT3a$~IOi26IM&;?Jnbq7ejaP}l zE6YYF&FVgilyI`|UrJIal~02Tqn!4T3n3A@igJF#olc&;9d^{Y^F;bzntQ?`>gqyF zMb#|NGgwu=X10yW#EP9g`eG7uEIl76aoypdPabx#MY@;$y6NiuV8vSMd^<2vuhrl0 z>3XLpTaet^{66MURO$FH#9#3AS1Zz+{cdwYWx8&AC(gB@XmDJYt~*aV85U&0 zPmlT4N2Df{eL6XX=aLieHcj6i4Q0(2S}!Tw00o5>h&b1=)Cd&vO<3)8&JMf*_pc=JdS@MMr*+RRf$wfK9q=(=CHcVR?zFCb$luf z6+~(`kuF_{)O>)nRw|kV8_9v9S4&q>m%2*GToK@U@Ep%%`K$~(tai1>EFP!E5_a;&gGkJSVq`Y>XWd=Q$Vj0&CZyK z>@7K^vj|my_J4~i;5s;kCi&LBlm-;>Uglg)Bp7mYSv|uKyDOn4munlk|1BYmwqS!} zqc35Hy9??J7rRyi1_wEO&-yl%0F~h#QX8F(Puh5A_=%zSgb@@4Cm0k@r9|k^Nd-?`;lO;o?1eUYB?cOKl{YdMT_&mL&b>7Gtb?!>%` z8X9{=w<+c+a3z04vCrO?0&a=p-R!_E0h`em=30;I!v@Jn&O#aV5zBzOHo@<7Hggs~?U5UDYkGU#wr$=AP-KT2}J?hlY` z1$xK|=mb8Rp@c}iEBRC*+g>q?l zDn)gPEX}Q822?#a5GDO_kE$s9oL?ezQ%emsE93unIq@_>c$a-|8sxZ*M55RfES5@c z%U|gZUco*X6bCW^P$!J)_1VNWVv@8*mm!L4XPar#>y&tU@99eU9{axDuXR!-rDW^2 zvc=`1Ac4L4eT(7sCDJ%b@ULCW!YjCpy82=OHFwIzk1dmjzMUu5I28 zIo+7Bo+mvL3i92aFVk-sypS(yvUZ8y0La^+cT7ybNFKTc&Pl=%zC~ zK_iA{ZT$hIE{k30O|y3Ifl^Z@78&Y9>z!7l{HQHB%8nhDHy>f0VX~w+I2;F+cE|jF zI}pb1bU`5=1B28e@tJY?itVqKDMXnIcvS=txCZE-F%Oo%20NlT6vt0m4QzzQF;j3V zx6)@<6bcM|tESBP+s%CmqXY};WXE910NqM+_-${>@dd?3c27sY)crIw*ZRCcexi@l zybqa^D?q#C+z?Q%zCffjYFjzI+weX$K=XsAC^l- zyX~q(F*M?xk;uA`GlaTWk8ar$!xOp=1GMfA%+};LD?N9JzJ#4|%Mb8*QRtay=|?E) zM4E9}FiKw4cD7>uBFDyQoRe?gT!*5qL9VeW@NtJA)>m_W3U!U7bPBYupf1vlCm*OgNr)x8;NUz1e-@e4yI&yT zP2Z;hRn!{W(6Q`8Ku!EKnXp$!h1y($jym{t*Z`Hp@96=I(%XVi#LVzVr^!OsA`sEL z!aQ2ff&GD4=`Lio^R(;c6d|TfX1xoDt-@x*M~XCxR8q$qs~` zr9ymPWklSsPNTvqXRaW55p-wrH z=IfIlG~uw1pMZO2jX*@h(V#7bcfql`&!d08-}0x8@;O<(@I#?hvw}M|u~a%sGi&e> z-y=v1bQ(R54;Wu8n0MJ5w1g18DT$2{DRx4#i(|3$Z2u}XP=J9cX#Fc&#z#wJ$(wyo+%~Bu`R|J_JvD#Jh@lYzI75) zd?R`ooHkPsuwkVmEm;;oy})au2|1R)S8Fd7J~5zCZK}KT%K`CrNi?DI`%m%qCv~fG zDmPWr{YS&8i!%pEm#kjv3nB#gn zRJo?OqN>k5^zzNn^nYt~B3UaeSW(s(+9&N{oW0qLZF4{Lje0LWe$}2~toO!Xyg;W{!#if)R{x8`Ed%upU?#MIjZ|dPR-o?OiN#hB zle|+46NV-b^~m0zKDv%2LL5>>trt?Bin`+lSW)B#XGJ(Z z@9e+Q*%inB?jJ<(}xo(>ID=&8<(N6G_aoqCdV;a`=%9&4(kQ#+TaVUU@i#C$EPB%*!wJMJ_pEoa`D z{E+Nk=G4orO7{+W2n;?C=NnMhJn>)t<^n+ZQTYb;cFhp-d(y3N8+&oP>Cw^whfIAY zZV31A1kNKAbq!dN^Oso^b$5O7zk)W9bJ?fuLzSJ$tN;GYhx9R=UDtb#GbY4Z(j&vn zP(ku$y26J7{0GRYytdcJyQHsvqD6mvLDC1VoYc$iH0w+oT(RvhEFQgeet8-5OvM!O z`M|f8O}~6hyjbPr=v?0BK7oR#H$Lp)!YLEJAh|nvPr@&r@&lA19^BPh$3=g8+$JJc zkfv5hr!K{jmS1fRGnV*nbO*Oe*r7U`g*g_L4x#t73vso<$U0X+m)`f)%=0hBpcB$> zy!4k=i&ZVvH$xY|zB}K};T5nJ9$hyED>kD1)O~kWqWu@{Tg8_x-L64@)uOBH_3YKv z%$H^v+X3<)t9ju?DyvJp*m(W`^du9%A9Z1E9d@JufX)=IGgH6b998Rcgaam@7~y^b zc=qshWX$I{>SWSqi~wEk`!JHXxRbXgFoj9C4R#S-PONNB4qDFBQKU`&Nbzcu2;VYm z7C1}v#I5>!RmJpoC#`naoRB;*4PDjx`xnD|9vswqc`T#j6U1XCVid=_*UxG*5ZtS0I;>Ab&c0ql!rQ=d}@KZjKTn-re1 z)2hgHbdCs}dz2En_Z;nz8jxYT= ziQS+TTgY-|Y9jjUD9dFU?rskTSh;lM0(7}SJ75CC0bL&Wblf@}|C21d- z@|2GE=*;qNC_oRR{k?kJ^6J?n3m6BpDUpxWmwwb*%7Sk2U)q}8(6d4fSFDCIYiokW zlUxe+B0<0Smgs>#+)8Z4qj2><856Trr=^#Mr$cTKQi)t4UiJDnYRUZa6dpd(*z$yx zYi|^@;tmNbpj3z(*;nDgY-+*^Ah_{$-l|P_%IE{1+U44$X{}b!y{Mon6^|sjWJJBu z?um&4eR@#EZ4K+Y zUvLd81O(@tccD!^eW}KSLM}Akh4Gj%Uh#;QE#Echfh0_1*&QM^txgxhKwv$sZCnQU z9gN_k9BtFSRjvDOn2zSXWl%4}I6z3xU5+}546YeC`gbBt8;$s{eWAV8~YMbkc~ zn{P(-nntufNxcGwcu!sdyyfYmA)oh3bD%e0Llq%Sz({3f3^EK_lU?de#d~*PnDhf9 zB0JTk8huA$)HaWBL#3ftB%P<>4_oEYYC+S3xLLo8Dd7nUxBs!+);Mh;hZuf8OM^clEywb?%U(0D+RWqE7+@}6mr4PT;OI2!t}Nel{SgDj+acKBS=i|MqUI3QvD_~$&C{zi zAT1Xw7C(nUAy`n{v;M12*di=*`bx6$YXe%q~S}~NG?Az?MUFINR|5CqG;hh8_ zpItacyYG40GSVD5K`P13DotfuuN2*>rxg?RsiSE@O9&?dV|HGlVI{Bx(4BC;z!y_d zCB%y;nK;G8O*ukVyKu!)Ufkc9@C zw4j`kZI(gJO_$SGUrnq+HjMJGkKv~QhE9GO(Uw=M@mH@CTMP*#4t{-$&#O)H{X;=0 z5fA5GQ#%XkK9Ui`1&UBXOU1pwzoH(V4_bv}E{9QxCB9S_wdnjNmGLn7fLn_X{ajDe z=BYUMVLrkyN>e;#8HKdwQ5&It4j(IgQtr z+#+V+a?e(F3Tt<(s+}?}k4h)^q!-!xQ&op;-fR3B|Fjc+s^-^9hnu2(3rF3|LTkf~ z@LFLSImIg}`f@L9y!vQw+)j=8`wIo959+)Pe+wV&pLKY5yVz%o1wV)aT5_iElsD0& z7ioSxz+r*>y5-hS!HJr- zXOx$Wmw3rF!woMzw|TbRd`X#_>GCzSa-=#z2Rlqvz_n?7eP|J@o}iH|gV z+zJUxZaKskBVl+t0!dmH$G;V>R*<&)`I6c*+vpEimLGm3Fy;|(OuJp-{8~->p1@S9 zSpmK>IU*T_k2j(?P~&$KgZcs+oZw1K9qfA{XW7b?iR6Zc!=%Isj_b=Rrt?1=(s*ns z{}7a5TyUWx3$el$!zZ?bv8`zTWh-28{8~NOlijlpA|R?EV%qk4)xLc6Ls{F-Vdn6i zj|^)2u!)O4O>0yPxV4+!T2<_ZQ-+lS3oPpFJ8GBQ6qQyLr17hySIkh30L#TpcF?KT zKB17=%9DN&^eyWc*Y>JD3@5K7SzxjV)kTa-X5CIj)CmW=sk_;qftM7v7Z$av@Fd^2 zxnBaXbNF{tvilxgK~l?AgufZEVQCz5l^lJxfo@P{gX%^6+nYj0!5stlT^{@zw5XTjGK&7=>t2&-2WqX|@}NbCA$s1!qja=gY3aZ}KdWS$ zg8a1oMr~7{6n}b7@WSQvPFlcQWsF8CSs}&K{*dDB2KD8iVuF8uZA%`M>$4>B95N1^ ziXS{tQQaVvgs3t*Hn|)bRoU(zbL~jT>fL0wa=F9Y8Vj8$paI1;FrK?4SE7*4L2Z+Y zRvtojbQ2nVo*5!&%OL6=$%i|F{@&G-cpaO&4qibm9*$KV!OQMJ+j|W&YjD^@5Ah72 zz{StU6|Q=Il@kDwam&PXUHOZEN{?e+qOKsn^0M7XTvR-Dh_9%C(g0)ZpDP(G5K4dV z*XDx2(W1Wecdp7G?FgSBA(oo&di)zj0~YiAV!4`W0%l^e%_GRh@2mY4-%ruV$L%y- zPZCGRRRq2Jw%OOmA>B{qIhaJ?Op~*9&dyQ`4JK0Idq54s+zB7_?DALo{(ESG1sqgZ z)-K9tQa}0D&w5}SJWtV*g{M$xu|Grc*MLO00FRw~T6 zF$gq$I)Q5W@cQbKY^pN+z;n)7Dna@2%w_uk;BE znWh~Lz(jdN_ckgj4MqZtMCsh}_?(?#`VfB8Ml z%vGf}Y7`Tz)2L4LT%P|HF4*09|A#Mgr!W0>_yS6;*^QTMS5&)T0Z$E>x;65$L!;E+ zqKYAf9LVtd2@;SF*^_pjjK(aym1&K6fH&j<(%+qg55Y<_=)xB|l>F70^8(=r#uO#< zARm@Q9$?}_5_&-XKyFFt>k*&}G$fM)AFgJnw@*=5Q!9=tN!!u6;II9FYw&b3@7t7n zL1;z<<^f+aUjyxBvjuYd(s9S$e9+zmvfXs*Zi5)a_ZN~=0yXovBw_>#6$Njhz|+rE z*M>@}ul#QFo!q+^8MXAl%3{^fZ`^xlF!^#&^U!jgmn&5yTyT}P#1WWa+#;~|#Zr`4 zP4PD!ZQ9&uvxYm_L+%gz)it_jQqEr~4C&@YXLuZWE_q?3(r z^9TrDWKiCP4dNI}BcA!hWVwTUB%WO`#xLqQSCwZ-_V+@sJRO)j4|kKhq8m<24=)Zc zE8%`}RUC3b<1h2!R@#^AWo*d_;UO@8A*d;d8ZvX|qa?8w(#qAtbq&__xMB zwH@?0AW?O+F-gbjijEw7mHQ=W=M0h^M01ZNe%rwhvR^E>*d~PMf}r|W%Wh(gVU=lT zA%n7*&g4GKeE9b3kGss|3D1})#(|T;%e_z;dFQbYI@n*5cm1Ca-KDr(6wBTrF&etUSX6j=BB?VO~m8u42Dk1tF_qWqYP>AseW&EH4K zcrYayUr0l(O4Fids|68|`(jkat)m)rX8304z-aA;rTR4VDyB1M-Zp^#ct3xB{(9{l z?Kc*#PzUbg+6FX!i-}67kA;I`nXhM4A0wRnhrDI#n-0m}l0Q_TgS`O)Kem7B8ks39>5kNma>r)x`$H7 z0qk}RFsK$7 z*+xDPYBLUG(8M~isyJeKSMmI~d~jXuHY|G1b|p$or7qboGbZXh#~I}sigq3|^S}dd zYWN-6wFh{iknzI3l(A;`ciO&jO63Y@aLMSA4@3WS2(OIf#9XFiav<-Wx}p|}Xq@TG zp-lDFaoI8-DJj8lMC5oAuv61`@sj8H7c4>~?P!$oP>vA4k^}P(CDk-)=F0Lg2W8yh z3^^@Ya76KlQXQ#n9`s4`?3KLb7?LH*sPv}2I!}wn_;N8bVYru;3>jpWs2mDDEQD+f zq?7wRQlwU{Py@3%&JcdiCpN2}5F`=h*_o@4-zq3^RUE*L@0Ul>S1sz720i+$hk*xR zA+oswDe&qCbE1V|VYLyH6?jj{!`ziyeU-x01&!r4qi?fU(h_#|D0=wOT^dGV%ZW=m zcKO^cFDTwAq&6OGG7nyoM+5XG+t-t$JUvs=V2q*?`i?fm&ya3XzZTxi!RMvt(zLW` zv9ln9EZZ&K7efdhImKM8a?Iy6PUDS9z&BoKS;G&7ehm)4>t2{N5;Kh-1ezUYgM$XT z()(#K`3pY;6xzNTD|Nh;aM^j+;Vi(HxuE}dmyZuWtq<{$f?6N!3(%^ZDQ-%cGGLzSiXdCuS3Ru0Y1UT%Ky^H~ajc#hMvT zU=S|PYM*F_`~-5<6#V=<wXnx62#?;iT*qXz5sMhuj*y=te3+6Ip9-r1IXV0zyoDCF zFiM)?s3-#ZNw3}kvCLbH>wYvpg6i-}+EoyVY90aMZ5NseVPcl}{_&tp3O@3MU;S%J zw7vgyeuY9vcQD<~v}*z~&gz5;pLq#4RnFIA!VCa)PNdgLIqsk)OGqB;qc**#blo7WUuPes1A*alak6Z zJy+Hn28fv}fG{b-DNQPIC4%C$x0w5@?c-kbxOx_T}hu~a%-Nmnc%%|4?uzCmGamo&7Xdx z=X$}u8O^D1WuLD;YoggEKmv60yRE*{NFRRT9K~W5WK*`$~|7Wdl8O42Rq z*HWs6@IDpBHBD3 zN4xaTLj>%&(dy6<^yn$Gk6nbF(tS@O&QOR;^nJ=XwJl&2HTL^+1Y?0RPZOxAEWJ5r z(Kecw4_U$qC5}RnB@AV@*#7D8{ngA$>M`!oFuY{kO`1-{KfL>KD^BiG^eByz7RUinM(?Mmx^?escx5G%Ms1tjOmG`)0>Y|*&} zIPrm;#!(YN157KW?4rCIZQlNdKwk{8 za&R<+V{-XJ+A`L-J}8GYC>nUWj*&qb2(P@W*2x@T`UO)f)bPd5yzr{K73f)B4@D-v zPsh5`PuG!VWC#2kto)Al10JKc_u*<82L`_C;Re$b+#@I|D+?9sQB8$@g7=^@7P7uu+w}Zxxo-5Oc<)ryUU3l?m zmz<~n%JLPw82Ng@1inBecMrxF8Ow^A%N0FlTguvNh&nKkI9N4!Kd9(U0= z1r$Rp)#^lEQ4GwH&w!PtF>tq4c987){uX0755Z2#dl!WB0EAnt>1U0gSG+!=W*0t`x_R6Abt<(x$|^C$>9y@1mb`ovCt~6-j9b zk{UqAxceFvsgi$>Rym|T=ec|bz|fa=-rcdAl8v%*Ez(x5C5h=5oqe((-xP%eX1h&a z;j<`&MJaY7Ih^v~sW}6SJU!R#{LFfQ(vGF{Xdh)Nf|ivZZjQzz^U%i=5T=p8nI1%= z`w~@C4fiqXrBvDP7XtOp2~2MB2`e&sxNo=qeVd{Od-pg0kocu+6e`mc`>sCn|rhGr1-5{5kFczR4~5OM{oG`95XIg>biyrLRi5 z9T$C#m#1-N`dwXJ^wnBiU>6ZXX9h@AiH&!+B{%e8Jo~=YU5pdgXPHWl4jv}ze%o25 zO6srlZ1|3SIuwmSJ)cXi%@#G}KQfD+ud-@zs|faY9^@uAMC(Td5^Fua-JllWDm_Q> z7BBMI!}kf$3gfecG-JX8 zUjFBK+LsfD5j6W}H@uIkNF3^QB#sMkBF8F<9Y`#A6yC7pNEE#IV0J=DWYieP{*cLV zMBN{%F#n)E$C7o9a$3kZDx_L})l_o|@yDjg1z+SEh zw=DNv=-Y>R?qq&60pZL-=ugAJZWi#ZBwhOID?bF)&3 zE{UZG3*+XCw%5waqHsiUvpwd1lC%HF7+rt69q@8`f55r2T1zFyptHH1v+lDC8qSn` z^5#eGDJL1NfWQk#98&X(7kc4qcR4wk`=3RV*w z@O6@%%Hn2y#3qh2qz__N(q0?J5knb~=`=!v;__i|OS{OhyXug8!?j(Hy)!jwrqLRg z*;q=r_2kB^efnP;gfpWtfa`q=X9is{_x#Di+6db&ENy4EmDJpL&*#|LUy=xVM?Hq} zvQO?gtp{5e5HLL$lK(LKYn|RAWrnJ`_gsW5<4KOCV2_KEwLovmU2opeK<0VaF5P{z zkF#VCLe2E_S)o0j_|P%K+EisC%t*9>pE(Iq%%k`@k-W0GHJ;$3qt5-%O+M1DMt-E8 znc$)1X(Ob!W$heI2i5&xF`dnLX5~`$V8#NJ@eTkI8E}n*Y9VvHJ?x)Xj(F5`xKrG;$gbzhO9jKLYTRjRlnm9QN#AXz^zUoF zgFy7!?r6=OP)~VYaXzr9;k~<|2>UoVik2@z$HjyhpRZd&Poi1vqT%Aw*G~H>K-a3= zI3WZ%pN{Qr(wF0H><)1QL1ayMV) zz+f9GXX>tRAuOx|(!va9myW*dAv`MJ&x32wYqvvx;5j0ra&@1KLglRgv&F3fyLU^P z3j@d;6anM3l(en%NxG#rc{jkS_Dip=@ECvNabnd+ z2QEaxvu3aDg%Yn#)>oN1G`m&{-#JOsmB+h_HfW0w*gc@ZQVKfgmIJ0SFtA8=uApQe zrf2YjMdn;vqlc_1t}#FGtFTEfH0+(_Zh7mEVgJm^oPXM zo0W>%Iyv6bU{+_4p6CV;yR?ij-RVx!RbM?T3xTdo)0GsirQIX;8EP-AnPCPEyHvz$ zTX~;-dsw_Qlt&-K$%#Cjm7JCTiXt{p&~qHDY7gJqD)$cz4FjUs68eU%QPEVX4Kqvj z&dit<(*#LG&Ut_o^VJb3pJ@10C&z7w59F>RbME1@v1^@tUhf9O5~5zu*KfC$l1ecP z1xt5+2*z;@@wy!WjYoX)A3@1FIcuxLew$lb>(Fr85Tc!147b8U_U&%4tpmpYe zE9e1iJbQBXsyxHl7~yg>^!<2&_Rdgl=n0018EOy%7&Hek;0kuJzBB;8rG-gdTUqQVTRF!Rha zfa9FW6dk@uq3{=!!~XF@CjAwCjNdKKXC z={!tJPCg}jkGTUkxPwK>W(4zk?Zv`QEW6j0N5U7*^hasBLi0VBlrDE4`hI|CutJ@a zf1lhvTY;+US#p=Ws*B^aH1Aq8SgEt9W&<=SqEg+SW)M2k+ptn ze4+UT?j2u7mvPHGp9`K+|EwGtbrbd_%B=lVs3SW-B7vSma=d`obX(p&cLtA=_!FnX z9bo{75(CG=@F<3uSbG^BrA#%?+tqz_oqe=t=TCSWNQ{hOZXoiWNwCMgxyi$4PJ4bf zV8#?df9B9GArq&n8CMv(0O;Z>1TO90XcNG!P3>>>jz_>9hqlE6#Dnwz_;b$2wXbCR zyI^5$)29?9zU=_K4b{TK=jB4EZi*}nnZi4NjlLOYM0~dY#V)=0?fuaV|K(JEG4-Vn zt7KK3YQ%!AV%2vKt7*XC(m!T^W~D1mPa;MwPBA+Ma2E1=rb6v{2{9tytE_3JkI|O^ zua*^NOnQhj-bpaHkbhuE?R-8Y?~!+ckXQv6m7`{AdM|vBbcdF@p5rRHUti^@+c%W4 zQ^oYqL_!D&;VXU8T{N>~G$QPesJ6$7er*7(AJ_4D*j&W4Q)XNtbd`NiQqDBOOX2ZZ zpfuRZJB~(;N!1o<2aL`5)DA|#FCFP%-Ng&mAa%{me-v=rrp|*NgRa(3XZjCWy?X5c zzN15XD(x?!nc=+7=CgG5#>O2aaj)Lh^4uw3xs@e+wJ-1!rXpqd=DG3|{e-Sjr`C1} zk$_gi>BJ!kn?7`YAJi5NBB#3Vw|k8N>W4^o6;8(-YJ_zqONVX=wF6j>4Ul$I1Imh@ zt$zhSa_o6A=y+%@rJ$ko)c{aa%6+iJBsqln85awDE*xD+=TRdo3{ZrobX~DFG zW74xHIg@Ygg+eEGK|D;?){qB?$SBy(T2lQ7aqYYJNV=rp4A5&&hdlzWbErQHd`y>A z4(XTAK~nIBo`*#}l`;_Yjca#@&-`=F2hCdW`KET#vq{-gXB>$Q7I1QupJ7H7ghXw# zkv_dY!~U_O)+!n8=f5nj3&yw(&iH%@sVzEJ?EXERVt?rjmCLytP)0w!@6SLqJZkpS zu<{Mdi%$j5py?mnN(PTmBjMcJK_}}sTdzI^?o;g53QeuRLfHI)Dr6k?mzxFXKFgvVYMc?e^>tj65k02&_s=MbT-Hv`DYK+|rEDWnG9kwO(?z&KF5t8qGp5|0+#KWpT8g4V$@xuIGoah;!Ybe+LetU^Q zanua;%k+$5!&JKK^x6BGbVz%cmVB?%0QC6%Z%(ZQ_E-6v6pN-V$7k<=UsSY@qri16;{bF;pg!p8mm)m0`>biXRHP91^N19_XW14n+H z`y`e51=rEuLATpOY91?J0=HNK0A>7nbRp4NlXjwNC`TO&%YIm6eE;LI^-VjTNjexb zGjlW5@buWqK-i38e{l4~lN^YoS(8K{g=LR-*+n3n^^Uao^CO>)=9&SV14hY_>%lNQYO6~gKO#i&@7cYu)MTMR4GDfTMxKpx@a zwE&v~&L6ob2dtf+?nwafU6cKw5w_^M{SdXEuO;U-keQ9oVM)0Ze@jqi6uQo+H`fKp7wMS!V7<7BT>SHwI-_kVz4n7;fuRB|Ln$pl0K2l!N$`U6+vTJL>8;l5vT$VE zCGwhiVFi&X+S|4VQZ%ZUpR5A)D?<>V>Y0KIZ2(%I2{&cHxJHRJ;mkF-s|TtzQ3|Gs ztR5fgube=ee5;hZd;>h>g;bM=rXoB*gO_+%atLU%2j$jf`ux^+t7}@SEQDf1Duq*! z5i}I2M~8IMSa95e7Oy9GfDPwW%m>EVt=n)BZVzumT`{l8LBkg2T&)*@5oDe4?l^e3 z8>nx*^*K-20MhW(_d_>$_X?~rM`y}?vtY0w&Pje?mdv@QT6jac^ql&u5C|%|04lM0 zmlgrvgH#_pwZ@5mLW)(4dpN9&H)v& zyEeQVvi!yYR9ZaEZ)*UIfzT2-Ocd8i>4#3v5@cYEL&Ic=?M(`}uz#AoU+#wPFLQ#| zMIP^dX#%*ENXigozuZ|L_J~8TM-s9y+#$ncuGin(7f9!+;qy~a59GT5D&v*X3h6+z zPLIzA<2aLnmaaP<8I^BUaj&Uy$&KS-*aP;|K5aQy6>{l^fSxJQXtTAZbKTaz=HtT~ z+J#U{`3~lb#<&Oa1@~yTCzw~M(eNGQ`(%I{5f)%Ul^$4lPa_zPK=`&U?Op}5MSW7TT zz@i+Bpq+4LwS*d-`T;b5KrNSDWD1Ao4#+e1cW>*3u6)~u?jPM$J9YFx{>d}Jn?u!a z!^o29-@Vo3AtO)ND6}@vCw$w^!>}Kf(uDMo=XYpR>-%0M-}i>Lcp2=w1_Abs1^XVc z??gin^@V#W*$co}d?3p9*vOi8FlS7DkJ{Rd8lhwRqUh0xWiv;-s)mBBv=tz#@(&Au zryREeDC8Es)ISQXlnP=DT?sTlbY;4|$Asy_I7K z2Q7KFpK%H&2F```n_rek(hvED5rYVy3hw$GV{no(&xcp{`k&2+Wzj_m?hWTq7ddO% z+-~|7;vMI2WNrocyW?J*bUP&X7UfJr1;GPBJ;ir1;O~kynW75(&IYv3BrWZj=A>LM zONl%9NXbW_#b~YzJ-QI1So7Nu^P|jtKmfCdCbBCHQ&tM>z`dvF8%ze>X1WHr1t5yU z176&SYreMLR&Yu}n2}?J%HaSil%Cnw_Ti^&dw4BNCLZ1aX(m3k$dNFs1`is6`E709 z)p7)f?~u2z#R&wZp3uN!T$!E4j)go$0Qp$}J+P}><$+l8ea$w2odV@tiXrxS}YWvAxaE<&V4V#WUE*|g4g%UqN>MC66zw>AEsgdUw3yqZfR?L9^cRq47-8Sp9AYfU zV@}kJVf(!ElmB3yfUAE#5VOoE81kL@!Bw|ZrV5?G8Yp&^0yf&2R@b}U&(uT!?7$}A zocgY>S2VNi${Ddn*E2r8bV}nZcm2&E%@EWG{opd5KjC9=lmFULCbI=%B@9 z->`64NRCUY00arJ`#`Y!+21a*5Mh9O{(zr#zn1KN@X>WUSn)J*l6A-K_aLQTyaHZe zT~+LooK8)E^VpK2V85>^%|)X^{t)ZaX}{CGXMM&#KYd*o9I)_365Sj4zg~9E$L#`Y zs%oPLI;_jvREHTa=4k{(xodD5A86gm$-I$AgQ6Ck*PQCMv<$S%-X`YgiZny z?es0$0Xdttgbo1ta=Y({v{uGlaEidG_(U@#v?tFZT&A$*&9rV=d~H0emr;RPc!O1y zD`-Ldz`sx$`hyx#LQeY%AT_DZeIZ{^&fwCbK>bKV_%iAwY?Ag zNMieH3jn_qoUsG=y;2x|PStzK)9UI5YiPO%ep~t!jAObly?dE{Z+y6xTCc0IU@_vs zShD|}TR`ymNhZ(N5;eY;wXfr&W=1U_pQWYR7l6Zntz3mngd@aC)+rI7%&$2(&u<4e z=C6XpE#(TLqU3uGk(#k1eX_xP-P;9HV2W-7m8C=Nsf*Ew@q0+Ux~bn?=_^0+L)_u3 zbIgww72#BjHv+f(ejO=+nP*4$gmmaHKAf_yt`xy8-(bV2RgyN0QcSxZM^8ql@mJ2l|7d7U-8yHh-V?Q1T5IinK1hNZ4I0s0gnV3t22C(ayb)%8pu^&%{ z?tSZOec?(<(88D2;notnjx==x1i92@IVi2oZLP)!m}(cE|&Vv@M_ zTmAaE*v>&n4P<-|87#-a%01A?nUgbXAOe%_*ZuYNRL9%^Z6q8v6EF)oG9h3B%YV!z z)2N@)t#olF4aXN$>)l!3B4$zxA{*q1SiOwX-~->C`8J9O?&17V?BJpo&!-=UPsY^* zetdCd4dK9SQCxTE+52^0bLPZ@v8e&)ZFXHedOa(R``g?)Y(D+~AhD0{-{=FGc^-N0PgC_BX~ z2A)6829BCFnxU~2K#{2

F^No__tdJ6>}iXn46#JbCT!K%oTRslJ~pUkh)UGZ+@aEF}k*LjZ%yU6({?lUy5#koTzq58qUta+ zlJycz%=AQ!K5K8i(HES?RW~XhS31<=` zNVIe}1hE)AcWTz^97URC)l*I}S_F~(#Z=it$R>o3HE%GZ^~I1!KX_g|T2GOgi;bNb z;*InKFzrYOKRD0OHz`PIV>3a?Vy*j{S6OP~eK16qW79uc)&)50z>(w9rk!$o^EZBP z;nu60TLs)@nx?3IH)RIq^upVE9Nhbk0f?;79(yk1Qs^))SC1nth_Aa~2>m@FZJh+S zvQ)A9bP%Ujhw^5O{CW8FgW}YT`YT1yXoq#QgW^kj->UJczJjNvy3e3aUS{iH#dAK% ziO7bP{R7zeaN+%H<)M7*1hpmf#P(w3pAW%5pwnS2w;u2(&K&6sLb-)!jgk3-Qw9&0t)Go zd7tFuIAL-iGkSxDud%)Iy)A+KbNra+)BJm@7N{@PHs~Wqixq*BY@IiPHfyV!W7~8(}7SHBnVAdA^7JFF#^Pq`eZ|+0o*!R}eIZ6G_1nhAa@M29 zo8P{!7V1*qZ)#cM*!JCsn{Twg|G$8E3+8|PUqDLmKgmf)lVJ_UK6+*D@tk{52VxD zfKk<(+5y)Zh z-ahqvB_qmd(fH>gN((!0{FDS+roe`&B9lmZdMp>If?`FJWf=Wkfy;N=W&bQY_gU+y z(m&SZ$N?a%c4m+)+%kSapI-E}{ANkb}SkfUh> z{WEq0l97HUv{9N8dhHe98c%)RJ8tNYfGBfJfF^a$HGH#MAmn}mtlL$6%?GLXmNYjzoZuW67m>49uEEc(rE;kdnGt$qc$qEE=O6QfleR3vsSBe zefGV8Lpa|dyi@r*RTAK^-LJ&V{Q!hhCIblwq5`kVldyNz>ami z6I%Y|B!XdSeOtB&{iCmS){HafHQ1RfTKn~1-gEjqSmFWts~3Oy)6_Ab^b&?mA>Z-_ zCscs;@4xfiS~kPlvrtF~oX&_hd%6kj`yb!4mb=#;PXU*IwsBwr$ZR%5A&sD%Y40U$ ztPtuEC}tpoZhn%`aF>by^1y3D`G{gB90+r+j1A z8NiR_YhIb0b=qh9Ux-Cq(##TVaqp4(3$F3qd(aSU#s_3lHwQz0Y~aKuuX&X>rp(dH zz(K&y*@e6DcR5-h;>cy{bQ=_%+t@THkiI$uot|{y$D+S4HUe)3moEJFru7Pr`2wra zHH=1z&(y6OqmK+luG$vaY4>@e4yzwrnjJbc;XAtrHRpHlR+Y=PHP7ni*1iD>@7#tz z^6wY7vb1hjbpNrx-M^{oM%Np|R-9n5BcVNYL=`t&msptyD}D~zkN%5EAS*&kJ2?5QX87G*hLDSXbWOm&0Pa?;(vBnvp`pfE)2sUzA zA?^S_e{S-F6l5y0>+Cdbnl|`q(L=@kt-lY$i($}=T1*E&2=5}Ng(@#b>I_W=GNan9 zo~uzajF!&I=6X@USK~CzGo(%UayFz_8!%ABLCpum!QTA9fsZ$e{TJWdVfYh(Wu|n@ zt;8k7q7pe+KL5jBb?2PduaBc6v8r{}SBvW@E)$eP%J-Xs&NHW(_dZ7;u^4cp(IY@3 z2j5S#XXrP-1nt#y-{#LhRASbnw3u!{D#%I>m$x&XtMu^?Z--9lyVO^$3kqXeHaeQCfYoJ|`KL%m5jd zAOzPyY9RYbCQHSTl=XRhhWS{7xo6cd%1M3tpZQ09%%2}wwR_K8HR9$+(n8^E%R|fg z!xiVuF;_!;n ztssbErjC5@Y-qYeI+7rp*Ui^~QL7o3_1KqZQE0m~{DCi=1GbOo-{BE%w}TCRdm1&%N?n1_otOJntYSC`JP`1OiB-LNQ+JWHIyier&2bZ_HU zAB}R+m4i7IjHyD|Kx*$`9WS6ev}^6A%?7Ouc%HMe)PwV1|7B^wrp|d*=|KOj)AXhvrF9z({^aw%Yzo`LsHbH)Q@GnD>(*Cv3 zTCfWcM^)a8=-eAU_8DIb?67)Zy;}t?&K>{qUzW5blpip;(hpqL#GP@^(_J8 zAmq0tD}`~;NL1CrXiGo(q2c|916`fo=49)l9(4rIol5QF|1T3r2LPw8T1Wq70>^j~ z0j*ltkn0P`7HZ6e`K1cnS~!6i0Iu%KRt)!=gEE|;P@bjby=RlLC~(zIR*2gYO4%MOc!qnQP=M$$L1oT;hwlj((bNmV)+f@m z0tUsv_pX5rS5&Faud#TgV@Hl&>$<-8h-Suf7X4!2Otr~(MeA(B-wqf&5&61nfmkq$ zbJ=}y?L0JMl&#cAvpCD!rr^`Y-2X#8o8D4jUFwo9P}r zW#|YVK-!H{FXVb)b2iTH{N=Ju#fB63d$l)GYr#aCgRH-ym4NN^(S z=80%N07P-{r+==|h8Xz_km;tvF_3aA0gzIWTwcB*-A_QG^he%+*7}R3Kw@S+A1df% z1u6D=X8U(+92>}t19}#k*`2n5q2B-!Oqy5%pMwLW2Tk8;+wj3;K|n4rP=G4dK|sy} z%eD%%MY9129pABu1Z|MA>BD@t;r!Fg5IgRkWj8xeHu5UoXm{R~{HbT1ufiVeVpp*`6Rt*N1HqaGi!g_x9KF8vbvt4r5*Q5dA78xrQp)8#TU8W@$R4t76E}S-ehkDU zoeRN-0;#sG>!%f}3@{HrshhufoDV&@`QE071OQXqkoWfD;vy8;GcDB?1KH)ke6~BO z6u7D9Pl*DZHX+UAUk}SOu&T=}1F2g=n*g{^mrt8*YHS~Xs&PYjlV(H#xFcSPDLjC@ z#lUSUQL=60tTV2FDaxkyJ>S&eK$?i@iKfpkn0z!~zpwWli_W3Xx|A5AR~% zDWFoAXL%=x0c=1ZQ6Lv$*Wy{ejtLkr0^3_skmAyp8~`IIHN0+;RZnwa7{b{d+A+UR z1f<8nN9Bchn$o8^3gDHDCy-v@KD8!!cg}9J?YS&H ze}YWLO0=|}CbfuaWy*U`57b%)LDakc>?JX?VA|^mpSbCqTClpTaZ)^#FJ8CZr}5HDP}5 zCkC(UEDskEUhPPb#yZj4{(AK0@2V-D*Q1La`!q)j2QX6eD~sSqRqhwilDvXW^HzwP znx?#t1IYB^V}@23!bFpb_To@FJ#{iZ-+zT{O;urIGDF(ZrAuG=K^W@ zrXZKR&z*&J#}Vnzn(_@{iapV_4``rnT<{DKExGq4d~-jb3Mu% zoPRqwGug?ThMU1Uk>k-?SPsn0^I%WJ@<89izS^a?4MM&l3P0yxR4fm@$$8Grr>!p? zuIUA6AZgI|_9lDNgWO%)HtFSb-;@G=#0A+OFm>%x%IgyuhST3B!H2)(7OYh zK&l2AgJ|g;Dp{2Rod^1J}q|HJHYb^QjFo2nDs5Cra<9DHYbOw#+vpDU8=; zx~Ri@1rV$Mq{-HZgG!WOMmQhH&s}FCZIDPcLcBY=LDV2ieTbXymP0(Q^s`1>;lpZ5 z77;l`c}7N^58oHY!9a146^}p>@)1xl2yQS9YA_dnaBO3{(Hz@cU%NakAosKS2yk|m zjXWiW$OlbbPG_So&03Wsi}7K7)KQZ5{YK?!L6)@v-cBI&s|sm}FKnq(Z}&xSXAuKH(Bbai zG?z?Vz{jrnqFOdt?gIN)QPZbE!IxJnN81Y@jWxg4RZsHM#n#uKqr~_!6C4bwlQ^1< zUL0q?7PdGhHeavB?~}RwwSeb8wMjdfvzSMGGFSEtr~zN|E7FcoNZPgPz2D^hr=b9t z>Co%qO_+aTDbX|g(<{+IG&+64v~#fi4>=mKYFuxRnzeqBqkMNvkFu&Xx0{ga>#qE} zk*BMzfrH*<@i6>wfK<>FOoJcPfcw+F3T3B!@Cwne{zLDW7MBNkuWFz(7I44s*T4BM zn&*R^-yTwz-aP)#@_>A_?+R$I>V*ia`v08o_1#ljlC?K73b#6o+lyTN1ZO9tc==E$ zIJ)-*-eHP?$8Jzym&uN(n~lB!@`eni;fzQOhf>YBn?Wm)hQb`SU1>>>mo+fE_v0An zekf=e_xWFq;2IRft`0Pd-4H2H5ZC!5qhKNZGOBzRc{ueKM5)hBQuoHnf^r4$p-Na+ z2*{Rb$gdb09(*?M5wg-YLTZK~d~~s8eN4?CWiHF#mk?F-i4S+jTV9Xfqy`evg);u2 zq&4jv1>c6a7Qmd!EBs?W(E2PNH1PovtMuu=9&&HMgmS!yIh%2i>w7}4O0KcN`C(to zDc_jIAVagX`UwHd$y-1+`zs2$BI*E$&P7Dugpb3|Gr zaFkF#Tfwjgm`uKO$iu4U@~9JXZm&TrjFP<^o>x$P_tw=c(PhpLBB4O|b8avP)+FGp z>zrX+4%}pLx*7W-ql_Ft1QDS2X~M_QZLQbHli8~Es2ZBNJ-B%o2eEJssM^(gBY$>w z_8T`wuK)Nj@~mAYGHPGg|7I_MV^_44I4tF*?{G_}X<*I!td)GS>{?$C9-?UD;i?#$ z&cdL`s1WI1u1OHJ?!;l&`|Sa8zYLgh()Y{YHrzU9><7M(6D-bOD;CA2mxxF;YkEBi zgxJhO{^;8ByH}310e{F|0|ixxHa;_HdGoojKy65w0_a}S;5z(2JYihGLdsj_WuLAzshF; z8$%lTfw|u@II*wDg2{aRN z2|5$;HeTcha5CoSA6fAN;Ao4bom5x!q!pm`0_64&c&zVD9Xx3-X4gWe;E|OmqPbH7f)G zSsvD5o1x8xYrqt+W!Y-eDUfX25esareUrOp2W)c!(+ba|jqtu74^U&;m&sAEoa6@V zyY#4R0w%zTK$gp`jkBPGx@beh4sVzqs{rrVdOBr8-QQmt9&(jWCKmko@KEE{BH-;) zKA?0ybM{`C(@TMgd4;$C3Q!*!B$nXS2<&N{T!v(nl60U=Hlq(`*Xf zunKJBgWA;9zoNW3fy=~!3FO-c&`NNSsTV+tl$L#+@e3Am@Hy;}XXKo!TcB$oLz(Yw z1-bJO1bgz#rH=!bHZS)w#hPLq9Zt=?%&3O7oF;O zEL$MUq&{zp9q@!;&$k(C!h{qqR5kwn{k`???{C}gF+yY1VZlpan)7|{_!Txc^o2vE zvr8rMA#lp4aR%!o7S~BDKETqWK*l~`()j#4fE$*`PqT!rkCMHn_b=|~Ea7V{8;Xu@ z`VJada8L%0e)0OtR4K{C{E6*4>@Sy>A{+vr;s-9~b2(ZhoDDMul4N0S0@~aKOuSl6 zWfIU3K*+!{(@-z~xb`RK?yjYmw-7PB09>Rc{~6fL2Q8?|0Zv9Nd3**qnr{dkO}~T~ zg8;4M+5?zmvv4FO#mJYadrRz literal 0 HcmV?d00001 diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py new file mode 100644 index 0000000000..83aa27dd3e --- /dev/null +++ b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py @@ -0,0 +1,596 @@ +""" +Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note. +""" + + +import phantom.rules as phantom +import json +from datetime import datetime, timedelta + + +@phantom.playbook_block() +def on_start(container): + phantom.debug('on_start() called') + + # call 'input_filter' block + input_filter(container=container) + + return + +@phantom.playbook_block() +def input_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("input_filter() called") + + ################################################################################ + # Filter to pass in a url, domain or ip to it's appropriate action + ################################################################################ + + # collect filtered artifact ids and results for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["playbook_input:url", "!=", ""] + ], + name="input_filter:condition_1", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + url_reputation(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + # collect filtered artifact ids and results for 'if' condition 2 + matched_artifacts_2, matched_results_2 = phantom.condition( + container=container, + conditions=[ + ["playbook_input:domain", "!=", ""] + ], + name="input_filter:condition_2", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_2 or matched_results_2: + domain_reputation(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_2, filtered_results=matched_results_2) + + # collect filtered artifact ids and results for 'if' condition 3 + matched_artifacts_3, matched_results_3 = phantom.condition( + container=container, + conditions=[ + ["playbook_input:ip", "!=", ""] + ], + name="input_filter:condition_3", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_3 or matched_results_3: + ip_reputation(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_3, filtered_results=matched_results_3) + + return + + +@phantom.playbook_block() +def url_reputation(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("url_reputation() called") + + # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + ################################################################################ + # Use Talos to get threat data on an url + ################################################################################ + + filtered_input_0_url = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_1:playbook_input:url"]) + + parameters = [] + + # build parameters list for 'url_reputation' call + for filtered_input_0_url_item in filtered_input_0_url: + if filtered_input_0_url_item[0] is not None: + parameters.append({ + "url": filtered_input_0_url_item[0], + }) + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.act("url reputation", parameters=parameters, name="url_reputation", assets=["cisco_talos_intelligence"], callback=url_reputation_filter) + + return + + +@phantom.playbook_block() +def domain_reputation(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("domain_reputation() called") + + # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + ################################################################################ + # Use Talos to get threat data on a domain + ################################################################################ + + filtered_input_0_domain = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_2:playbook_input:domain"]) + + parameters = [] + + # build parameters list for 'domain_reputation' call + for filtered_input_0_domain_item in filtered_input_0_domain: + if filtered_input_0_domain_item[0] is not None: + parameters.append({ + "domain": filtered_input_0_domain_item[0], + }) + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.act("domain reputation", parameters=parameters, name="domain_reputation", assets=["cisco_talos_intelligence"], callback=domain_reputation_filter) + + return + + +@phantom.playbook_block() +def ip_reputation(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("ip_reputation() called") + + # phantom.debug('Action: {0} {1}'.format(action['name'], ('SUCCEEDED' if success else 'FAILED'))) + + ################################################################################ + # Use Talos to get threat data on an ip + ################################################################################ + + filtered_input_0_ip = phantom.collect2(container=container, datapath=["filtered-data:input_filter:condition_3:playbook_input:ip"]) + + parameters = [] + + # build parameters list for 'ip_reputation' call + for filtered_input_0_ip_item in filtered_input_0_ip: + if filtered_input_0_ip_item[0] is not None: + parameters.append({ + "ip": filtered_input_0_ip_item[0], + }) + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.act("ip reputation", parameters=parameters, name="ip_reputation", assets=["cisco_talos_intelligence"], callback=ip_reputation_filter) + + return + + +@phantom.playbook_block() +def url_reputation_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("url_reputation_filter() called") + + ################################################################################ + # Exclude failing url reputations + ################################################################################ + + # collect filtered artifact ids and results for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["url_reputation:action_result.status", "==", "success"] + ], + name="url_reputation_filter:condition_1", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + format_1(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + + +@phantom.playbook_block() +def domain_reputation_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("domain_reputation_filter() called") + + ################################################################################ + # Exclude failing domain reputations + ################################################################################ + + # collect filtered artifact ids and results for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["domain_reputation:action_result.status", "==", "success"] + ], + name="domain_reputation_filter:condition_1", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + format_2(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + + +@phantom.playbook_block() +def ip_reputation_filter(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("ip_reputation_filter() called") + + ################################################################################ + # Exclude failing ip reputations + ################################################################################ + + # collect filtered artifact ids and results for 'if' condition 1 + matched_artifacts_1, matched_results_1 = phantom.condition( + container=container, + conditions=[ + ["ip_reputation:action_result.status", "==", "success"] + ], + name="ip_reputation_filter:condition_1", + delimiter=None) + + # call connected blocks if filtered artifacts or results + if matched_artifacts_1 or matched_results_1: + format_3(action=action, success=success, container=container, results=results, handle=handle, filtered_artifacts=matched_artifacts_1, filtered_results=matched_results_1) + + return + + +@phantom.playbook_block() +def format_2(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("format_2() called") + + ################################################################################ + # Format output of domain threat data into an appropriate format for build_domain_output + # that generates observable objects. + ################################################################################ + + template = """SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%""" + + # parameter list for template variable replacement + parameters = [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ] + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.format(container=container, template=template, parameters=parameters, name="format_2") + + build_domain_output(container=container) + + return + + +@phantom.playbook_block() +def format_1(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("format_1() called") + + ################################################################################ + # Format output of url threat data into an appropriate format for build_url_output + # that generates observable objects. + ################################################################################ + + template = """SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%""" + + # parameter list for template variable replacement + parameters = [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ] + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.format(container=container, template=template, parameters=parameters, name="format_1") + + build_url_output(container=container) + + return + + +@phantom.playbook_block() +def format_3(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("format_3() called") + + ################################################################################ + # Format output of ip threat data into an appropriate format for build_ip_output + # that generates observable objects. + ################################################################################ + + template = """SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%""" + + # parameter list for template variable replacement + parameters = [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ] + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.format(container=container, template=template, parameters=parameters, name="format_3") + + build_ip_output(container=container) + + return + + +@phantom.playbook_block() +def build_url_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("build_url_output() called") + + ################################################################################ + # Generate an observable dictionary to output into the observables data path. + ################################################################################ + + filtered_result_0_data_url_reputation_filter = phantom.collect2(container=container, datapath=["filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable","filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level","filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories","filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP"]) + + filtered_result_0_data___observable = [item[0] for item in filtered_result_0_data_url_reputation_filter] + filtered_result_0_data___threat_level = [item[1] for item in filtered_result_0_data_url_reputation_filter] + filtered_result_0_data___threat_categories = [item[2] for item in filtered_result_0_data_url_reputation_filter] + filtered_result_0_data___aup = [item[3] for item in filtered_result_0_data_url_reputation_filter] + + build_url_output__observable_array = None + + ################################################################################ + ## Custom Code Start + ################################################################################ + + from urllib.parse import urlparse + build_url_output__observable_array = [] + + talos_to_score_mapping = {"unknown": "Unknown", "trusted": "Safe", "favorable": "Probably_Safe", "neutral": "May_not_be_Safe", "questionable": "Suspicious_or_Risky", "unstrusted": "Malicious"} + score_table = { + "Unkown": "0", + "Very_Safe": "1", + "Safe": "2", + "Probably_Safe": "3", + "Leans_Safe": "4", + "May_not_be_Safe": "5", + "Exercise_Caution": "6", + "Suspicious_or_Risky": "7", + "Possibly_Malicious": "8", + "Probably_Malicious": "9", + "Malicious": "10" + } + + for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup): + parsed_url = urlparse(url) + score = talos_to_score_mapping.get(threat_level.lower(), "") + observable_object = { + "value": url, + "type": "url", + "reputation": { + "threat_level": threat_level, + "threat_categories": threat_categories, + "aup_categories": aup, + "score": score, + "score_id": score_table.get(score, "") + }, + "attributes": { + "hostname": parsed_url.hostname, + "scheme": parsed_url.scheme + }, + "source": "Cisco Talos Intelligence", + } + if parsed_url.path: + observable_object['attributes']['path'] = parsed_url.path + if parsed_url.query: + observable_object['attributes']['query'] = parsed_url.query + if parsed_url.port: + observable_object['attributes']['port'] = parsed_url.port + + build_url_output__observable_array.append(observable_object) + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.save_run_data(key="build_url_output:observable_array", value=json.dumps(build_url_output__observable_array)) + + return + + +@phantom.playbook_block() +def build_domain_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("build_domain_output() called") + + ################################################################################ + # Generate an observable dictionary to output into the observables data path. + ################################################################################ + + filtered_result_0_data_domain_reputation_filter = phantom.collect2(container=container, datapath=["filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable","filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level","filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories","filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP"]) + + filtered_result_0_data___observable = [item[0] for item in filtered_result_0_data_domain_reputation_filter] + filtered_result_0_data___threat_level = [item[1] for item in filtered_result_0_data_domain_reputation_filter] + filtered_result_0_data___threat_categories = [item[2] for item in filtered_result_0_data_domain_reputation_filter] + filtered_result_0_data___aup = [item[3] for item in filtered_result_0_data_domain_reputation_filter] + + build_domain_output__observable_array = None + + ################################################################################ + ## Custom Code Start + ################################################################################ + + build_domain_output__observable_array = [] + + talos_to_score_mapping = {"unknown": "Unknown", "trusted": "Safe", "favorable": "Probably_Safe", "neutral": "May_not_be_Safe", "questionable": "Suspicious_or_Risky", "unstrusted": "Malicious"} + score_table = { + "Unkown": "0", + "Very_Safe": "1", + "Safe": "2", + "Probably_Safe": "3", + "Leans_Safe": "4", + "May_not_be_Safe": "5", + "Exercise_Caution": "6", + "Suspicious_or_Risky": "7", + "Possibly_Malicious": "8", + "Probably_Malicious": "9", + "Malicious": "10" + } + + for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup): + score = talos_to_score_mapping.get(threat_level.lower(), "") + observable_object = { + "value": domain, + "type": "domain", + "reputation": { + "threat_level": threat_level, + "threat_categories": threat_categories, + "aup_categories": aup, + "score": score, + "score_id": score_table.get(score, "") + }, + "source": "Cisco Talos Intelligence" + } + build_domain_output__observable_array.append(observable_object) + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.save_run_data(key="build_domain_output:observable_array", value=json.dumps(build_domain_output__observable_array)) + + return + + +@phantom.playbook_block() +def build_ip_output(action=None, success=None, container=None, results=None, handle=None, filtered_artifacts=None, filtered_results=None, custom_function=None, loop_state_json=None, **kwargs): + phantom.debug("build_ip_output() called") + + ################################################################################ + # Generate an observable dictionary to output into the observables data path. + ################################################################################ + + filtered_result_0_data_ip_reputation_filter = phantom.collect2(container=container, datapath=["filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable","filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level","filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories","filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP"]) + + filtered_result_0_data___observable = [item[0] for item in filtered_result_0_data_ip_reputation_filter] + filtered_result_0_data___threat_level = [item[1] for item in filtered_result_0_data_ip_reputation_filter] + filtered_result_0_data___threat_categories = [item[2] for item in filtered_result_0_data_ip_reputation_filter] + filtered_result_0_data___aup = [item[3] for item in filtered_result_0_data_ip_reputation_filter] + + build_ip_output__observable_array = None + + ################################################################################ + ## Custom Code Start + ################################################################################ + + import ipaddress + build_ip_output__observable_array = [] + + talos_to_score_mapping = {"unknown": "Unknown", "trusted": "Safe", "favorable": "Probably_Safe", "neutral": "May_not_be_Safe", "questionable": "Suspicious_or_Risky", "unstrusted": "Malicious"} + score_table = { + "Unkown": "0", + "Very_Safe": "1", + "Safe": "2", + "Probably_Safe": "3", + "Leans_Safe": "4", + "May_not_be_Safe": "5", + "Exercise_Caution": "6", + "Suspicious_or_Risky": "7", + "Possibly_Malicious": "8", + "Probably_Malicious": "9", + "Malicious": "10" + } + + for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup): + score = talos_to_score_mapping.get(threat_level.lower(), "") + observable_object = { + "value": ip, + "type": "ipv4", + "reputation": { + "threat_level": threat_level, + "threat_categories": threat_categories, + "aup_categories": aup, + "score": score, + "score_id": score_table.get(score, "") + }, + "source": "Cisco Talos Intelligence" + } + ip_addr = ipaddress.ip_address(ip) + if isinstance(ip_addr, ipaddress.IPv6Address): + observable_object["type"] = "ipv6" + + build_ip_output__observable_array.append(observable_object) + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.save_run_data(key="build_ip_output:observable_array", value=json.dumps(build_ip_output__observable_array)) + + return + + +@phantom.playbook_block() +def on_finish(container, summary): + phantom.debug("on_finish() called") + + format_1 = phantom.get_format_data(name="format_1") + format_2 = phantom.get_format_data(name="format_2") + format_3 = phantom.get_format_data(name="format_3") + build_url_output__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="build_url_output:observable_array")) != "" else "null") # pylint: disable=used-before-assignment + build_domain_output__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="build_domain_output:observable_array")) != "" else "null") # pylint: disable=used-before-assignment + build_ip_output__observable_array = json.loads(_ if (_ := phantom.get_run_data(key="build_ip_output:observable_array")) != "" else "null") # pylint: disable=used-before-assignment + + observable_combined_value = phantom.concatenate(build_url_output__observable_array, build_domain_output__observable_array, build_ip_output__observable_array) + markdown_report_combined_value = phantom.concatenate(format_1, format_2, format_3) + + output = { + "observable": observable_combined_value, + "markdown_report": markdown_report_combined_value, + } + + ################################################################################ + ## Custom Code Start + ################################################################################ + + # Write your custom code here... + + ################################################################################ + ## Custom Code End + ################################################################################ + + phantom.save_playbook_output_data(output=output) + + return \ No newline at end of file diff --git a/playbooks/cisco_talos_intelligence_identifier_reputation_analysis.yml b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml similarity index 100% rename from playbooks/cisco_talos_intelligence_identifier_reputation_analysis.yml rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml From 1e430e5cf4e388766736a1438715811dbbb9c82d Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 10:45:36 +0100 Subject: [PATCH 31/82] fix error with filter macros --- ..._and_sc_application.yml => windows_service_stop_attempt.yml} | 2 +- .../windows_suspicious_child_process_spawned_from_webserver.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) rename detections/endpoint/{windows_service_stop_via_net__and_sc_application.yml => windows_service_stop_attempt.yml} (98%) diff --git a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml b/detections/endpoint/windows_service_stop_attempt.yml similarity index 98% rename from detections/endpoint/windows_service_stop_via_net__and_sc_application.yml rename to detections/endpoint/windows_service_stop_attempt.yml index 093c38aa47..59c2e1cf7f 100644 --- a/detections/endpoint/windows_service_stop_via_net__and_sc_application.yml +++ b/detections/endpoint/windows_service_stop_attempt.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_net` OR `process_sc`) Processes.process="* stop *") OR Processes.process="*Stop-Service *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_via_net__and_sc_application_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_net` OR `process_sc`) Processes.process="* stop *") OR Processes.process="*Stop-Service *" by Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_stop_attempt_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Windows OS or software may stop and restart services due to some critical update. references: diff --git a/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml index eb4ad12a70..8f5d664169 100644 --- a/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml +++ b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml @@ -1,4 +1,4 @@ -name: Windows Suspicious Child Process Spawned From Web Server +name: Windows Suspicious Child Process Spawned From WebServer id: 22597426-6dbd-49bd-bcdc-4ec19857192f version: '6' date: '2025-01-13' From 51106278d0ca4b027940c875c70f8065aa8a0d60 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 10:51:42 +0100 Subject: [PATCH 32/82] fix additional issues with filter macros --- detections/deprecated/domain_group_discovery_with_net.yml | 2 +- detections/deprecated/net_localgroup_discovery.yml | 2 +- ...via_net.yml => windows_domain_group_discovery_via_net.yml} | 4 ++-- 3 files changed, 4 insertions(+), 4 deletions(-) rename detections/endpoint/{windows_group_discovery_via_net.yml => windows_domain_group_discovery_via_net.yml} (96%) diff --git a/detections/deprecated/domain_group_discovery_with_net.yml b/detections/deprecated/domain_group_discovery_with_net.yml index 1b1c2d1460..3044000b93 100644 --- a/detections/deprecated/domain_group_discovery_with_net.yml +++ b/detections/deprecated/domain_group_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2025-01-13' author: Mauricio Velazco, Splunk status: deprecated type: Hunting -description: This search has been deprecated in favour of the more generic analytic "Domain Group Discovery With Net". The following analytic identifies the execution of `net.exe` with command-line arguments used to query domain groups, specifically `group /domain`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain groups, which is a common step in Active Directory Discovery. If confirmed malicious, this behavior could allow attackers to gain insights into the domain structure, aiding in further attacks such as privilege escalation or lateral movement. +description: This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic identifies the execution of `net.exe` with command-line arguments used to query domain groups, specifically `group /domain`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant as it indicates potential reconnaissance efforts by adversaries to enumerate domain groups, which is a common step in Active Directory Discovery. If confirmed malicious, this behavior could allow attackers to gain insights into the domain structure, aiding in further attacks such as privilege escalation or lateral movement. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/deprecated/net_localgroup_discovery.yml b/detections/deprecated/net_localgroup_discovery.yml index dbf16c85fa..b0cd79f36d 100644 --- a/detections/deprecated/net_localgroup_discovery.yml +++ b/detections/deprecated/net_localgroup_discovery.yml @@ -5,7 +5,7 @@ date: '2025-01-13' author: Michael Haag, Splunk status: deprecated type: Hunting -description: This search has been deprecated in favour of the more generic analytic "Domain Group Discovery With Net". The following analytic detects the execution of the `net localgroup` command, which is used to enumerate local group memberships on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it can indicate an attacker is gathering information about local group memberships, potentially to identify privileged accounts. If confirmed malicious, this behavior could lead to further privilege escalation or lateral movement within the network. +description: This search has been deprecated in favour of the more generic analytic "c5c8e0f3-147a-43da-bf04-4cfaec27dc44". The following analytic detects the execution of the `net localgroup` command, which is used to enumerate local group memberships on a system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs that include command-line details. This activity is significant because it can indicate an attacker is gathering information about local group memberships, potentially to identify privileged accounts. If confirmed malicious, this behavior could lead to further privilege escalation or lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_domain_group_discovery_via_net.yml similarity index 96% rename from detections/endpoint/windows_group_discovery_via_net.yml rename to detections/endpoint/windows_domain_group_discovery_via_net.yml index 10cb8b78e2..b917407589 100644 --- a/detections/endpoint/windows_group_discovery_via_net.yml +++ b/detections/endpoint/windows_domain_group_discovery_via_net.yml @@ -1,4 +1,4 @@ -name: Domain Group Discovery With Net +name: Windows Domain Group Discovery Via Net id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 version: 1 date: '2025-01-13' @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*group* AND Processes.process=*/do*) AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*group* AND Processes.process=*/do*) AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_domain_group_discovery_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: From 04d10316f80578359e5ea93191e17373f8752b39 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 11:02:07 +0100 Subject: [PATCH 33/82] upgrade analytics version --- detections/endpoint/linux_auditd_add_user_account.yml | 4 ++-- detections/endpoint/linux_auditd_add_user_account_type.yml | 4 ++-- detections/endpoint/linux_auditd_at_application_execution.yml | 4 ++-- detections/endpoint/linux_auditd_auditd_service_stop.yml | 4 ++-- .../endpoint/linux_auditd_change_file_owner_to_root.yml | 4 ++-- ...nux_auditd_data_transfer_size_limits_via_split_syscall.yml | 4 ++-- detections/endpoint/linux_auditd_dd_file_overwrite.yml | 4 ++-- .../linux_auditd_disable_or_modify_system_firewall.yml | 4 ++-- detections/endpoint/linux_auditd_doas_conf_file_creation.yml | 4 ++-- detections/endpoint/linux_auditd_doas_tool_execution.yml | 4 ++-- .../endpoint/linux_auditd_edit_cron_table_parameter.yml | 4 ++-- ...ux_auditd_install_kernel_module_using_modprobe_utility.yml | 4 ++-- .../linux_auditd_kernel_module_using_rmmod_utility.yml | 4 ++-- .../endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml | 4 ++-- detections/endpoint/linux_auditd_osquery_service_stop.yml | 4 ++-- ...td_possible_access_or_modification_of_sshd_config_file.yml | 4 ++-- .../linux_auditd_possible_access_to_credential_files.yml | 4 ++-- .../endpoint/linux_auditd_possible_access_to_sudoers_file.yml | 4 ++-- .../endpoint/linux_auditd_preload_hijack_via_preload_file.yml | 4 ++-- detections/endpoint/linux_auditd_service_restarted.yml | 4 ++-- detections/endpoint/linux_auditd_service_started.yml | 4 ++-- .../endpoint/linux_auditd_setuid_using_chmod_utility.yml | 4 ++-- detections/endpoint/linux_auditd_shred_overwrite_command.yml | 4 ++-- detections/endpoint/linux_auditd_sudo_or_su_execution.yml | 4 ++-- detections/endpoint/linux_auditd_sysmon_service_stop.yml | 4 ++-- .../linux_auditd_system_network_configuration_discovery.yml | 4 ++-- .../linux_auditd_unix_shell_configuration_modification.yml | 4 ++-- detections/endpoint/linux_auditd_whoami_user_discovery.yml | 4 ++-- detections/endpoint/microsoft_defender_atp_alerts.yml | 4 ++-- detections/endpoint/microsoft_defender_incident_alerts.yml | 4 ++-- .../endpoint/print_spooler_failed_to_load_a_plug_in.yml | 4 ++-- .../endpoint/windows_domain_admin_impersonation_indicator.yml | 4 ++-- 32 files changed, 64 insertions(+), 64 deletions(-) diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index aca8ced3d0..5a3a149d50 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -1,7 +1,7 @@ name: Linux Auditd Add User Account id: aae66dc0-74b4-4807-b480-b35f8027abb4 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index 6080f61072..ae806eb40b 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -1,7 +1,7 @@ name: Linux Auditd Add User Account Type id: f8c325ea-506e-4105-8ccf-da1492e90115 -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index 63a79584b6..aebd078139 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -1,7 +1,7 @@ name: Linux Auditd At Application Execution id: 9f306e0a-1c36-469e-8892-968ca12470dd -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index 2f3a32c0b1..515e0c4417 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Auditd Service Stop id: 6cb9d0e1-eabe-41de-a11a-5efade354e9d -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 07c7501efb..89247b3e0a 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -1,7 +1,7 @@ name: Linux Auditd Change File Owner To Root id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90 -version: 3 -date: '2024-10-17' +version: 4 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index b1edc0205e..58925c0293 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -1,7 +1,7 @@ name: Linux Auditd Data Transfer Size Limits Via Split Syscall id: c03d4a49-cf9d-435b-86e9-c6f8c9b6c42e -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index 4ed51e4a3f..2c3e57ad31 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -1,7 +1,7 @@ name: Linux Auditd Dd File Overwrite id: d1b74420-4cea-4752-a123-9b40dfcca49a -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index 9a72aac6c5..9397655d75 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -1,7 +1,7 @@ name: Linux Auditd Disable Or Modify System Firewall id: 07052556-d4b5-4bae-89aa-cbdc1bb11250 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index d8366159cb..0e3c174dfc 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -1,7 +1,7 @@ name: Linux Auditd Doas Conf File Creation id: 61059783-574b-40d2-ac2f-69b898afd6b4 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index 72bec21b53..54af2e3220 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -1,7 +1,7 @@ name: Linux Auditd Doas Tool Execution id: 91b8ca78-f205-4826-a3ef-cd8d6b24e97b -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index 3369a4c80b..d97f39e47d 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -1,7 +1,7 @@ name: Linux Auditd Edit Cron Table Parameter id: f4bb7321-7e64-4d1e-b1aa-21f8b019a91f -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index 7bd5b274f9..0fc792ad0f 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Install Kernel Module Using Modprobe Utility id: 95165985-ace5-4d42-9c42-93a89a5af901 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index f401ae1c76..387d6a2b66 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Kernel Module Using Rmmod Utility id: 31810b7a-0abe-42be-a210-0dec8106afee -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index b018346985..e8b98b6ce7 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Nopasswd Entry In Sudoers File id: 651df959-ad17-4b73-a323-90cb96d5fa1b -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index 5ef5f252b7..a71971586d 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Osquery Service Stop id: 0c320fea-6e87-4b99-a884-74d09d4b655d -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index 1e6024027c..c583a1d8a2 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access Or Modification Of Sshd Config File id: acb3ea33-70f7-47aa-b335-643b3aebcb2f -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 3a4a2cfde7..a9a968eb44 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 6dfa906169..bb328b6fed 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Sudoers File id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 0392e6f344..174465cce2 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Preload Hijack Via Preload File id: c1b7abca-55cb-4a39-bdfb-e28c1c12745f -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml index 827bb36175..25f7969556 100644 --- a/detections/endpoint/linux_auditd_service_restarted.yml +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -1,7 +1,7 @@ name: Linux Auditd Service Restarted id: 8eb3e858-18d3-44a4-a514-52cfa39f154a -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 09f64c1243..82e6f41015 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -1,7 +1,7 @@ name: Linux Auditd Service Started id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml index bf1be4bd81..b299839343 100644 --- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -1,7 +1,7 @@ name: Linux Auditd Setuid Using Chmod Utility id: 8230c407-1b47-4d95-ac2e-718bd6381386 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml index 20e89b1760..76ad5761a6 100644 --- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -1,7 +1,7 @@ name: Linux Auditd Shred Overwrite Command id: ce2bde4d-a1d4-4452-8c87-98440e5adfb3 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index 7e6a5cadd3..bdde5358db 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -1,7 +1,7 @@ name: Linux Auditd Sudo Or Su Execution id: 817a5c89-5b92-4818-a22d-aa35e1361afe -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index f1c42a5312..ac9a5c1ba7 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -1,7 +1,7 @@ name: Linux Auditd Sysmon Service Stop id: 20901256-633a-40de-8753-7b88811a460f -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index 0ed6958042..202acd5902 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -1,7 +1,7 @@ name: Linux Auditd System Network Configuration Discovery id: 5db16825-81bd-4923-a8d6-d6a13a59832a -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 6957b46914..0132fb0852 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -1,7 +1,7 @@ name: Linux Auditd Unix Shell Configuration Modification id: 66f737c6-3f7f-46ed-8e9b-cc0e5bf01f04 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: TTP diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index ca49aa1428..f8fa35e89b 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -1,7 +1,7 @@ name: Linux Auditd Whoami User Discovery id: d1ff2e22-310d-446a-80b3-faedaa7b3b52 -version: 2 -date: '2024-09-30' +version: 3 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Anomaly diff --git a/detections/endpoint/microsoft_defender_atp_alerts.yml b/detections/endpoint/microsoft_defender_atp_alerts.yml index 7afd85785e..b01e3965c4 100644 --- a/detections/endpoint/microsoft_defender_atp_alerts.yml +++ b/detections/endpoint/microsoft_defender_atp_alerts.yml @@ -1,7 +1,7 @@ name: Microsoft Defender ATP Alerts id: 38f034ed-1598-46c8-95e8-14edf05fdf5d -version: 1 -date: '2024-10-30' +version: 2 +date: '2025-01-20' author: Bryan Pluta, Bhavin Patel, Splunk status: production type: TTP diff --git a/detections/endpoint/microsoft_defender_incident_alerts.yml b/detections/endpoint/microsoft_defender_incident_alerts.yml index 986beed0d1..bbf690276f 100644 --- a/detections/endpoint/microsoft_defender_incident_alerts.yml +++ b/detections/endpoint/microsoft_defender_incident_alerts.yml @@ -1,7 +1,7 @@ name: Microsoft Defender Incident Alerts id: 13435b55-afd8-46d4-9045-7d5457f430a5 -version: 1 -date: '2024-10-30' +version: 2 +date: '2025-01-20' author: Bryan Pluta, Bhavin Patel, Splunk status: production type: TTP diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 30eeab74ba..509c62f4b1 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -1,7 +1,7 @@ name: Print Spooler Failed to Load a Plug-in id: 1adc9548-da7c-11eb-8f13-acde48001122 -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-20' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index f2f62cc86d..1f4c9d8bfa 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -1,7 +1,7 @@ name: Windows Domain Admin Impersonation Indicator id: 10381f93-6d38-470a-9c30-d25478e3bd3f -version: '5' -date: '2024-11-28' +version: 6 +date: '2025-01-20' author: Mauricio Velazco, Splunk status: production type: TTP From 548deb0b4b9b93a7a38324799114873c8b3a7e5c Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 15:11:16 +0100 Subject: [PATCH 34/82] update logic to match tests --- ...covery_via_net.yml => windows_group_discovery_via_net.yml} | 4 ++-- .../endpoint/windows_network_connection_discovery_via_net.yml | 4 ++-- .../endpoint/windows_password_policy_discovery_with_net.yml | 4 ++-- .../windows_sensitive_registry_hive_dump_via_commandline.yml | 2 +- 4 files changed, 7 insertions(+), 7 deletions(-) rename detections/endpoint/{windows_domain_group_discovery_via_net.yml => windows_group_discovery_via_net.yml} (87%) diff --git a/detections/endpoint/windows_domain_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml similarity index 87% rename from detections/endpoint/windows_domain_group_discovery_via_net.yml rename to detections/endpoint/windows_group_discovery_via_net.yml index b917407589..f63eadc65a 100644 --- a/detections/endpoint/windows_domain_group_discovery_via_net.yml +++ b/detections/endpoint/windows_group_discovery_via_net.yml @@ -1,4 +1,4 @@ -name: Windows Domain Group Discovery Via Net +name: Windows Group Discovery Via Net id: c5c8e0f3-147a-43da-bf04-4cfaec27dc44 version: 1 date: '2025-01-13' @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*group* AND Processes.process=*/do*) AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_domain_group_discovery_via_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` Processes.process="*group*" AND NOT (Processes.process="*/add" OR Processes.process="*/delete") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_group_discovery_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: diff --git a/detections/endpoint/windows_network_connection_discovery_via_net.yml b/detections/endpoint/windows_network_connection_discovery_via_net.yml index 61e696275a..7f10332140 100644 --- a/detections/endpoint/windows_network_connection_discovery_via_net.yml +++ b/detections/endpoint/windows_network_connection_discovery_via_net.yml @@ -5,12 +5,12 @@ date: '2025-01-13' author: Mauricio Velazco, Splunk status: production type: Hunting -description: The following analytic identifies the execution of `net.exe` or `net1.exe` with command-line arguments used to list network connections on a compromised system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential network reconnaissance by adversaries or Red Teams, aiming to gather situational awareness and Active Directory information. If confirmed malicious, this behavior could allow attackers to map the network, identify critical assets, and plan further attacks, potentially leading to data exfiltration or lateral movement. +description: The following analytic identifies the execution of `net.exe` with command-line arguments used to list network connections on a compromised system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential network reconnaissance by adversaries or Red Teams, aiming to gather situational awareness and Active Directory information. If confirmed malicious, this behavior could allow attackers to map the network, identify critical assets, and plan further attacks, potentially leading to data exfiltration or lateral movement. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*use) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_connection_discovery_via_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe") AND (Processes.process=*use) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_connection_discovery_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: diff --git a/detections/endpoint/windows_password_policy_discovery_with_net.yml b/detections/endpoint/windows_password_policy_discovery_with_net.yml index d85bbd0440..e2e6de41f3 100644 --- a/detections/endpoint/windows_password_policy_discovery_with_net.yml +++ b/detections/endpoint/windows_password_policy_discovery_with_net.yml @@ -2,7 +2,7 @@ name: Windows Password Policy Discovery with Net id: 09336538-065a-11ec-8665-acde48001122 version: 6 date: '2025-01-13' -author: Teoderick Contreras, Mauricio Velazco, Splunk +author: Teoderick Contreras, Mauricio Velazco, Nasreddine Bencherchali, Splunk status: production type: Hunting description: The following analytic identifies the execution of `net.exe` with command line arguments aimed at obtaining the computer or domain password policy. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential reconnaissance efforts by adversaries to gather information about Active Directory password policies. If confirmed malicious, this behavior could allow attackers to understand password complexity requirements, aiding in brute-force or password-guessing attacks, ultimately compromising user accounts and gaining unauthorized access to the network. @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "*accounts" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_policy_discovery_with_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "*accounts*" AND Processes.process NOT IN ("*/FORCELOGOFF*", "*/MINPWLEN*", "*/MAXPWAGE*", "*/MINPWAGE*", "*/UNIQUEPW*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_policy_discovery_with_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 777938da61..97db28270b 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` AND (Processes.process=*save* OR Processes.process=*export*)) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND (Processes.process="*HKEY_LOCAL_MACHINE*" OR Processes.process="*HKLM*") AND (Processes.process="*\sam*" OR Processes.process="*\system*" OR Processes.process="*\security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` Processes.process IN ("*save*", "*export*")) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND Processes.process IN ("*HKEY_LOCAL_MACHINE*", "*HKLM*") AND Processes.process IN ("*\sam*", "*\system*", "*\security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: It is possible some agent based products will generate false positives. Filter as needed. references: From 0d976cfffe74113f81fb2baa212e518a9b5c5aca Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 16:42:07 +0100 Subject: [PATCH 35/82] additional updates and fixes --- ...work_configuration_discovery_activity.yml} | 20 +++++++++---------- ...te_local_administrator_account_via_net.yml | 2 +- ...s_network_connection_discovery_via_net.yml | 4 ++-- ...ows_network_share_interaction_via_net.yml} | 16 ++++++++------- ..._network_configuration_discovery_tools.yml | 13 ++---------- 5 files changed, 24 insertions(+), 31 deletions(-) rename detections/endpoint/{detect_processes_used_for_system_network_configuration_discovery.yml => potential_system_network_configuration_discovery_activity.yml} (82%) rename detections/endpoint/{windows_network_share_interaction_with_net.yml => windows_network_share_interaction_via_net.yml} (67%) diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml similarity index 82% rename from detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml rename to detections/endpoint/potential_system_network_configuration_discovery_activity.yml index 2c66b755db..8735dc9e4f 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml @@ -1,16 +1,16 @@ -name: Detect processes used for System Network Configuration Discovery +name: Potential System Network Configuration Discovery Activity id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 -version: 5 -date: '2024-09-30' +version: 6 +date: '2025-01-20' author: Bhavin Patel, Splunk status: production -type: TTP -description: The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This activity is significant as it may indicate an attacker attempting to map the network, which is a common precursor to lateral movement or further exploitation. If confirmed malicious, this behavior could allow an attacker to gain insights into the network topology, identify critical systems, and plan subsequent attacks, potentially leading to data exfiltration or system compromise. +type: Anomaly +description: The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This activity can be significant as it may indicate an attacker attempting to map the network, which is a common precursor to lateral movement or further exploitation. If confirmed malicious, this behavior could allow an attacker to gain insights into the network topology, identify critical systems, and plan subsequent attacks, potentially leading to data exfiltration or system compromise. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name Processes.parent_process_name Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name process parent_process parent_process_name eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter`' +search: '| tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user IN ("","unknown") by Processes.dest Processes.process_name Processes.parent_process_name Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name process parent_process parent_process_name eventcount | `potential_system_network_configuration_discovery_activity_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives. references: [] @@ -27,9 +27,9 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - confidence: 80 - impact: 40 - message: An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. + confidence: 50 + impact: 50 + message: An instance of $parent_process_name$ spawning multiple network discovery processes such as $process_name$ was identified on endpoint $dest$ by user $user$. mitre_attack_id: - T1016 observable: @@ -66,7 +66,7 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 32 + risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml index 118809b4c7..8d655f6725 100644 --- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process=*/add* AND (Processes.process IN ("*administrators*", "*administratoren*", "*administrateurs*", "*administrador*", "*amministratori*", "*administratorer*", "*Rendszergazda*", "*Администратор*", "*Administratör*") by Processes.process Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_create_local_administrator_account_via_net_filter`' +search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process values(parent_process_name) as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process=*/add* AND Processes.process IN ("*administrators*", "*administratoren*", "*administrateurs*", "*administrador*", "*amministratori*", "*administratorer*", "*Rendszergazda*", "*Администратор*", "*Administratör*") by Processes.process Processes.process_name Processes.parent_process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_create_local_administrator_account_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators often leverage net.exe to create admin accounts. references: [] diff --git a/detections/endpoint/windows_network_connection_discovery_via_net.yml b/detections/endpoint/windows_network_connection_discovery_via_net.yml index 7f10332140..cdba356391 100644 --- a/detections/endpoint/windows_network_connection_discovery_via_net.yml +++ b/detections/endpoint/windows_network_connection_discovery_via_net.yml @@ -5,12 +5,12 @@ date: '2025-01-13' author: Mauricio Velazco, Splunk status: production type: Hunting -description: The following analytic identifies the execution of `net.exe` with command-line arguments used to list network connections on a compromised system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it indicates potential network reconnaissance by adversaries or Red Teams, aiming to gather situational awareness and Active Directory information. If confirmed malicious, this behavior could allow attackers to map the network, identify critical assets, and plan further attacks, potentially leading to data exfiltration or lateral movement. +description: The following analytic identifies the execution of `net.exe` with command-line arguments used to list or display information about computer connections. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity can be significant as it indicates potential network reconnaissance by adversaries or Red Teams, aiming to gather situational awareness and Active Directory information. If confirmed malicious, this behavior could allow attackers to map the network, identify critical assets, and plan further attacks, potentially leading to data exfiltration or lateral movement. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe") AND (Processes.process=*use) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_connection_discovery_via_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (`process_net` OR (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe")) AND (Processes.process=*use) by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_connection_discovery_via_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: diff --git a/detections/endpoint/windows_network_share_interaction_with_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml similarity index 67% rename from detections/endpoint/windows_network_share_interaction_with_net.yml rename to detections/endpoint/windows_network_share_interaction_via_net.yml index e526666d9d..db23e8ba6e 100644 --- a/detections/endpoint/windows_network_share_interaction_with_net.yml +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -1,16 +1,18 @@ -name: Windows Network Share Interaction With Net +name: Windows Network Share Interaction Via Net id: 4dc3951f-b3f8-4f46-b412-76a483f72277 -version: 3 -date: '2024-11-26' +version: 4 +date: '2025-01-20' author: Dean Luxton status: production -type: TTP +type: Anomaly data_source: - Sysmon EventID 1 -description: This analytic detects network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) as user_bunit FROM datamodel=Endpoint.Processes WHERE `process_net` BY Processes.user Processes.dest Processes.process_exec Processes.parent_process_exec Processes.process Processes.parent_process | `drop_dm_object_name(Processes)` | regex process="net[\s\.ex1]+view|net[\s\.ex1]+share|net[\s\.ex1]+use\s" | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_share_interaction_with_net_filter`' +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +description: The following analytic identifies network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (`process_net` OR (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe")) AND Processes.process IN ("*use *", "*view *") BY Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_share_interaction_via_net_filter`' how_to_implement: The detection is based on data originating from either Endpoint Detection and Response (EDR) telemetry or EventCode 4688 with process command line logging enabled. These sources provide security-related telemetry from the endpoints. To implement this search, you must ingest logs that contain the process name, parent process, and complete command-line executions. These logs must be mapped to the Splunk Common Information Model (CIM) to normalize the field names capture the data within the datamodel schema. -known_false_positives: Unknown +known_false_positives: Administrators or power users may use this command. Additional filters needs to be applied. references: - https://attack.mitre.org/techniques/T1135/ drilldown_searches: diff --git a/macros/system_network_configuration_discovery_tools.yml b/macros/system_network_configuration_discovery_tools.yml index 3f869e3af2..245c383f2d 100644 --- a/macros/system_network_configuration_discovery_tools.yml +++ b/macros/system_network_configuration_discovery_tools.yml @@ -1,12 +1,3 @@ -definition: (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" - OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" - OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= - "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= - "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= - "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= - "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= - "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR - process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe") -description: This macro is a list of process that can be used to discover the network - configuration +definition: (process_name="arp.exe" OR process_name="dsquery.exe" OR process_name="hostname.exe" OR process_name="ipconfig.exe" OR process_name="nbstat.exe" OR process_name="net.exe" OR process_name="netsh.exe" OR process_name="nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name="qwinsta.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe") +description: This macro is a list of processes that can be used to discover the network configuration name: system_network_configuration_discovery_tools From ec6f2da84de77b92572362191b164cc628f8bfa4 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 16:45:15 +0100 Subject: [PATCH 36/82] Update windows_password_policy_discovery_with_net.yml --- .../endpoint/windows_password_policy_discovery_with_net.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_password_policy_discovery_with_net.yml b/detections/endpoint/windows_password_policy_discovery_with_net.yml index e2e6de41f3..1c79471ad6 100644 --- a/detections/endpoint/windows_password_policy_discovery_with_net.yml +++ b/detections/endpoint/windows_password_policy_discovery_with_net.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "*accounts*" AND Processes.process NOT IN ("*/FORCELOGOFF*", "*/MINPWLEN*", "*/MAXPWAGE*", "*/MINPWAGE*", "*/UNIQUEPW*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_policy_discovery_with_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process = "*accounts*" AND NOT Processes.process IN ("*/FORCELOGOFF*", "*/MINPWLEN*", "*/MAXPWAGE*", "*/MINPWAGE*", "*/UNIQUEPW*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_password_policy_discovery_with_net_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Administrators or power users may use this command for troubleshooting. references: From b3d58a6b4e301fd258318c3c7c29c5af575552f8 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 17:43:32 +0100 Subject: [PATCH 37/82] update to pass tests --- .../windows_common_abused_cmd_shell_risk_behavior.yml | 6 +++--- .../endpoint/windows_network_share_interaction_via_net.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml index b96b349845..43e057c70d 100644 --- a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml +++ b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml @@ -1,13 +1,13 @@ name: Windows Common Abused Cmd Shell Risk Behavior id: e99fcc4f-c6b0-4443-aa2a-e3c85126ec9a -version: 3 -date: '2024-09-30' +version: 4 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Correlation data_source: [] description: The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. This detection leverages the Command Line Interface (CLI) data from various sources to identify suspicious activities. This behavior is significant as it often indicates attempts to execute malicious commands, access sensitive data, install backdoors, or perform other nefarious actions. If confirmed malicious, attackers could gain unauthorized control, exfiltrate information, escalate privileges, or launch further attacks within the network, leading to severe compromise. -search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where source IN ("*Cmdline Tool Not Executed In CMD Shell*", "*Windows System Network Config Discovery Display DNS*", "*Local Account Discovery With Wmic*", "*Net Localgroup Discovery*", "*Create local admin accounts using net exe*", "*Local Account Discovery with Net*", "*Icacls Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections Discovery Netsh*", "*Network Connection Discovery With Arp*", "*Windows System Discovery Using ldap Nslookup*", "*Windows System Shutdown CommandLine*") by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 4 | `windows_common_abused_cmd_shell_risk_behavior_filter`' +search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime sum(All_Risk.calculated_risk_score) as risk_score, count(All_Risk.calculated_risk_score) as risk_event_count, values(All_Risk.annotations.mitre_attack.mitre_tactic_id) as annotations.mitre_attack.mitre_tactic_id, dc(All_Risk.annotations.mitre_attack.mitre_tactic_id) as mitre_tactic_id_count, values(All_Risk.annotations.mitre_attack.mitre_technique_id) as annotations.mitre_attack.mitre_technique_id, dc(All_Risk.annotations.mitre_attack.mitre_technique_id) as mitre_technique_id_count, values(All_Risk.tag) as tag, values(source) as source, dc(source) as source_count from datamodel=Risk.All_Risk where source IN ("*Windows Cmdline Tool Execution From Non-Shell Process*", "*Windows System Network Config Discovery Display DNS*", "*Local Account Discovery With Wmic*", "*Windows Group Discovery Via Net*", "*Windows Create Local Administrator Account Via Net*", "*Windows User Discovery Via Net*", "*Icacls Deny Command*", "*ICACLS Grant Command*", "*Windows Proxy Via Netsh*", "*Processes launching netsh*", "*Disabling Firewall with Netsh*", "*Windows System Network Connections Discovery Netsh*", "*Network Connection Discovery With Arp*", "*Windows System Discovery Using ldap Nslookup*", "*Windows System Shutdown CommandLine*") by All_Risk.risk_object All_Risk.risk_object_type All_Risk.annotations.mitre_attack.mitre_tactic | `drop_dm_object_name(All_Risk)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 4 | `windows_common_abused_cmd_shell_risk_behavior_filter`' how_to_implement: Splunk Enterprise Security is required to utilize this correlation. In addition, modify the source_count value to your environment. In our testing, a count of 4 or 5 was decent in a lab, but the number may need to be increased base on internal testing. In addition, based on false positives, modify any analytics to be anomaly and lower or increase risk based on organization importance. known_false_positives: False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers. references: diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml index db23e8ba6e..f8098110ef 100644 --- a/detections/endpoint/windows_network_share_interaction_via_net.yml +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -10,7 +10,7 @@ data_source: - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 description: The following analytic identifies network share discovery and collection activities performed on Windows systems using the Net command. Attackers often use network share discovery to identify accessible shared resources within a network, which can be a precursor to privilege escalation or data exfiltration. By monitoring Windows Event Logs for the usage of the Net command to list and interact with network shares, this detection helps identify potential reconnaissance and collection activities. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (`process_net` OR (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe")) AND Processes.process IN ("*use *", "*view *") BY Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_share_interaction_via_net_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes WHERE (`process_net` OR (Processes.process_name="net.exe" OR Processes.original_file_name="net.exe")) AND Processes.process IN ("*use *", "*view*") BY Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_share_interaction_via_net_filter`' how_to_implement: The detection is based on data originating from either Endpoint Detection and Response (EDR) telemetry or EventCode 4688 with process command line logging enabled. These sources provide security-related telemetry from the endpoints. To implement this search, you must ingest logs that contain the process name, parent process, and complete command-line executions. These logs must be mapped to the Splunk Common Information Model (CIM) to normalize the field names capture the data within the datamodel schema. known_false_positives: Administrators or power users may use this command. Additional filters needs to be applied. references: From 3452135c58e07eafb4e600fabf1c35bb386289b3 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 18:29:42 +0100 Subject: [PATCH 38/82] update more office analytics and others --- .../office_product_spawning_wmic.yml | 0 ...ffice_product_dropped_cab_or_inf_file.yml} | 38 ++++------------- ..._office_product_dropped_uncommon_file.yml} | 42 +++++-------------- ...s_office_product_loaded_mshtml_module.yml} | 10 ++--- ...s_office_product_loading_taskschd_dll.yml} | 18 ++++---- ...ndows_office_product_loading_vbe7_dll.yml} | 16 +++---- ...uct_spawned_child_process_for_download.yml | 2 +- macros/process_office_products.yml | 2 +- 8 files changed, 43 insertions(+), 85 deletions(-) rename detections/{endpoint => deprecated}/office_product_spawning_wmic.yml (100%) rename detections/endpoint/{office_product_writing_cab_or_inf.yml => windows_office_product_dropped_cab_or_inf_file.yml} (58%) rename detections/endpoint/{office_application_drop_executable.yml => windows_office_product_dropped_uncommon_file.yml} (53%) rename detections/endpoint/{mshtml_module_load_in_office_product.yml => windows_office_product_loaded_mshtml_module.yml} (80%) rename detections/endpoint/{office_document_creating_schedule_task.yml => windows_office_product_loading_taskschd_dll.yml} (78%) rename detections/endpoint/{office_document_executing_macro_code.yml => windows_office_product_loading_vbe7_dll.yml} (80%) diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/deprecated/office_product_spawning_wmic.yml similarity index 100% rename from detections/endpoint/office_product_spawning_wmic.yml rename to detections/deprecated/office_product_spawning_wmic.yml diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml similarity index 58% rename from detections/endpoint/office_product_writing_cab_or_inf.yml rename to detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index 936819f977..8610e49fab 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -1,38 +1,17 @@ -name: Office Product Writing cab or inf +name: Windows Office Product Dropped Cab or Inf File id: f48cd1d4-125a-11ec-a447-acde48001122 -version: '8' -date: '2024-11-28' +version: 9 +date: '2025-01-20' author: Michael Haag, Splunk status: production type: TTP -description: The following analytic detects Office products writing .cab or .inf files, - indicative of CVE-2021-40444 exploitation. It leverages the Endpoint.Processes and - Endpoint.Filesystem data models to identify Office applications creating these file - types. This activity is significant as it may signal an attempt to load malicious - ActiveX controls and download remote payloads, a known attack vector. If confirmed - malicious, this could lead to remote code execution, allowing attackers to gain - control over the affected system and potentially compromise sensitive data. +description: The following analytic detects Office products writing .cab or .inf files, indicative of CVE-2021-40444 exploitation. It leverages the Endpoint.Processes and Endpoint.Filesystem data models to identify Office applications creating these file types. This activity is significant as it may signal an attempt to load malicious ActiveX controls and download remote payloads, a known attack vector. If confirmed malicious, this could lead to remote code execution, allowing attackers to gain control over the affected system and potentially compromise sensitive data. data_source: -- Sysmon EventID 1 +- Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -- Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as - proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count - min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem - where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest - Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid - | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time - dest file_create_time file_name file_path process_name process_path process proc_guid] - | dedup file_create_time | table dest, process_name, process, file_create_time, - file_name, file_path, proc_guid | `office_product_writing_cab_or_inf_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` - node. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN `process_office_products` by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.cab", "*.inf") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid | `windows_office_product_dropped_cab_or_inf_file_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. @@ -66,8 +45,7 @@ tags: cve: - CVE-2021-40444 impact: 80 - message: An instance of $process_name$ was identified on $dest$ writing an inf or - cab file to this. This is not typical of $process_name$. + message: An instance of $process_name$ was identified on $dest$ writing a .inf or .cab file. This is uncommon behavior and require further investigation. mitre_attack_id: - T1566 - T1566.001 diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml similarity index 53% rename from detections/endpoint/office_application_drop_executable.yml rename to detections/endpoint/windows_office_product_dropped_uncommon_file.yml index 1f9bce4930..58ff81e65e 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -1,35 +1,15 @@ -name: Office Application Drop Executable +name: Windows Office Product Dropped Uncommon File id: 73ce70c4-146d-11ec-9184-acde48001122 -version: '7' -date: '2024-11-28' +version: 8 +date: '2025-01-20' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github status: production -type: TTP -description: The following analytic detects Microsoft Office applications dropping - or creating executables or scripts on a Windows OS. It leverages process creation - and file system events from the Endpoint data model to identify Office applications - like Word or Excel generating files with extensions such as .exe, .dll, or .ps1. - This behavior is significant as it is often associated with spear-phishing attacks - where malicious files are dropped to compromise the host. If confirmed malicious, - this activity could lead to code execution, privilege escalation, or persistent - access, posing a severe threat to the environment. +type: Anomaly +description: The following analytic detects Microsoft Office applications dropping or creating executables or scripts on a Windows OS. It leverages process creation and file system events from the Endpoint data model to identify Office applications like Word or Excel generating files with extensions such as ".exe", ".dll", or ".ps1". This behavior is significant as it is often associated with spear-phishing attacks where malicious files are dropped to compromise the host. If confirmed malicious, this activity could lead to code execution, privilege escalation, or persistent access, posing a severe threat to the environment. data_source: - Sysmon EventID 1 AND Sysmon EventID 11 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes - where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") - by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest - Processes.process_guid | `drop_dm_object_name(Processes)` |join process_guid, _time - [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") - by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name - Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` - | fields _time dest file_create_time file_name file_path process_name process_path - process process_guid] | dedup file_create_time | table dest, process_name, process, - file_create_time, file_name, file_path, process_guid | `office_application_drop_executable_filter`' -how_to_implement: To successfully implement this search, you need to be ingesting - logs with the process name, parent process, and command-line executions from your - endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_office_products` by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.dll", "*.exe", "*.js", "*.pif", "*.ps1", "*.scr", "*.vbe", "*.vbs") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process process_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, process_guid | `windows_office_product_dropped_uncommon_file_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. known_false_positives: office macro for automation may do this behavior references: - https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation @@ -59,9 +39,9 @@ tags: - AgentTesla - PlugX asset_type: Endpoint - confidence: 80 - impact: 80 - message: process $process_name$ drops a file $file_name$ in host $dest$ + confidence: 60 + impact: 60 + message: An instance of $process_name$ was identified on $dest$ writing the file $file_name$. This is uncommon behavior and require further investigation. mitre_attack_id: - T1566 - T1566.001 @@ -85,7 +65,7 @@ tags: - process_guid - dest - user_id - risk_score: 64 + risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml similarity index 80% rename from detections/endpoint/mshtml_module_load_in_office_product.yml rename to detections/endpoint/windows_office_product_loaded_mshtml_module.yml index adaaba6fd6..6b17ff86fd 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml @@ -1,14 +1,14 @@ -name: MSHTML Module Load in Office Product +name: Windows Office Product Loaded MSHTML Module id: 5f1c168e-118b-11ec-84ff-acde48001122 -version: 5 -date: '2024-09-30' +version: 6 +date: '2025-01-20' author: Michael Haag, Mauricio Velazco, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects the loading of the mshtml.dll module into an Office product, which is indicative of CVE-2021-40444 exploitation. It leverages Sysmon EventID 7 to monitor image loads by specific Office processes. This activity is significant because it can indicate an attempt to exploit a vulnerability in the MSHTML component via a malicious document. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to system compromise, data exfiltration, or further network penetration. data_source: - Sysmon EventID 7 -search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", "msaccess.exe","Graph.exe","winproj.exe") loaded_file_path IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by user_id, dest, process_name, loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' +search: '`sysmon` EventID=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") loaded_file_path IN ("*\\mshtml.dll", "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") | stats count min(_time) as firstTime max(_time) as lastTime by user_id, dest, process_name, loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loaded_mshtml_module_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process names and image loads from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: Limited false positives will be present, however, tune as necessary. Some applications may legitimately load mshtml.dll. references: diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml similarity index 78% rename from detections/endpoint/office_document_creating_schedule_task.yml rename to detections/endpoint/windows_office_product_loading_taskschd_dll.yml index 9c3c447078..242d4caaea 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml @@ -1,14 +1,14 @@ -name: Office Document Creating Schedule Task +name: Windows Office Product Loading Taskschd DLL id: cc8b7b74-9d0f-11eb-8342-acde48001122 -version: 8 -date: '2024-09-30' +version: 9 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic detects an Office document creating a scheduled task, either through a macro VBA API or by loading `taskschd.dll`. This detection leverages Sysmon EventCode 7 to identify when Office applications load the `taskschd.dll` file. This activity is significant as it is a common technique used by malicious macro malware to establish persistence or initiate beaconing. If confirmed malicious, this could allow an attacker to maintain persistence, execute arbitrary commands, or schedule future malicious activities, posing a significant threat to the environment. data_source: - Sysmon EventID 7 -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", "msaccess.exe") loaded_file_path = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime count by user_id, dest, process_name,loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`' +search: '`sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path = "*\\taskschd.dll" | stats min(_time) as firstTime max(_time) as lastTime count by user_id, dest, process_name,loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_taskschd_dll_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. known_false_positives: False positives may occur if legitimate office documents are creating scheduled tasks. Ensure to investigate the scheduled task and the command to be executed. If the task is benign, add the task name to the exclusion list. Some applications may legitimately load taskschd.dll. references: @@ -28,9 +28,9 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - confidence: 70 - impact: 70 - message: An Office document was identified creating a scheduled task on $dest$. Investigate further. + confidence: 50 + impact: 50 + message: $process_name$ was identified loading the taskschd.dll on $dest$. This could indicate a potential malicious macro being executed. Further analysis is required. mitre_attack_id: - T1566 - T1566.001 @@ -53,7 +53,7 @@ tags: - ProcessId - ProcessGuid - _time - risk_score: 49 + risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml similarity index 80% rename from detections/endpoint/office_document_executing_macro_code.yml rename to detections/endpoint/windows_office_product_loading_vbe7_dll.yml index 7cbe39d7e0..7486928eaa 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml @@ -1,14 +1,14 @@ -name: Office Document Executing Macro Code +name: Windows Office Product Loading VBE7 DLL id: b12c89bc-9d06-11eb-a592-acde48001122 -version: 7 -date: '2024-09-30' +version: 8 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production -type: TTP +type: Anomaly description: The following analytic identifies office documents executing macro code. It leverages Sysmon EventCode 7 to detect when processes like WINWORD.EXE or EXCEL.EXE load specific DLLs associated with macros (e.g., VBE7.DLL). This activity is significant because macros are a common attack vector for delivering malicious payloads, such as malware. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the system. Disabling macros by default is recommended to mitigate this risk. data_source: - Sysmon EventID 7 -search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") loaded_file_path IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(loaded_file) as loaded_file count by dest EventCode process_name process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' +search: '`sysmon` EventCode=7 process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") loaded_file_path IN ("*\\VBE7INTL.DLL", "*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) as firstTime max(_time) as lastTime values(loaded_file) as loaded_file count by dest EventCode process_name process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_loading_vbe7_dll_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Also be sure to include those monitored dll to your own sysmon config. known_false_positives: False positives may occur if legitimate office documents are executing macro code. Ensure to investigate the macro code and the command to be executed. If the macro code is benign, add the document name to the exclusion list. Some applications may legitimately load VBE7INTL.DLL, VBE7.DLL, or VBEUI.DLL. references: @@ -41,8 +41,8 @@ tags: - NjRAT asset_type: Endpoint confidence: 50 - impact: 70 - message: Office document executing a macro on $dest$ + impact: 50 + message: $process_name$ was identified loading $loaded_file_path$ on $dest$. This could indicate a potential malicious macro being executed. Further analysis is required. mitre_attack_id: - T1566 - T1566.001 @@ -65,7 +65,7 @@ tags: - ProcessId - ProcessGuid - _time - risk_score: 35 + risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml index 05cd8c0c25..1736227ef8 100644 --- a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml +++ b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_child_process_for_download_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_office_products_parent` Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name IN ("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_office_product_spawned_child_process_for_download_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: Default browser not in the filter list. references: diff --git a/macros/process_office_products.yml b/macros/process_office_products.yml index d161fca52c..1f3155d735 100644 --- a/macros/process_office_products.yml +++ b/macros/process_office_products.yml @@ -1,3 +1,3 @@ -definition: (Processes.process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe") OR Processes.original_file_name IN ("EQNEDT32.EXE", "Excel.exe", "Graph.exe", "MSACCESS.EXE", "MSPUB.EXE", "OneNote.exe", "OneNoteIm.exe", "OneNoteM.exe", "OUTLOOK.EXE", "POWERPNT.EXE", "VISIO.EXE", "WinProj.exe", "WinWord.exe")) +definition: (Processes.process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") OR Processes.original_file_name IN ("EQNEDT32.EXE", "Excel.exe", "Graph.exe", "MSACCESS.EXE", "MSPUB.EXE", "OneNote.exe", "OneNoteIm.exe", "OneNoteM.exe", "OUTLOOK.EXE", "POWERPNT.EXE", "VISIO.EXE", "WinProj.exe", "WinWord.exe")) description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ name: process_office_products \ No newline at end of file From 473b732972d6adfa34dca2e0b7d20fd1039464c2 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 18:30:36 +0100 Subject: [PATCH 39/82] Update office_product_spawning_wmic.yml --- detections/deprecated/office_product_spawning_wmic.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/deprecated/office_product_spawning_wmic.yml b/detections/deprecated/office_product_spawning_wmic.yml index 6f4941e74a..477df1d5cc 100644 --- a/detections/deprecated/office_product_spawning_wmic.yml +++ b/detections/deprecated/office_product_spawning_wmic.yml @@ -3,7 +3,7 @@ id: ffc236d6-a6c9-11eb-95f1-acde48001122 version: 10 date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic has been deprecated in favour of a more generic approach in "Windows Office Product Spawned Uncommon Process". The following analytic detects any Windows Office Product spawning `wmic.exe`, From 65cea954435bb07a3fdc426bb08f8a56cdb745d4 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 18:33:03 +0100 Subject: [PATCH 40/82] Update windows_sensitive_registry_hive_dump_via_commandline.yml --- .../windows_sensitive_registry_hive_dump_via_commandline.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 97db28270b..c24d7977a0 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -77,12 +77,12 @@ tags: risk_score: 56 security_domain: endpoint tests: -- name: True Positive Test +- name: True Positive Test - Sysmon attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog -- name: True Positive Test +- name: True Positive Test - CrowdStrike attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log source: crowdstrike From 9b97d31129e51113bf995b7fc3ddb09706c27182 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Mon, 20 Jan 2025 19:19:41 +0100 Subject: [PATCH 41/82] bug fix --- .../endpoint/windows_office_product_dropped_cab_or_inf_file.yml | 2 +- .../windows_sensitive_registry_hive_dump_via_commandline.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index 8610e49fab..00b394fcb1 100644 --- a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 AND Sysmon EventID 11 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name IN `process_office_products` by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.cab", "*.inf") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid | `windows_office_product_dropped_cab_or_inf_file_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where `process_office_products` by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.cab", "*.inf") by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time dest file_create_time file_name file_path process_name process_path process proc_guid] | dedup file_create_time | table dest, process_name, process, file_create_time, file_name, file_path, proc_guid | `windows_office_product_dropped_cab_or_inf_file_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. known_false_positives: The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index c24d7977a0..486b60664a 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -10,7 +10,7 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` Processes.process IN ("*save*", "*export*")) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND Processes.process IN ("*HKEY_LOCAL_MACHINE*", "*HKLM*") AND Processes.process IN ("*\sam*", "*\system*", "*\security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` Processes.process IN ("*save*", "*export*")) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND Processes.process IN ("*HKEY_LOCAL_MACHINE*", "*HKLM*") AND Processes.process IN ("*SAM*", "*System*", "*Security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: It is possible some agent based products will generate false positives. Filter as needed. references: From 480e29b27b4f8192423c44d7e110bfec678b4516 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 22 Jan 2025 12:12:08 +0100 Subject: [PATCH 42/82] remove fields --- .../excel_spawning_windows_script_host.yml | 30 ----------- .../linux_auditd_add_user_account.yml | 12 ----- .../linux_auditd_add_user_account_type.yml | 17 ------- .../linux_auditd_at_application_execution.yml | 17 ------- .../linux_auditd_auditd_service_stop.yml | 16 ------ .../linux_auditd_base64_decode_files.yml | 13 ----- ...linux_auditd_change_file_owner_to_root.yml | 12 ----- .../linux_auditd_clipboard_data_copy.yml | 13 ----- .../linux_auditd_data_destruction_command.yml | 13 ----- ...td_data_transfer_size_limits_via_split.yml | 13 ----- ...transfer_size_limits_via_split_syscall.yml | 17 ------- ..._database_file_and_directory_discovery.yml | 13 ----- .../linux_auditd_dd_file_overwrite.yml | 12 ----- ...ditd_disable_or_modify_system_firewall.yml | 16 ------ .../linux_auditd_doas_conf_file_creation.yml | 14 ------ .../linux_auditd_doas_tool_execution.yml | 17 ------- ...linux_auditd_edit_cron_table_parameter.yml | 17 ------- ...ux_auditd_file_and_directory_discovery.yml | 9 ---- ...le_permissions_modification_via_chattr.yml | 13 ----- ...ind_credentials_from_password_managers.yml | 13 ----- ..._find_credentials_from_password_stores.yml | 13 ----- .../linux_auditd_find_ssh_private_keys.yml | 13 ----- ...linux_auditd_hardware_addition_swapoff.yml | 13 ----- ..._hidden_files_and_directories_creation.yml | 13 ----- ...l_kernel_module_using_modprobe_utility.yml | 17 ------- ...ditd_kernel_module_using_rmmod_utility.yml | 17 ------- ..._auditd_nopasswd_entry_in_sudoers_file.yml | 12 ----- .../linux_auditd_osquery_service_stop.yml | 16 ------ ...ss_or_modification_of_sshd_config_file.yml | 14 ------ ...td_possible_access_to_credential_files.yml | 12 ----- ...auditd_possible_access_to_sudoers_file.yml | 14 ------ ...cronjob_entry_on_existing_cronjob_file.yml | 15 ------ ...ux_auditd_preload_hijack_library_calls.yml | 13 ----- ...auditd_preload_hijack_via_preload_file.yml | 14 ------ ...ivate_keys_and_certificate_enumeration.yml | 13 ----- .../linux_auditd_service_restarted.yml | 12 ----- .../endpoint/linux_auditd_service_started.yml | 12 ----- ...inux_auditd_setuid_using_chmod_utility.yml | 12 ----- ...nux_auditd_setuid_using_setcap_utility.yml | 13 ----- .../linux_auditd_shred_overwrite_command.yml | 12 ----- .../endpoint/linux_auditd_stop_services.yml | 16 ------ .../linux_auditd_sudo_or_su_execution.yml | 12 ----- .../linux_auditd_sysmon_service_stop.yml | 16 ------ ...system_network_configuration_discovery.yml | 17 ------- ..._unix_shell_configuration_modification.yml | 14 ------ ...inux_auditd_unload_module_via_modprobe.yml | 13 ----- ...tual_disk_file_and_directory_discovery.yml | 13 ----- .../linux_auditd_whoami_user_discovery.yml | 17 ------- ...hell_process___execution_policy_bypass.yml | 22 -------- .../microsoft_defender_atp_alerts.yml | 50 ------------------- .../microsoft_defender_incident_alerts.yml | 50 ------------------- ...twork_configuration_discovery_activity.yml | 34 ------------- ...ding_dotnet_into_memory_via_reflection.yml | 20 -------- ...print_spooler_failed_to_load_a_plug_in.yml | 15 ------ ...nstallation_with_suspicious_parameters.yml | 20 -------- ...ndows_attempt_to_stop_security_service.yml | 34 ------------- ...indows_bitlockertogo_process_execution.yml | 9 ---- ...ws_bitlockertogo_with_network_activity.yml | 5 -- ..._tool_execution_from_non_shell_process.yml | 34 ------------- ..._common_abused_cmd_shell_risk_behavior.yml | 16 ------ ...te_local_administrator_account_via_net.yml | 34 ------------- ...s_domain_admin_impersonation_indicator.yml | 16 ------ ...dows_esx_admins_group_creation_via_net.yml | 22 -------- ...windows_excessive_service_stop_attempt.yml | 26 ---------- .../windows_excessive_usage_of_net_app.yml | 30 ----------- .../windows_group_discovery_via_net.yml | 21 -------- ...ttp_network_communication_from_msiexec.yml | 33 ------------ ...s_via_set_command_from_uncommon_parent.yml | 22 -------- ...s_network_connection_discovery_via_net.yml | 21 -------- ...dows_network_share_interaction_via_net.yml | 21 -------- ...new_default_file_association_value_set.yml | 20 -------- ...office_product_dropped_cab_or_inf_file.yml | 21 -------- ...s_office_product_dropped_uncommon_file.yml | 20 -------- ...ws_office_product_loaded_mshtml_module.yml | 20 -------- ...ws_office_product_loading_taskschd_dll.yml | 19 ------- ...indows_office_product_loading_vbe7_dll.yml | 19 ------- ...uct_spawned_child_process_for_download.yml | 22 -------- ...windows_office_product_spawned_control.yml | 30 ----------- .../windows_office_product_spawned_msdt.yml | 22 -------- ...e_product_spawned_rundll32_with_no_dll.yml | 28 ----------- ...ffice_product_spawned_uncommon_process.yml | 35 ------------- ...ows_password_policy_discovery_with_net.yml | 27 ---------- ...dows_registry_entries_exported_via_reg.yml | 28 ----------- ...dows_registry_entries_restored_via_reg.yml | 28 ----------- ...ows_sensitive_group_discovery_with_net.yml | 21 -------- ...ive_registry_hive_dump_via_commandline.yml | 30 ----------- .../endpoint/windows_service_creation.yml | 17 ------- 87 files changed, 1647 deletions(-) diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index 50d7f1336b..25eb6d0890 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -58,43 +58,13 @@ tags: - Spearphishing Attachments - Compromised Windows Host asset_type: Endpoint - confidence: 100 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. mitre_attack_id: - T1003.002 - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - process_name - - process_id - - parent_process_name - - dest - - user - - parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 5a3a149d50..6c10c6f275 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -28,25 +28,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$] to add a user account. mitre_attack_id: - T1136.001 - T1136 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - proctitle - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index ae806eb40b..b058a0c9f4 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -29,30 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: New [$type$] event on host - [$dest$] to add a user account type. mitre_attack_id: - T1136 - T1136.001 - observable: - - name: dest - type: Hostname - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - exe - - pid - - hostname - - res - - UID - - type - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index aebd078139..0084dbce6d 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -31,30 +31,13 @@ tags: - Linux Living Off The Land - Compromised Linux Host asset_type: Endpoint - confidence: 30 - impact: 30 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to execute the "at" application. mitre_attack_id: - T1053.002 - T1053 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - comm - - exe - - SYSCALL - - UID - - ppid - - pid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index 515e0c4417..b3f8512259 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -29,28 +29,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A service event - [$type$] event occurred on host - [$dest$]. mitre_attack_id: - T1489 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - type - - pid - - UID - - comm - - exe - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index bdb33137ab..38f0533d96 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -30,25 +30,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$] to decode a file using base64. mitre_attack_id: - T1140 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 89247b3e0a..13784c73f7 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -30,25 +30,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$] to change a file owner to root. mitre_attack_id: - T1222.002 - T1222 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - proctitle - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index e844e3cc50..4b3ad20b66 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -28,25 +28,12 @@ tags: - Linux Living Off The Land - Compromised Linux Host asset_type: Endpoint - confidence: 40 - impact: 40 - message: A [$process_exec$] event occurred on host - [$dest$] to copy data from the clipboard. mitre_attack_id: - T1115 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 16 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index 3201e7e0e0..e69160ec5f 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -29,25 +29,12 @@ tags: - AwfulShred - Compromised Linux Host asset_type: Endpoint - confidence: 90 - impact: 100 - message: A [$process_exec$] event occurred on host - [$dest$] to destroy data. mitre_attack_id: - T1485 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 90 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index de934eb8a4..2e2c6a3e6e 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -29,25 +29,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 70 - impact: 70 - message: A [$process_exec$] event occurred on host - [$dest$] to split a file. mitre_attack_id: - T1030 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index 58925c0293..9c30d10fae 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -29,29 +29,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$] that limits the size of data transfer. mitre_attack_id: - T1030 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - comm - - exe - - SYSCALL - - UID - - ppid - - pid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index 60d8cb7835..ade8e0963c 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -30,25 +30,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$] to discover database files and directories. mitre_attack_id: - T1083 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index 2c3e57ad31..7582f3f830 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -29,24 +29,12 @@ tags: - Data Destruction - Compromised Linux Host asset_type: Endpoint - confidence: 90 - impact: 90 - message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1485 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - proctitle - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index 9397655d75..e9ebbd65c8 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -29,29 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A service event - [$type$] to disable or modify system firewall occurred on host - [$dest$] . mitre_attack_id: - T1562.004 - T1562 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - type - - pid - - UID - - comm - - exe - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 0e3c174dfc..06ac060b5a 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -29,27 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A [$type$] event occurred on host - [$dest$] to create a doas.conf file. mitre_attack_id: - T1548.003 - T1548 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - name - - nametype - - OGID - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index 54af2e3220..3e9f267e64 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -29,30 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 70 - impact: 70 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to execute the "doas" tool. mitre_attack_id: - T1548.003 - T1548 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - comm - - exe - - SYSCALL - - UID - - ppid - - pid - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index d97f39e47d..336e5f94d9 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -30,30 +30,13 @@ tags: - Linux Living Off The Land - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to edit the cron table. mitre_attack_id: - T1053.003 - T1053 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - comm - - exe - - SYSCALL - - UID - - ppid - - pid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index 4aed31144d..e41ce58104 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -30,16 +30,8 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$] to discover files and directories. mitre_attack_id: - T1083 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security @@ -48,7 +40,6 @@ tags: - _time - argc - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index a9bc8b21af..ef108ec994 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -29,26 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 70 - impact: 70 - message: A [$process_exec$] event occurred on host - [$dest$] to modify file permissions using the "chattr" command. mitre_attack_id: - T1222.002 - T1222 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index 81daf23272..7c3d0d5f96 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -30,26 +30,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$] to find credentials stored in password managers. mitre_attack_id: - T1555.005 - T1555 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 6dfab9fc46..52eaee55b9 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -30,26 +30,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$] to find credentials stored in password managers. mitre_attack_id: - T1555.005 - T1555 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index 23f64f41be..02d503e9d5 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -30,26 +30,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 70 - impact: 70 - message: A [$process_exec$] event occurred on host - [$dest$] to find SSH private keys. mitre_attack_id: - T1552.004 - T1552 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index 3c8f5b1bba..9753bdfd30 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -28,25 +28,12 @@ tags: - AwfulShred - Compromised Linux Host asset_type: Endpoint - confidence: 60 - impact: 60 - message: A [$process_exec$] event occurred on host - [$dest$] to disable the swapping of paging devices on a Linux system. mitre_attack_id: - T1200 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index 4a11ae5b48..b5db900508 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -30,25 +30,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$]. mitre_attack_id: - T1083 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index 0fc792ad0f..7be24b3b66 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -31,30 +31,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to install a Linux kernel module using the modprobe utility. mitre_attack_id: - T1547.006 - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - comm - - exe - - SYSCALL - - UID - - ppid - - pid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index 387d6a2b66..390e98bc6a 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -29,30 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 90 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to remove a Linux kernel module using the rmmod utility. mitre_attack_id: - T1547.006 - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - comm - - exe - - SYSCALL - - UID - - ppid - - pid - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index e8b98b6ce7..a07f3a6dd9 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -29,25 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$] to add NOPASSWD entry in sudoers file. mitre_attack_id: - T1548.003 - T1548 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - proctitle - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index a71971586d..28ef4f1cb1 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -29,28 +29,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A service event - [$type$] event occurred on host - [$dest$] to stop the osquery service. mitre_attack_id: - T1489 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - type - - pid - - UID - - comm - - exe - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index c583a1d8a2..783e1ce760 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -30,27 +30,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A [$type$] has been accessed/modified on host - [$dest$] to modify the sshd_config file. mitre_attack_id: - T1098.004 - T1098 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - name - - nametype - - OGID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index a9a968eb44..404c3c008d 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -29,25 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$] to access or dump the contents of /etc/passwd and /etc/shadow files. mitre_attack_id: - T1003.008 - T1003 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - proctitle - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index bb328b6fed..4e41d4d034 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -29,27 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A [$type$] has been accessed/modified on host - [$dest$] to access or modify the sudoers file. mitre_attack_id: - T1548.003 - T1548 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - name - - nametype - - OGID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 82bb125034..9f4c9fb5a8 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -43,28 +43,13 @@ tags: - Scheduled Tasks - Linux Persistence Techniques asset_type: Endpoint - confidence: 70 - impact: 70 - message: A [$type$] event has occurred on host - [$dest$] to append a cronjob entry - on an existing cronjob file. mitre_attack_id: - T1053.003 - T1053 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - name - - nametype - - OGID - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index f537d137dd..6eef14886f 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -28,26 +28,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 90 - impact: 90 - message: A [$process_exec$] event occurred on host - [$dest$] to hijack or hook library functions using the LD_PRELOAD environment variable. mitre_attack_id: - T1574.006 - T1574 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 174465cce2..47930b7dbc 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -29,27 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 90 - impact: 90 - message: A [$type$] event has occurred on host - [$dest$] to modify the preload file. mitre_attack_id: - T1574.006 - T1574 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - name - - nametype - - OGID - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml index b30b4049b2..208899c9ed 100644 --- a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml +++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml @@ -30,26 +30,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$] to find private keys. mitre_attack_id: - T1552.004 - T1552 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml index 25f7969556..5cf26907bf 100644 --- a/detections/endpoint/linux_auditd_service_restarted.yml +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -33,25 +33,13 @@ tags: - Gomir - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$] to restart or re-enable a service. mitre_attack_id: - T1053.006 - T1053 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - proctitle - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 82e6f41015..1eb2f52950 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -29,25 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A [$process_exec$] event occurred on host - [$dest$] to start or enable a service. mitre_attack_id: - T1569.002 - T1569 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - proctitle - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml index b299839343..0a5901105b 100644 --- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -29,25 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 90 - impact: 90 - message: A [$process_exec$] event occurred on host - [$dest$] to set the SUID or SGID bit on files using the chmod utility. mitre_attack_id: - T1548.001 - T1548 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - proctitle - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index 0f231adcdb..9a77024d34 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -28,26 +28,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 90 - impact: 90 - message: A [$process_exec$] event occurred on host - [$dest$] to set the SUID or SGID bit on files using the setcap utility. mitre_attack_id: - T1548.001 - T1548 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml index 76ad5761a6..6b4c425301 100644 --- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -32,24 +32,12 @@ tags: - Industroyer2 - Compromised Linux Host asset_type: Endpoint - confidence: 90 - impact: 90 - message: A [$process_exec$] event occurred on host - [$dest$] to overwrite files using the shred utility. mitre_attack_id: - T1485 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - proctitle - risk_score: 81 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 702f5b4a55..23004f47e1 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -30,28 +30,12 @@ tags: - AwfulShred - Compromised Linux Host asset_type: Endpoint - confidence: 30 - impact: 30 - message: A service event - [$type$] event occurred on host - [$dest$] to stop or disable a service. mitre_attack_id: - T1489 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - type - - pid - - UID - - comm - - exe - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index bdde5358db..a334c0aabd 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -28,25 +28,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$] to execute the sudo or su command. mitre_attack_id: - T1548.003 - T1548 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - proctitle - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index ac9a5c1ba7..42823d3bc6 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -29,28 +29,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A service event - [$type$] event occurred on host - [$dest$] to stop or disable the sysmon service. mitre_attack_id: - T1489 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - type - - pid - - UID - - comm - - exe - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index 202acd5902..23ed547ae0 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -29,29 +29,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to discover system network configuration. mitre_attack_id: - T1016 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - comm - - exe - - SYSCALL - - UID - - ppid - - pid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 0132fb0852..67d17b2f04 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -30,27 +30,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 80 - impact: 80 - message: A [$type$] event occurred on host - [$dest$] to modify the unix shell configuration file. mitre_attack_id: - T1546.004 - T1546 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - name - - nametype - - OGID - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index 352bdc7cf4..e2fea0b311 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -29,26 +29,13 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 70 - impact: 70 - message: A [$process_exec$] event occurred on host - [$dest$] to unload a kernel module via the modprobe command. mitre_attack_id: - T1547.006 - T1547 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 49 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index 282728f5e7..e3f63c6ec4 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -30,25 +30,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A [$process_exec$] event occurred on host - [$dest$] to discover virtual disk files and directories. mitre_attack_id: - T1083 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index f8fa35e89b..a016a2f848 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -30,29 +30,12 @@ tags: - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint - confidence: 50 - impact: 50 - message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to discover virtual disk files and directories. mitre_attack_id: - T1033 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - comm - - exe - - SYSCALL - - UID - - ppid - - pid - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index b1c621918f..2492906b66 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -32,35 +32,13 @@ tags: - AsyncRAT - Volt Typhoon asset_type: Endpoint - confidence: 60 - impact: 70 - message: PowerShell local execution policy bypass attempt on $dest$ mitre_attack_id: - T1059 - T1059.001 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 42 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/microsoft_defender_atp_alerts.yml b/detections/endpoint/microsoft_defender_atp_alerts.yml index b01e3965c4..ff2bb3142d 100644 --- a/detections/endpoint/microsoft_defender_atp_alerts.yml +++ b/detections/endpoint/microsoft_defender_atp_alerts.yml @@ -36,61 +36,11 @@ tags: - Critical Alerts asset_type: Endpoint atomic_guid: [] - confidence: 90 - impact: 90 - message: $severity$ alert for $src$ - $signature$ mitre_attack_id: [] - observable: - - name: src - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: file_name - type: File Name - role: - - Attacker - - name: process - type: Process Name - role: - - Attacker - - name: ip_address - type: IP Address - role: - - Attacker - - name: registry_key - type: Registry Key - role: - - Attacker - - name: url - type: URL String - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - entityType - - filePath - - processCommandLine - - ipAddress - - registryKey - - url - - fileName - - risk_score - - firstTime - - lastTime - - src - - severity - - annotations.mitre_attack - - signature - - user - risk_score: 81 security_domain: endpoint manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Setting these to manual test since otherwise we fail integration testing. The detection is also failing on unit-testing as some of the fields set in the observables are empty. tests: diff --git a/detections/endpoint/microsoft_defender_incident_alerts.yml b/detections/endpoint/microsoft_defender_incident_alerts.yml index bbf690276f..a25edb92d9 100644 --- a/detections/endpoint/microsoft_defender_incident_alerts.yml +++ b/detections/endpoint/microsoft_defender_incident_alerts.yml @@ -42,61 +42,11 @@ tags: - Critical Alerts asset_type: Endpoint atomic_guid: [] - confidence: 90 - impact: 90 - message: $severity$ alert for $dest$ - $signature$ mitre_attack_id: [] - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: file_name - type: File Name - role: - - Attacker - - name: process - type: Process Name - role: - - Attacker - - name: ip_address - type: IP Address - role: - - Attacker - - name: registry_key - type: Registry Key - role: - - Attacker - - name: url - type: URL String - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - entityType - - filePath - - processCommandLine - - ipAddress - - registryKey - - url - - fileName - - risk_score - - firstTime - - lastTime - - src - - severity - - annotations.mitre_attack.mitre_technique_id - - signature - - user - risk_score: 81 security_domain: endpoint manual_test: We are dynamically creating the risk_score field based on the severity of the alert in the SPL and that supersedes the risk score set in the detection. Setting these to manual test since otherwise we fail integration testing. The detection is also failing on unit-testing as some of the fields set in the observables are empty. tests: diff --git a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml index 8735dc9e4f..6cd7997756 100644 --- a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml +++ b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml @@ -27,46 +27,12 @@ tags: analytic_story: - Unusual Processes asset_type: Endpoint - confidence: 50 - impact: 50 - message: An instance of $parent_process_name$ spawning multiple network discovery processes such as $process_name$ was identified on endpoint $dest$ by user $user$. mitre_attack_id: - T1016 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index 44681b760d..b6d6b21dc1 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -35,33 +35,13 @@ tags: - Malicious PowerShell - Data Destruction asset_type: Endpoint - confidence: 80 - impact: 70 - message: A suspicious powershell script that contains calls to reflective class assembly command in $ScriptBlockText$ is potentially trying to load malicious .NET code in memory in host $Computer$ mitre_attack_id: - T1059 - T1059.001 - observable: - - name: Computer - type: Hostname - role: - - Victim - - name: UserID - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - ScriptBlockText - - Opcode - - Computer - - UserID - - EventCode - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 509c62f4b1..598dfc25f6 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -29,31 +29,16 @@ tags: analytic_story: - PrintNightmare CVE-2021-34527 asset_type: Endpoint - confidence: 90 cve: - CVE-2021-34527 - CVE-2021-1675 - impact: 80 - message: Suspicious printer spooler errors have occurred on endpoint $ComputerName$ with EventCode $EventCode$. mitre_attack_id: - T1547.012 - T1547 - observable: - - name: ComputerName - type: Hostname - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - OpCode - - EventCode - - ComputerName - - Message - risk_score: 72 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index b93fb7da28..9a524277f3 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -40,33 +40,13 @@ tags: - Windows Persistence Techniques - Compromised Windows Host asset_type: Endpoint - confidence: 90 - impact: 70 - message: A process $process_name$ that possible create a shim db silently in host - $dest$ mitre_attack_id: - T1546.011 - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.process_name - - Processes.parent_process_name - - Processes.dest - - Processes.user - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index 1083c18407..36347b3b34 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -34,47 +34,13 @@ tags: - Azorult - Trickbot asset_type: Endpoint - confidence: 80 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. mitre_attack_id: - T1562.001 - T1562 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_bitlockertogo_process_execution.yml b/detections/endpoint/windows_bitlockertogo_process_execution.yml index 61c3ece759..a6607a72a8 100644 --- a/detections/endpoint/windows_bitlockertogo_process_execution.yml +++ b/detections/endpoint/windows_bitlockertogo_process_execution.yml @@ -42,15 +42,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1218 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml index 697b12d58d..9be44cb329 100644 --- a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml +++ b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml @@ -38,11 +38,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1218 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml index 647d330d1f..bfea210231 100644 --- a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -37,47 +37,13 @@ tags: - CISA AA23-347A - Gozi Malware asset_type: Endpoint - confidence: 40 - impact: 40 - message: $process_name$ was spawned from an uncommon parent process $parent_process_name$ on $dest$. mitre_attack_id: - T1059 - T1059.007 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 16 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml index 43e057c70d..8e8aba3b57 100644 --- a/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml +++ b/detections/endpoint/windows_common_abused_cmd_shell_risk_behavior.yml @@ -36,9 +36,6 @@ tags: - CISA AA23-347A - Disabling Security Tools asset_type: Endpoint - confidence: 70 - impact: 70 - message: series of process commandline being abused by threat actor have been identified on $risk_object$ mitre_attack_id: - T1222 - T1049 @@ -46,23 +43,10 @@ tags: - T1529 - T1016 - T1059 - observable: - - name: risk_object - type: Hostname - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 49 - required_fields: - - _time - - All_Risk.analyticstories - - All_Risk.risk_object_type - - All_Risk.risk_object - - All_Risk.annotations.mitre_attack.mitre_tactic - - source security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml index 8d655f6725..90f25d28e9 100644 --- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -31,47 +31,13 @@ tags: - DarkGate Malware - CISA AA24-241A asset_type: Endpoint - confidence: 60 - impact: 50 - message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. mitre_attack_id: - T1136.001 - T1136 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 30 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index 1f4c9d8bfa..1bee496a19 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -65,28 +65,12 @@ tags: - Compromised Windows Host - Active Directory Privilege Escalation asset_type: Endpoint - confidence: 100 - impact: 80 - message: $TargetUserName$ may be impersonating a Domain Administrator through a - forged Kerberos ticket. mitre_attack_id: - T1558 - observable: - - name: TargetUserName - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 80 - required_fields: - - _time, - - EventCode - - LogonType - - TargetUserName - - GroupMembership security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index 61ff643051..b404ba054e 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -30,35 +30,13 @@ tags: analytic_story: - VMware ESXi AD Integration Authentication Bypass CVE-2024-37085 asset_type: Endpoint - confidence: 70 - impact: 80 - message: An attempt to create an "ESX Admins" group was detected on $dest$ by user $user$. mitre_attack_id: - T1136.002 - T1136.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.original_file_name risk_score: 56 security_domain: endpoint cve: diff --git a/detections/endpoint/windows_excessive_service_stop_attempt.yml b/detections/endpoint/windows_excessive_service_stop_attempt.yml index 2ae9713bcd..de83371e43 100644 --- a/detections/endpoint/windows_excessive_service_stop_attempt.yml +++ b/detections/endpoint/windows_excessive_service_stop_attempt.yml @@ -30,38 +30,12 @@ tags: - Ransomware - BlackByte Ransomware asset_type: Endpoint - confidence: 100 - impact: 80 - message: An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. mitre_attack_id: - T1489 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_excessive_usage_of_net_app.yml b/detections/endpoint/windows_excessive_usage_of_net_app.yml index 3cbb7b6a9d..6c507c45d5 100644 --- a/detections/endpoint/windows_excessive_usage_of_net_app.yml +++ b/detections/endpoint/windows_excessive_usage_of_net_app.yml @@ -34,42 +34,12 @@ tags: - Ransomware - Rhysida Ransomware asset_type: Endpoint - confidence: 70 - impact: 40 - message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$ mitre_attack_id: - T1531 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 28 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_group_discovery_via_net.yml b/detections/endpoint/windows_group_discovery_via_net.yml index f63eadc65a..b351dac9de 100644 --- a/detections/endpoint/windows_group_discovery_via_net.yml +++ b/detections/endpoint/windows_group_discovery_via_net.yml @@ -32,35 +32,14 @@ tags: - Windows Discovery Techniques - Azorult asset_type: Endpoint - confidence: 50 - impact: 30 - message: Local or domain group enumeration on $dest$ by $user$ mitre_attack_id: - T1069 - T1069.001 - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index 90fead6067..75bf669de1 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -27,45 +27,12 @@ tags: analytic_story: - Windows System Binary Proxy Execution MSIExec asset_type: Endpoint - confidence: 50 - impact: 50 - message: An instance of $process_name$ was identified on endpoint $dest$ contacting a remote destination $dest_ip$ on port $dest_port$ mitre_attack_id: - T1218.007 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process Name - role: - - Attacker - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.process_id - - Processes.process_name - - Processes.dest - - Processes.process_path - - Processes.process - - Processes.parent_process_name - - All_Traffic.process_id - - All_Traffic.dest - - All_Traffic.dest_port - - All_Traffic.dest_ip - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml index c2ca59a1d5..f83e86cb4c 100644 --- a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml +++ b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml @@ -28,34 +28,12 @@ tags: analytic_story: - Qakbot asset_type: Endpoint - confidence: 50 - impact: 50 - message: $parent_process_name$ Spawned $process_name$ with a commandline $process$ in $dest$ mitre_attack_id: - T1055 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_network_connection_discovery_via_net.yml b/detections/endpoint/windows_network_connection_discovery_via_net.yml index cdba356391..85a981ccaf 100644 --- a/detections/endpoint/windows_network_connection_discovery_via_net.yml +++ b/detections/endpoint/windows_network_connection_discovery_via_net.yml @@ -22,33 +22,12 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - confidence: 50 - impact: 30 - message: Network Connection discovery on $dest$ by $user$ mitre_attack_id: - T1049 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml index f8098110ef..8fb2277403 100644 --- a/detections/endpoint/windows_network_share_interaction_via_net.yml +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -32,34 +32,13 @@ tags: asset_type: Endpoint atomic_guid: - ab39a04f-0c93-4540-9ff2-83f862c385ae - confidence: 100 - impact: 20 - message: User $user$ leveraged net.exe on $dest$ to interact with network shares, executed by parent process $parent_process$ mitre_attack_id: - T1135 - T1039 - required_fields: - - Processes.process_name - - Processes.user - - Processes.dest - - Processes.process_exec - - Processes.parent_process_exec - - Processes.process - - Processes.parent_process - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 20 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_new_default_file_association_value_set.yml b/detections/endpoint/windows_new_default_file_association_value_set.yml index d6f71a881f..3b77265c00 100644 --- a/detections/endpoint/windows_new_default_file_association_value_set.yml +++ b/detections/endpoint/windows_new_default_file_association_value_set.yml @@ -31,33 +31,13 @@ tags: - Windows Persistence Techniques - Data Destruction asset_type: Endpoint - confidence: 50 - impact: 50 - message: Default file association for $registry_path$ was modified to $registry_value_data$ in $dest$. mitre_attack_id: - T1546.001 - T1546 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index 00b394fcb1..af6dcfcbad 100644 --- a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -41,36 +41,15 @@ tags: - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - Compromised Windows Host asset_type: Endpoint - confidence: 100 cve: - CVE-2021-40444 - impact: 80 - message: An instance of $process_name$ was identified on $dest$ writing a .inf or .cab file. This is uncommon behavior and require further investigation. mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - dest - - process_name - - process - - file_create_time - - file_name - - file_path - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml index 58ff81e65e..bddfbc1e24 100644 --- a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -39,33 +39,13 @@ tags: - AgentTesla - PlugX asset_type: Endpoint - confidence: 60 - impact: 60 - message: An instance of $process_name$ was identified on $dest$ writing the file $file_name$. This is uncommon behavior and require further investigation. mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - process_name - - file_name - - process_guid - - dest - - user_id - risk_score: 36 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml index 6b17ff86fd..531428723b 100644 --- a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml +++ b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml @@ -31,35 +31,15 @@ tags: - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint - confidence: 100 cve: - CVE-2021-40444 - impact: 80 - message: An instance of $process_name$ was identified on endpoint $dest$ loading mshtml.dll. mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - ImageLoaded - - process_name - - OriginalFileName - - process_id - - dest - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml index 242d4caaea..9dfd532495 100644 --- a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml +++ b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml @@ -28,32 +28,13 @@ tags: analytic_story: - Spearphishing Attachments asset_type: Endpoint - confidence: 50 - impact: 50 - message: $process_name$ was identified loading the taskschd.dll on $dest$. This could indicate a potential malicious macro being executed. Further analysis is required. mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - ImageLoaded - - AllImageLoaded - - dest - - EventCode - - Image - - process_name - - ProcessId - - ProcessGuid - - _time - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml index 7486928eaa..585cca431d 100644 --- a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml +++ b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml @@ -40,32 +40,13 @@ tags: - PlugX - NjRAT asset_type: Endpoint - confidence: 50 - impact: 50 - message: $process_name$ was identified loading $loaded_file_path$ on $dest$. This could indicate a potential malicious macro being executed. Further analysis is required. mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - ImageLoaded - - AllImageLoaded - - dest - - EventCode - - Image - - process_name - - ProcessId - - ProcessGuid - - _time - risk_score: 25 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml index 1736227ef8..1d46e41096 100644 --- a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml +++ b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml @@ -32,35 +32,13 @@ tags: - PlugX - NjRAT asset_type: Endpoint - confidence: 50 - impact: 70 - message: Office document spawning suspicious child process on $dest$ mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 35 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_spawned_control.yml b/detections/endpoint/windows_office_product_spawned_control.yml index e69030ff03..0878b4d611 100644 --- a/detections/endpoint/windows_office_product_spawned_control.yml +++ b/detections/endpoint/windows_office_product_spawned_control.yml @@ -56,45 +56,15 @@ tags: - Microsoft MSHTML Remote Code Execution CVE-2021-40444 - Compromised Windows Host asset_type: Endpoint - confidence: 100 cve: - CVE-2021-40444 - impact: 80 - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ clicking a suspicious attachment. mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 80 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_spawned_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml index 0f67d0dab1..51adb635a8 100644 --- a/detections/endpoint/windows_office_product_spawned_msdt.yml +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -56,32 +56,11 @@ tags: - Compromised Windows Host - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 asset_type: Endpoint - confidence: 100 cve: - CVE-2022-30190 - impact: 100 - message: Office parent process $parent_process_name$ has spawned a child process - $process_name$ on host $dest$. mitre_attack_id: - T1566 - T1566.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -99,7 +78,6 @@ tags: - Processes.parent_process_path - Processes.process_path - Processes.parent_process_id - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml index 53b0bfcd5c..0a3ad75c8d 100644 --- a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml +++ b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml @@ -53,41 +53,13 @@ tags: - CVE-2023-36884 Office and Windows HTML RCE Vulnerability - Compromised Windows Host asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ and no dll commandline $process$ - in host $dest$ mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml index 6ff3bac2c6..6894764e34 100644 --- a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml +++ b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml @@ -61,48 +61,13 @@ tags: - Trickbot - Warzone RAT asset_type: Endpoint - confidence: 100 - impact: 100 - message: Office process $parent_process_name$ spawned a potentially suspicious child - process $process_name$ with process id $process_id$ in host $dest$ mitre_attack_id: - T1566 - T1566.001 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 100 security_domain: endpoint tests: - name: True Positive Test - Macro diff --git a/detections/endpoint/windows_password_policy_discovery_with_net.yml b/detections/endpoint/windows_password_policy_discovery_with_net.yml index 1c79471ad6..9253379379 100644 --- a/detections/endpoint/windows_password_policy_discovery_with_net.yml +++ b/detections/endpoint/windows_password_policy_discovery_with_net.yml @@ -19,39 +19,12 @@ tags: analytic_story: - Active Directory Discovery asset_type: Endpoint - confidence: 30 - impact: 30 - message: an instance of process $process_name$ with commandline $process$ in $dest$ mitre_attack_id: - T1201 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_registry_entries_exported_via_reg.yml b/detections/endpoint/windows_registry_entries_exported_via_reg.yml index b8bc479897..594d20607e 100644 --- a/detections/endpoint/windows_registry_entries_exported_via_reg.yml +++ b/detections/endpoint/windows_registry_entries_exported_via_reg.yml @@ -23,40 +23,12 @@ tags: - CISA AA23-347A - Prestige Ransomware asset_type: Endpoint - confidence: 30 - impact: 30 - message: execution of process $process_name$ in $dest$ mitre_attack_id: - T1012 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - - Processes.parent_process_guid - - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_registry_entries_restored_via_reg.yml b/detections/endpoint/windows_registry_entries_restored_via_reg.yml index a443300194..39e55f7395 100644 --- a/detections/endpoint/windows_registry_entries_restored_via_reg.yml +++ b/detections/endpoint/windows_registry_entries_restored_via_reg.yml @@ -22,40 +22,12 @@ tags: - Windows Post-Exploitation - Prestige Ransomware asset_type: Endpoint - confidence: 30 - impact: 30 - message: execution of process $process_name$ in $dest$ mitre_attack_id: - T1012 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - - Processes.parent_process_guid - - Processes.process_guid - risk_score: 9 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml index d02a2c241a..5bafee9f07 100644 --- a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -36,34 +36,13 @@ tags: - BlackSuit Ransomware - IcedID asset_type: Endpoint - confidence: 70 - impact: 30 - message: Elevated domain group discovery enumeration on $dest$ by $user$ mitre_attack_id: - T1069 - T1069.002 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 21 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 486b60664a..83995aa775 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -38,43 +38,13 @@ tags: - Volt Typhoon - Windows Registry Abuse asset_type: Endpoint - confidence: 70 - impact: 80 - message: Suspicious use of `reg.exe` or `regedit.exe` to export sensitive registry hives that could potentially contain credentials, executed on $dest$ by user $user$, with a parent process of $parent_process_name$ mitre_attack_id: - T1003.002 - T1003 - observable: - - name: user - type: User - role: - - Victim - - name: dest - type: Endpoint - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 56 security_domain: endpoint tests: - name: True Positive Test - Sysmon diff --git a/detections/endpoint/windows_service_creation.yml b/detections/endpoint/windows_service_creation.yml index b36adf5b71..b668074316 100644 --- a/detections/endpoint/windows_service_creation.yml +++ b/detections/endpoint/windows_service_creation.yml @@ -41,29 +41,12 @@ tags: - PlugX - CISA AA23-347A asset_type: Endpoint - confidence: 80 - impact: 80 - message: A Windows Service was created on a endpoint from $dest$ using a registry entry mitre_attack_id: - T1574.011 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Registry.dest - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data - - Registry.process_guid - risk_score: 64 security_domain: endpoint tests: - name: True Positive Test From 8cf6cfecf640894f61704b9afaa40d7c1773a793 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 22 Jan 2025 20:18:12 +0100 Subject: [PATCH 43/82] rba changes --- .../excel_spawning_windows_script_host.yml | 19 +++++++- .../office_product_spawning_mshta.yml | 37 +++++----------- ...e_product_spawning_windows_script_host.yml | 44 +++++-------------- .../office_product_spawning_wmic.yml | 37 +++++----------- .../deprecated/winword_spawning_cmd.yml | 44 ++++++------------- .../winword_spawning_windows_script_host.yml | 37 +++++----------- .../linux_auditd_add_user_account.yml | 7 +++ .../linux_auditd_add_user_account_type.yml | 7 +++ .../linux_auditd_at_application_execution.yml | 8 ++++ .../linux_auditd_auditd_service_stop.yml | 7 +++ .../linux_auditd_base64_decode_files.yml | 8 ++++ ...linux_auditd_change_file_owner_to_root.yml | 8 ++++ .../linux_auditd_clipboard_data_copy.yml | 9 +++- .../linux_auditd_data_destruction_command.yml | 7 +++ ...td_data_transfer_size_limits_via_split.yml | 7 +++ ...transfer_size_limits_via_split_syscall.yml | 8 ++++ ..._database_file_and_directory_discovery.yml | 8 ++++ .../linux_auditd_dd_file_overwrite.yml | 7 +++ ...ditd_disable_or_modify_system_firewall.yml | 8 ++++ .../linux_auditd_doas_conf_file_creation.yml | 7 +++ .../linux_auditd_doas_tool_execution.yml | 8 ++++ ...linux_auditd_edit_cron_table_parameter.yml | 8 ++++ ...ux_auditd_file_and_directory_discovery.yml | 12 +++-- ...le_permissions_modification_via_chattr.yml | 8 ++++ ...ind_credentials_from_password_managers.yml | 8 ++++ ..._find_credentials_from_password_stores.yml | 8 ++++ .../linux_auditd_find_ssh_private_keys.yml | 8 ++++ ...linux_auditd_hardware_addition_swapoff.yml | 9 +++- ..._hidden_files_and_directories_creation.yml | 7 +++ ...l_kernel_module_using_modprobe_utility.yml | 8 ++++ ...ditd_kernel_module_using_rmmod_utility.yml | 8 ++++ ..._auditd_nopasswd_entry_in_sudoers_file.yml | 8 ++++ .../linux_auditd_osquery_service_stop.yml | 8 ++++ ...ss_or_modification_of_sshd_config_file.yml | 8 ++++ ...td_possible_access_to_credential_files.yml | 8 ++++ ...auditd_possible_access_to_sudoers_file.yml | 8 ++++ ...ux_auditd_preload_hijack_library_calls.yml | 8 ++++ ...auditd_preload_hijack_via_preload_file.yml | 7 +++ ...ivate_keys_and_certificate_enumeration.yml | 7 +++ .../linux_auditd_service_restarted.yml | 8 ++++ .../endpoint/linux_auditd_service_started.yml | 8 ++++ ...inux_auditd_setuid_using_chmod_utility.yml | 8 ++++ ...nux_auditd_setuid_using_setcap_utility.yml | 8 ++++ .../linux_auditd_shred_overwrite_command.yml | 8 ++++ .../endpoint/linux_auditd_stop_services.yml | 8 ++++ .../linux_auditd_sudo_or_su_execution.yml | 8 ++++ .../linux_auditd_sysmon_service_stop.yml | 8 ++++ ...system_network_configuration_discovery.yml | 8 ++++ ..._unix_shell_configuration_modification.yml | 8 ++++ ...inux_auditd_unload_module_via_modprobe.yml | 8 ++++ ...tual_disk_file_and_directory_discovery.yml | 8 ++++ .../linux_auditd_whoami_user_discovery.yml | 8 ++++ ...hell_process___execution_policy_bypass.yml | 7 +++ .../microsoft_defender_atp_alerts.yml | 20 +++++++++ .../microsoft_defender_incident_alerts.yml | 20 +++++++++ ...twork_configuration_discovery_activity.yml | 16 +++++++ ...ding_dotnet_into_memory_via_reflection.yml | 12 +++++ ...print_spooler_failed_to_load_a_plug_in.yml | 8 ++++ ...nstallation_with_suspicious_parameters.yml | 11 +++++ ...ndows_attempt_to_stop_security_service.yml | 15 +++++++ ...indows_bitlockertogo_process_execution.yml | 9 ++++ ...ws_bitlockertogo_with_network_activity.yml | 5 +++ ..._tool_execution_from_non_shell_process.yml | 15 +++++++ ...te_local_administrator_account_via_net.yml | 16 +++++++ ...s_domain_admin_impersonation_indicator.yml | 8 ++++ ...dows_esx_admins_group_creation_via_net.yml | 12 ++++- ...windows_excessive_service_stop_attempt.yml | 10 +++++ .../windows_excessive_usage_of_net_app.yml | 13 ++++++ ...ttp_network_communication_from_msiexec.yml | 15 +++++++ ...s_via_set_command_from_uncommon_parent.yml | 8 ++++ ...dows_network_share_interaction_via_net.yml | 11 +++++ ...office_product_dropped_cab_or_inf_file.yml | 10 +++++ ...s_office_product_dropped_uncommon_file.yml | 9 ++++ ...ws_office_product_loaded_mshtml_module.yml | 10 +++++ ...ws_office_product_loading_taskschd_dll.yml | 8 ++++ ...indows_office_product_loading_vbe7_dll.yml | 7 +++ ...uct_spawned_child_process_for_download.yml | 7 +++ ...windows_office_product_spawned_control.yml | 12 +++++ .../windows_office_product_spawned_msdt.yml | 15 +++++++ ...e_product_spawned_rundll32_with_no_dll.yml | 11 +++++ ...ffice_product_spawned_uncommon_process.yml | 12 +++++ ...ows_sensitive_group_discovery_with_net.yml | 7 +++ ...ive_registry_hive_dump_via_commandline.yml | 13 ++++++ .../endpoint/windows_service_creation.yml | 8 ++++ macros/process_office_products.yml | 2 +- 85 files changed, 792 insertions(+), 152 deletions(-) rename detections/{endpoint => deprecated}/excel_spawning_windows_script_host.yml (90%) diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/deprecated/excel_spawning_windows_script_host.yml similarity index 90% rename from detections/endpoint/excel_spawning_windows_script_host.yml rename to detections/deprecated/excel_spawning_windows_script_host.yml index 25eb6d0890..70da2b9f10 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/deprecated/excel_spawning_windows_script_host.yml @@ -1,9 +1,9 @@ name: Excel Spawning Windows Script Host id: 57fe880a-9be3-11eb-9bf3-acde48001122 -version: 7 +version: 8 date: '2025-01-13' author: Michael Haag, Splunk -status: production +status: deprecated type: TTP description: The following analytic has been deprecated in favour of a more generic approach. The following analytic identifies instances where Microsoft Excel spawns @@ -53,6 +53,21 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. + risk_objects: + - field: user + type: user + score: 80 + - field: dest + type: system + score: 80 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments diff --git a/detections/deprecated/office_product_spawning_mshta.yml b/detections/deprecated/office_product_spawning_mshta.yml index 727712a09b..966d3f3b98 100644 --- a/detections/deprecated/office_product_spawning_mshta.yml +++ b/detections/deprecated/office_product_spawning_mshta.yml @@ -51,6 +51,16 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Office process $parent_process_name$ observed executing a suspicious child + process $process_name$ with process id $process_id$ on host $dest$ + risk_objects: + - field: dest + type: system + score: 63 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - Azorult @@ -60,40 +70,13 @@ tags: - NjRAT - CVE-2023-36884 Office and Windows HTML RCE Vulnerability asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ in host $dest$ mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/deprecated/office_product_spawning_windows_script_host.yml b/detections/deprecated/office_product_spawning_windows_script_host.yml index 0a0e918fef..20ee47bc5c 100644 --- a/detections/deprecated/office_product_spawning_windows_script_host.yml +++ b/detections/deprecated/office_product_spawning_windows_script_host.yml @@ -54,6 +54,18 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Office process $parent_process_name$ observed executing a suspicious child + process $process_name$ on host $dest$. + risk_objects: + - field: dest + type: system + score: 63 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments @@ -61,44 +73,13 @@ tags: - CVE-2023-36884 Office and Windows HTML RCE Vulnerability - Compromised Windows Host asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ on host $dest$. mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: parent_process_name - type: Process - role: - - Attacker - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test @@ -106,4 +87,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/detections/deprecated/office_product_spawning_wmic.yml b/detections/deprecated/office_product_spawning_wmic.yml index 477df1d5cc..6360ea5c4e 100644 --- a/detections/deprecated/office_product_spawning_wmic.yml +++ b/detections/deprecated/office_product_spawning_wmic.yml @@ -54,6 +54,16 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Office process $parent_process_name$ observed executing a suspicious child + process $process_name$ with process id $process_id$ on host $dest$ + risk_objects: + - field: dest + type: system + score: 63 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments @@ -61,40 +71,13 @@ tags: - CVE-2023-36884 Office and Windows HTML RCE Vulnerability - FIN7 asset_type: Endpoint - confidence: 90 - impact: 70 - message: office parent process $parent_process_name$ will execute a suspicious child - process $process_name$ with process id $process_id$ in host $dest$ mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Hostname - role: - - Victim - - name: process_name - type: Process Name - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 63 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/deprecated/winword_spawning_cmd.yml b/detections/deprecated/winword_spawning_cmd.yml index ea5336cf1b..5760517a84 100644 --- a/detections/deprecated/winword_spawning_cmd.yml +++ b/detections/deprecated/winword_spawning_cmd.yml @@ -51,6 +51,19 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: '$parent_process_name$ on $dest$ by $user$ launched command: $process_name$ + which is very common in spearphishing attacks.' + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments @@ -58,44 +71,13 @@ tags: - CVE-2023-21716 Word RTF Heap Corruption - DarkCrystal RAT asset_type: Endpoint - confidence: 100 - impact: 70 - message: '$parent_process_name$ on $dest$ by $user$ launched command: $process_name$ - which is very common in spearphishing attacks.' mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/deprecated/winword_spawning_windows_script_host.yml b/detections/deprecated/winword_spawning_windows_script_host.yml index 52d3046d40..16ee7d84c1 100644 --- a/detections/deprecated/winword_spawning_windows_script_host.yml +++ b/detections/deprecated/winword_spawning_windows_script_host.yml @@ -51,44 +51,31 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: User $user$ on $dest$ spawned Windows Script Host from Winword.exe + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments - Compromised Windows Host - CVE-2023-21716 Word RTF Heap Corruption asset_type: Endpoint - confidence: 100 - impact: 70 - message: User $user$ on $dest$ spawned Windows Script Host from Winword.exe mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - process_name - - process_id - - parent_process_name - - dest - - user - - parent_process_id - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 6c10c6f275..deb04b7e4d 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -22,6 +22,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to add a user account. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index b058a0c9f4..179bf9a925 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -22,6 +22,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: New [$type$] event on host - [$dest$] to add a user account type. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index 0084dbce6d..ce87100fe8 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to execute the + "at" application. + risk_objects: + - field: dest + type: system + score: 9 + threat_objects: [] tags: analytic_story: - Scheduled Tasks diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index b3f8512259..dddc777142 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -22,6 +22,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A service event - [$type$] event occured on host - [$dest$]. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index 38f0533d96..4c97560dad 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to decode a file using + base64. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml index 13784c73f7..a45a65d0f8 100644 --- a/detections/endpoint/linux_auditd_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_auditd_change_file_owner_to_root.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to change a file owner + to root. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_clipboard_data_copy.yml b/detections/endpoint/linux_auditd_clipboard_data_copy.yml index 4b3ad20b66..0a32d1b5d3 100644 --- a/detections/endpoint/linux_auditd_clipboard_data_copy.yml +++ b/detections/endpoint/linux_auditd_clipboard_data_copy.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to copy data from + the clipboard. + risk_objects: + - field: dest + type: system + score: 16 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land @@ -41,4 +49,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1115/linux_auditd_xclip/linux_auditd_xclip.log source: /var/log/audit/audit.log sourcetype: linux:audit - update_timestamp: true diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index e69160ec5f..0d435a8f23 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -23,6 +23,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to destroy data. + risk_objects: + - field: dest + type: system + score: 90 + threat_objects: [] tags: analytic_story: - Data Destruction diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml index 2e2c6a3e6e..2c7f2eee4e 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split.yml @@ -22,6 +22,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to split a file. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index 9c30d10fae..798a41de8e 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] that limits + the size of data transfer. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml index ade8e0963c..d9643341cb 100644 --- a/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_database_file_and_directory_discovery.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to discover database + files and directories. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index 7582f3f830..6c9556388c 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -23,6 +23,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$]. + risk_objects: + - field: dest + type: system + score: 81 + threat_objects: [] tags: analytic_story: - Industroyer2 diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index e9ebbd65c8..f1a1585c55 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A service event - [$type$] to disable or modify system firewall occured + on host - [$dest$] . + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 06ac060b5a..55c71d3dd9 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -23,6 +23,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$type$] event occured on host - [$dest$] to create a doas.conf file. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index 3e9f267e64..202bba09f3 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to execute the + "doas" tool. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index 336e5f94d9..4c16052073 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to edit the + cron table. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Scheduled Tasks diff --git a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml index e41ce58104..f117d9113f 100644 --- a/detections/endpoint/linux_auditd_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_file_and_directory_discovery.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to discover files + and directories. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land @@ -36,10 +44,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - argc - - process_exec security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml index ef108ec994..84bb8beef4 100644 --- a/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml +++ b/detections/endpoint/linux_auditd_file_permissions_modification_via_chattr.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to modify file permissions + using the "chattr" command. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml index 7c3d0d5f96..f42a173862 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_managers.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to find credentials + stored in password managers. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml index 52eaee55b9..6332592a94 100644 --- a/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml +++ b/detections/endpoint/linux_auditd_find_credentials_from_password_stores.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to find credentials + stored in password managers. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml index 02d503e9d5..8788828cc2 100644 --- a/detections/endpoint/linux_auditd_find_ssh_private_keys.yml +++ b/detections/endpoint/linux_auditd_find_ssh_private_keys.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to find SSH private + keys. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml index 9753bdfd30..11a767918e 100644 --- a/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml +++ b/detections/endpoint/linux_auditd_hardware_addition_swapoff.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to disable the swapping + of paging devices on a Linux system. + risk_objects: + - field: dest + type: system + score: 36 + threat_objects: [] tags: analytic_story: - Data Destruction @@ -41,4 +49,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1200/linux_auditd_swapoff/linux_auditd_swapoff.log source: /var/log/audit/audit.log sourcetype: linux:audit - update_timestamp: true diff --git a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml index b5db900508..f888933bba 100644 --- a/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml +++ b/detections/endpoint/linux_auditd_hidden_files_and_directories_creation.yml @@ -23,6 +23,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$]. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml index 7be24b3b66..29a1db8488 100644 --- a/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_auditd_install_kernel_module_using_modprobe_utility.yml @@ -24,6 +24,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to install a + Linux kernel module using the modprobe utility. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index 390e98bc6a..c242b8d08f 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to remove a + Linux kernel module using the rmmod utility. + risk_objects: + - field: dest + type: system + score: 72 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index a07f3a6dd9..3720c29aba 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to add NOPASSWD entry + in sudoers file. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index 28ef4f1cb1..3bdf4cc7ec 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A service event - [$type$] event occured on host - [$dest$] to stop the + osquery service. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index 783e1ce760..70e240b1dc 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$type$] has been accessed/modified on host - [$dest$] to modify the + sshd_config file. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 404c3c008d..d1b5f03bb9 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to access or dump + the contents of /etc/passwd and /etc/shadow files. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 4e41d4d034..b7ae713fdb 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$type$] has been accessed/modified on host - [$dest$] to access or modify + the sudoers file. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index 6eef14886f..905d2fd1db 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to hijack or hook + library functions using the LD_PRELOAD environment variable. + risk_objects: + - field: dest + type: system + score: 81 + threat_objects: [] tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 47930b7dbc..d44e083fbb 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -22,6 +22,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$type$] event has occured on host - [$dest$] to modify the preload file. + risk_objects: + - field: dest + type: system + score: 81 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml index 208899c9ed..0e5f984f6a 100644 --- a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml +++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml @@ -23,6 +23,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to find private keys. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml index 5cf26907bf..e70eac26b5 100644 --- a/detections/endpoint/linux_auditd_service_restarted.yml +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to restart or re-enable + a service. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - AwfulShred diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index 1eb2f52950..aeb9364bc8 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to start or enable + a service. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml index 0a5901105b..d958d0309d 100644 --- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to set the SUID or + SGID bit on files using the chmod utility. + risk_objects: + - field: dest + type: system + score: 81 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml index 9a77024d34..df8cc3f4ae 100644 --- a/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_setcap_utility.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to set the SUID or + SGID bit on files using the setcap utility. + risk_objects: + - field: dest + type: system + score: 81 + threat_objects: [] tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml index 6b4c425301..bcd4d675a9 100644 --- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to overwrite files + using the shred utility. + risk_objects: + - field: dest + type: system + score: 81 + threat_objects: [] tags: analytic_story: - AwfulShred diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 23004f47e1..7de4ac2caa 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A service event - [$type$] event occured on host - [$dest$] to stop or + disable a service. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] tags: analytic_story: - Industroyer2 diff --git a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml index a334c0aabd..b53ed7ef6c 100644 --- a/detections/endpoint/linux_auditd_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_auditd_sudo_or_su_execution.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to execute the sudo + or su command. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Privilege Escalation diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index 42823d3bc6..2cb80778a0 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A service event - [$type$] event occured on host - [$dest$] to stop or + disable the sysmon service. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index 23ed547ae0..8691c24bfe 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to discover + system network configuration. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 67d17b2f04..9b4c91ba32 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$type$] event occured on host - [$dest$] to modify the unix shell configuration + file. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml index e2fea0b311..d3f5d76e2e 100644 --- a/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml +++ b/detections/endpoint/linux_auditd_unload_module_via_modprobe.yml @@ -22,6 +22,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to unload a kernel + module via the modprobe command. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml index e3f63c6ec4..59da2a56d4 100644 --- a/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml +++ b/detections/endpoint/linux_auditd_virtual_disk_file_and_directory_discovery.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to discover virtual + disk files and directories. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index a016a2f848..b940269f1e 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -23,6 +23,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to discover + virtual disk files and directories. + risk_objects: + - field: dest + type: system + score: 25 + threat_objects: [] tags: analytic_story: - Linux Living Off The Land diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 2492906b66..41471fc7c0 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -24,6 +24,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: PowerShell local execution policy bypass attempt on $dest$ + risk_objects: + - field: dest + type: system + score: 42 + threat_objects: [] tags: analytic_story: - DHS Report TA18-074A diff --git a/detections/endpoint/microsoft_defender_atp_alerts.yml b/detections/endpoint/microsoft_defender_atp_alerts.yml index ff2bb3142d..e18398545b 100644 --- a/detections/endpoint/microsoft_defender_atp_alerts.yml +++ b/detections/endpoint/microsoft_defender_atp_alerts.yml @@ -31,6 +31,26 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $severity$ alert for $src$ - $signature$ + risk_objects: + - field: src + type: system + score: 81 + - field: user + type: user + score: 81 + threat_objects: + - field: file_name + type: file_name + - field: process + type: process_name + - field: ip_address + type: ip_address + - field: registry_key + type: registry_path + - field: url + type: url tags: analytic_story: - Critical Alerts diff --git a/detections/endpoint/microsoft_defender_incident_alerts.yml b/detections/endpoint/microsoft_defender_incident_alerts.yml index a25edb92d9..2133ecae98 100644 --- a/detections/endpoint/microsoft_defender_incident_alerts.yml +++ b/detections/endpoint/microsoft_defender_incident_alerts.yml @@ -37,6 +37,26 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$","$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $severity$ alert for $dest$ - $signature$ + risk_objects: + - field: dest + type: system + score: 81 + - field: user + type: user + score: 81 + threat_objects: + - field: file_name + type: file_name + - field: process + type: process_name + - field: ip_address + type: ip_address + - field: registry_key + type: registry_path + - field: url + type: url tags: analytic_story: - Critical Alerts diff --git a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml index 6cd7997756..1d0ac6798c 100644 --- a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml +++ b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml @@ -23,6 +23,22 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning multiple $process_name$ was + identified on endpoint $dest$ by user $user$ typically not a normal behavior of + the process. + risk_objects: + - field: user + type: user + score: 32 + - field: dest + type: system + score: 32 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - Unusual Processes diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index b6d6b21dc1..98ce1c7612 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -26,6 +26,18 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$UserID$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A suspicious powershell script contains reflective class assembly command + in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in + host $Computer$ + risk_objects: + - field: Computer + type: system + score: 56 + - field: user + type: user + score: 56 + threat_objects: [] tags: analytic_story: - Winter Vivern diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 598dfc25f6..13f823f51e 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -25,6 +25,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$ComputerName$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ + with EventCode $EventCode$. + risk_objects: + - field: ComputerName + type: system + score: 72 + threat_objects: [] tags: analytic_story: - PrintNightmare CVE-2021-34527 diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 9a524277f3..9e30f471ff 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -35,6 +35,17 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A process $process_name$ that possibly creates a shim db silently in host + $dest$ + risk_objects: + - field: dest + type: system + score: 63 + - field: user + type: user + score: 63 + threat_objects: [] tags: analytic_story: - Windows Persistence Techniques diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index 36347b3b34..fa9264062b 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -25,6 +25,21 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to disable security services on endpoint $dest$ by user $user$. + risk_objects: + - field: user + type: user + score: 20 + - field: dest + type: system + score: 20 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - WhisperGate diff --git a/detections/endpoint/windows_bitlockertogo_process_execution.yml b/detections/endpoint/windows_bitlockertogo_process_execution.yml index a6607a72a8..61c3ece759 100644 --- a/detections/endpoint/windows_bitlockertogo_process_execution.yml +++ b/detections/endpoint/windows_bitlockertogo_process_execution.yml @@ -42,6 +42,15 @@ tags: asset_type: Endpoint mitre_attack_id: - T1218 + observable: + - name: dest + type: Endpoint + role: + - Victim + - name: user + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml index 9be44cb329..697b12d58d 100644 --- a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml +++ b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml @@ -38,6 +38,11 @@ tags: asset_type: Endpoint mitre_attack_id: - T1218 + observable: + - name: dest + type: Endpoint + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml index bfea210231..1201456848 100644 --- a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -26,6 +26,21 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A non-standard parent process $parent_process_name$ spawned child process + $process_name$ to execute command-line tool on $dest$. + risk_objects: + - field: dest + type: system + score: 56 + - field: user + type: user + score: 56 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - Volt Typhoon diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml index 90f25d28e9..033b7f012f 100644 --- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -23,6 +23,22 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators + group. + risk_objects: + - field: user + type: user + score: 30 + - field: dest + type: system + score: 30 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - DHS Report TA18-074A diff --git a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml index 1bee496a19..806aa64509 100644 --- a/detections/endpoint/windows_domain_admin_impersonation_indicator.yml +++ b/detections/endpoint/windows_domain_admin_impersonation_indicator.yml @@ -58,6 +58,14 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: $TargetUserName$ may be impersonating a Domain Administrator through a + forged Kerberos ticket. + risk_objects: + - field: TargetUserName + type: user + score: 80 + threat_objects: [] tags: analytic_story: - Active Directory Kerberos Attacks diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index b404ba054e..0fecbadc81 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -26,6 +26,17 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An attempt to create an "ESX Admins" group was detected on $dest$ by user + $user$. + risk_objects: + - field: user + type: user + score: 56 + - field: dest + type: system + score: 56 + threat_objects: [] tags: analytic_story: - VMware ESXi AD Integration Authentication Bypass CVE-2024-37085 @@ -37,7 +48,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - risk_score: 56 security_domain: endpoint cve: - CVE-2024-37085 diff --git a/detections/endpoint/windows_excessive_service_stop_attempt.yml b/detections/endpoint/windows_excessive_service_stop_attempt.yml index de83371e43..650ee8c56d 100644 --- a/detections/endpoint/windows_excessive_service_stop_attempt.yml +++ b/detections/endpoint/windows_excessive_service_stop_attempt.yml @@ -24,6 +24,16 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An excessive amount of $process_name$ was executed on $dest$ attempting + to disable services. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - XMRig diff --git a/detections/endpoint/windows_excessive_usage_of_net_app.yml b/detections/endpoint/windows_excessive_usage_of_net_app.yml index 6c507c45d5..303b508b62 100644 --- a/detections/endpoint/windows_excessive_usage_of_net_app.yml +++ b/detections/endpoint/windows_excessive_usage_of_net_app.yml @@ -24,6 +24,19 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ + has been detected on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 28 + - field: dest + type: system + score: 28 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - Prestige Ransomware diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index 75bf669de1..7b11c61c3d 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -23,6 +23,21 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on endpoint $dest$ contacting + a remote destination $dest_ip$ + risk_objects: + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - Windows System Binary Proxy Execution MSIExec diff --git a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml index f83e86cb4c..7751b99c58 100644 --- a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml +++ b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml @@ -24,6 +24,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: non-shell parent process has a child process $process_name$ with a commandline + $process$ to fetch env variables on $dest$ + risk_objects: + - field: dest + type: system + score: 56 + threat_objects: [] tags: analytic_story: - Qakbot diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml index 8fb2277403..47a8dd8772 100644 --- a/detections/endpoint/windows_network_share_interaction_via_net.yml +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -24,6 +24,17 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: User $user$ leveraged net.exe on $dest$ to interact with network shares, + executed by parent process $parent_process$ + risk_objects: + - field: dest + type: system + score: 20 + - field: user + type: user + score: 20 + threat_objects: [] tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index af6dcfcbad..b365b97975 100644 --- a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -35,6 +35,16 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on $dest$ writing an inf or + cab file to this. This is not typical of $process_name$. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments diff --git a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml index bddfbc1e24..3db3fc6cf0 100644 --- a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -30,6 +30,15 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: process $process_name$ drops a file $file_name$ in host $dest$ + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - CVE-2023-21716 Word RTF Heap Corruption diff --git a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml index 531428723b..fa747992b2 100644 --- a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml +++ b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml @@ -25,6 +25,16 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on endpoint $dest$ loading + mshtml.dll. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments diff --git a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml index 9dfd532495..4e37e4291b 100644 --- a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml +++ b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml @@ -24,6 +24,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An Office document was identified creating a scheduled task on $dest$. + Investigate further. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] tags: analytic_story: - Spearphishing Attachments diff --git a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml index 585cca431d..35b2ea4bd6 100644 --- a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml +++ b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml @@ -27,6 +27,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Office document executing a macro on $dest$ + risk_objects: + - field: dest + type: system + score: 35 + threat_objects: [] tags: analytic_story: - Spearphishing Attachments diff --git a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml index 1d46e41096..0a06c8cf3f 100644 --- a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml +++ b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml @@ -25,6 +25,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Office document spawning suspicious child process on $dest$ + risk_objects: + - field: dest + type: system + score: 35 + threat_objects: [] tags: analytic_story: - Spearphishing Attachments diff --git a/detections/endpoint/windows_office_product_spawned_control.yml b/detections/endpoint/windows_office_product_spawned_control.yml index 0878b4d611..1cf0c90c7e 100644 --- a/detections/endpoint/windows_office_product_spawned_control.yml +++ b/detections/endpoint/windows_office_product_spawned_control.yml @@ -50,6 +50,18 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ clicking a suspicious attachment. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments diff --git a/detections/endpoint/windows_office_product_spawned_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml index 51adb635a8..3739e7513e 100644 --- a/detections/endpoint/windows_office_product_spawned_msdt.yml +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -50,6 +50,21 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Office process $parent_process_name$ has spawned a child process $process_name$ + on host $dest$. + risk_objects: + - field: user + type: user + score: 100 + - field: dest + type: system + score: 100 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments diff --git a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml index 0a3ad75c8d..6950ce0432 100644 --- a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml +++ b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml @@ -47,6 +47,17 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Office process $parent_process_name$ observed executing a suspicious child + process $process_name$ with process id $process_id$ and no dll commandline $process$ + on host $dest$ + risk_objects: + - field: dest + type: system + score: 63 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments diff --git a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml index 6894764e34..07bf669910 100644 --- a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml +++ b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml @@ -43,6 +43,18 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: User $user$ on $dest$ spawned Windows Script Host from Winword.exe + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - AgentTesla diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml index 5bafee9f07..128c59a6e9 100644 --- a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -28,6 +28,13 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Elevated domain group discovery enumeration on $dest$ by $user$ + risk_objects: + - field: dest + type: system + score: 21 + threat_objects: [] tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 83995aa775..77cda7a286 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -26,6 +26,19 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: Suspicious use of `reg.exe` exporting Windows Registry hives containing + credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ + risk_objects: + - field: user + type: user + score: 56 + - field: dest + type: system + score: 56 + threat_objects: + - field: parent_process_name + type: parent_process_name tags: analytic_story: - CISA AA22-257A diff --git a/detections/endpoint/windows_service_creation.yml b/detections/endpoint/windows_service_creation.yml index b668074316..1df59c5f1f 100644 --- a/detections/endpoint/windows_service_creation.yml +++ b/detections/endpoint/windows_service_creation.yml @@ -31,6 +31,14 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: A Windows Service was created on a endpoint from $dest$ using a registry + entry + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] tags: analytic_story: - Active Directory Lateral Movement diff --git a/macros/process_office_products.yml b/macros/process_office_products.yml index 1f3155d735..7462194e06 100644 --- a/macros/process_office_products.yml +++ b/macros/process_office_products.yml @@ -1,3 +1,3 @@ definition: (Processes.process_name IN ("EQNEDT32.exe", "excel.exe", "Graph.exe", "msaccess.exe", "mspub.exe", "onenote.exe", "onenoteim.exe", "onenotem.exe", "outlook.exe", "powerpnt.exe", "visio.exe", "winproj.exe", "winword.exe", "wordpad.exe", "wordview.exe") OR Processes.original_file_name IN ("EQNEDT32.EXE", "Excel.exe", "Graph.exe", "MSACCESS.EXE", "MSPUB.EXE", "OneNote.exe", "OneNoteIm.exe", "OneNoteM.exe", "OUTLOOK.EXE", "POWERPNT.EXE", "VISIO.EXE", "WinProj.exe", "WinWord.exe")) description: Matches the process with its original file name, data for this macro came from https://strontic.github.io/ -name: process_office_products \ No newline at end of file +name: process_office_products From a10fa00d0bfea0ee9b11c74608b12a78b6d094cf Mon Sep 17 00:00:00 2001 From: ljstella Date: Wed, 22 Jan 2025 13:26:14 -0600 Subject: [PATCH 44/82] Removed Observables section from last two stragglers --- .../endpoint/windows_bitlockertogo_process_execution.yml | 9 --------- .../windows_bitlockertogo_with_network_activity.yml | 5 ----- 2 files changed, 14 deletions(-) diff --git a/detections/endpoint/windows_bitlockertogo_process_execution.yml b/detections/endpoint/windows_bitlockertogo_process_execution.yml index 61c3ece759..a6607a72a8 100644 --- a/detections/endpoint/windows_bitlockertogo_process_execution.yml +++ b/detections/endpoint/windows_bitlockertogo_process_execution.yml @@ -42,15 +42,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1218 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml index 697b12d58d..9be44cb329 100644 --- a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml +++ b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml @@ -38,11 +38,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1218 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security From b1bf4c6310cbc3ad3f3cac76428baa4dee0c14ed Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 22 Jan 2025 20:51:36 +0100 Subject: [PATCH 45/82] more fixes --- .../remote_system_discovery_with_net.yml | 18 --------- .../winword_spawning_powershell.yml | 40 ++++++------------- ...cronjob_entry_on_existing_cronjob_file.yml | 4 +- ...ding_dotnet_into_memory_via_reflection.yml | 8 ++-- ...indows_bitlockertogo_process_execution.yml | 9 ----- ...ws_bitlockertogo_with_network_activity.yml | 5 --- .../windows_office_product_spawned_msdt.yml | 13 ------ 7 files changed, 19 insertions(+), 78 deletions(-) diff --git a/detections/deprecated/remote_system_discovery_with_net.yml b/detections/deprecated/remote_system_discovery_with_net.yml index a9570ff02a..b62a9e9f25 100644 --- a/detections/deprecated/remote_system_discovery_with_net.yml +++ b/detections/deprecated/remote_system_discovery_with_net.yml @@ -26,28 +26,10 @@ tags: message: Remote system discovery enumeration on $dest$ by $user$ mitre_attack_id: - T1018 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 15 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/deprecated/winword_spawning_powershell.yml b/detections/deprecated/winword_spawning_powershell.yml index 91d719d427..15811b2308 100644 --- a/detections/deprecated/winword_spawning_powershell.yml +++ b/detections/deprecated/winword_spawning_powershell.yml @@ -54,6 +54,19 @@ drilldown_searches: by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ +rba: + message: '$parent_process_name$ on $dest$ by $user$ launched the following powershell + process: $process_name$ which is very common in spearphishing attacks' + risk_objects: + - field: dest + type: system + score: 70 + - field: user + type: user + score: 70 + threat_objects: + - field: process_name + type: process_name tags: analytic_story: - Spearphishing Attachments @@ -68,37 +81,10 @@ tags: mitre_attack_id: - T1566 - T1566.001 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim - - name: process_name - type: Process - role: - - Attacker product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - risk_score: 70 security_domain: endpoint tests: - name: True Positive Test diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 9f4c9fb5a8..b404a42ce6 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Append Cronjob Entry On Existing Cronjob File id: fea71cf0-fa10-4ef6-9202-9682b2e0c477 -version: '3' -date: '2024-12-17' +version: 4 +date: '2025-01-20' author: Teoderick Contreras, Splunk status: production type: Hunting diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index 98ce1c7612..a98579a280 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -18,12 +18,12 @@ references: - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ drilldown_searches: -- name: View the detection results for - "$Computer$" and "$UserID$" - search: '%original_detection_search% | search Computer = "$Computer$" UserID = "$UserID$"' +- name: View the detection results for - "$Computer$" and "$user$" + search: '%original_detection_search% | search Computer = "$Computer$" user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" and "$UserID$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$UserID$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +- name: View risk events for the last 7 days for - "$Computer$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: diff --git a/detections/endpoint/windows_bitlockertogo_process_execution.yml b/detections/endpoint/windows_bitlockertogo_process_execution.yml index 61c3ece759..a6607a72a8 100644 --- a/detections/endpoint/windows_bitlockertogo_process_execution.yml +++ b/detections/endpoint/windows_bitlockertogo_process_execution.yml @@ -42,15 +42,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1218 - observable: - - name: dest - type: Endpoint - role: - - Victim - - name: user - type: User - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml index 697b12d58d..9be44cb329 100644 --- a/detections/endpoint/windows_bitlockertogo_with_network_activity.yml +++ b/detections/endpoint/windows_bitlockertogo_with_network_activity.yml @@ -38,11 +38,6 @@ tags: asset_type: Endpoint mitre_attack_id: - T1218 - observable: - - name: dest - type: Endpoint - role: - - Victim product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_office_product_spawned_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml index 3739e7513e..9fedd387e9 100644 --- a/detections/endpoint/windows_office_product_spawned_msdt.yml +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -80,19 +80,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id security_domain: endpoint tests: - name: True Positive Test From bd1c8364f10cb3f08ed080cc548e6432e47d1136 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Wed, 22 Jan 2025 20:57:29 +0100 Subject: [PATCH 46/82] CI fixes --- .../deprecated/remote_system_discovery_with_net.yml | 3 --- detections/deprecated/winword_spawning_powershell.yml | 4 ---- .../endpoint/linux_auditd_data_destruction_command.yml | 1 - detections/endpoint/linux_auditd_stop_services.yml | 8 -------- .../windows_http_network_communication_from_msiexec.yml | 1 - ...env_variables_via_set_command_from_uncommon_parent.yml | 1 - .../endpoint/windows_office_product_spawned_msdt.yml | 1 - .../windows_office_product_spawned_uncommon_process.yml | 1 - .../windows_registry_entries_exported_via_reg.yml | 1 - .../windows_registry_entries_restored_via_reg.yml | 1 - detections/endpoint/windows_service_stop_attempt.yml | 7 ------- 11 files changed, 29 deletions(-) diff --git a/detections/deprecated/remote_system_discovery_with_net.yml b/detections/deprecated/remote_system_discovery_with_net.yml index b62a9e9f25..2377264b52 100644 --- a/detections/deprecated/remote_system_discovery_with_net.yml +++ b/detections/deprecated/remote_system_discovery_with_net.yml @@ -21,9 +21,6 @@ tags: - Active Directory Discovery - IcedID asset_type: Endpoint - confidence: 50 - impact: 30 - message: Remote system discovery enumeration on $dest$ by $user$ mitre_attack_id: - T1018 product: diff --git a/detections/deprecated/winword_spawning_powershell.yml b/detections/deprecated/winword_spawning_powershell.yml index 15811b2308..b2e102dc75 100644 --- a/detections/deprecated/winword_spawning_powershell.yml +++ b/detections/deprecated/winword_spawning_powershell.yml @@ -74,10 +74,6 @@ tags: - CVE-2023-21716 Word RTF Heap Corruption - DarkCrystal RAT asset_type: Endpoint - confidence: 100 - impact: 70 - message: '$parent_process_name$ on $dest$ by $user$ launched the following powershell - process: $process_name$ which is very common in spearphishing attacks' mitre_attack_id: - T1566 - T1566.001 diff --git a/detections/endpoint/linux_auditd_data_destruction_command.yml b/detections/endpoint/linux_auditd_data_destruction_command.yml index 0d435a8f23..94d554eb0a 100644 --- a/detections/endpoint/linux_auditd_data_destruction_command.yml +++ b/detections/endpoint/linux_auditd_data_destruction_command.yml @@ -49,4 +49,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_no_preserve_root/linux_auditd_no_preserve_root.log source: /var/log/audit/audit.log sourcetype: linux:audit - update_timestamp: true diff --git a/detections/endpoint/linux_auditd_stop_services.yml b/detections/endpoint/linux_auditd_stop_services.yml index 7de4ac2caa..23004f47e1 100644 --- a/detections/endpoint/linux_auditd_stop_services.yml +++ b/detections/endpoint/linux_auditd_stop_services.yml @@ -23,14 +23,6 @@ drilldown_searches: search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -rba: - message: A service event - [$type$] event occured on host - [$dest$] to stop or - disable a service. - risk_objects: - - field: dest - type: system - score: 49 - threat_objects: [] tags: analytic_story: - Industroyer2 diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index 7b11c61c3d..94d5502310 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -55,4 +55,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml index 7751b99c58..4be4f5ad84 100644 --- a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml +++ b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml @@ -49,4 +49,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/detections/endpoint/windows_office_product_spawned_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml index 9fedd387e9..42115bf883 100644 --- a/detections/endpoint/windows_office_product_spawned_msdt.yml +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -87,4 +87,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml index 07bf669910..5dc516ea3d 100644 --- a/detections/endpoint/windows_office_product_spawned_uncommon_process.yml +++ b/detections/endpoint/windows_office_product_spawned_uncommon_process.yml @@ -102,7 +102,6 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - update_timestamp: true - name: True Positive Test - TrickBot attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/spear_phish/windows-sysmon.log diff --git a/detections/endpoint/windows_registry_entries_exported_via_reg.yml b/detections/endpoint/windows_registry_entries_exported_via_reg.yml index 594d20607e..70e5fc6a36 100644 --- a/detections/endpoint/windows_registry_entries_exported_via_reg.yml +++ b/detections/endpoint/windows_registry_entries_exported_via_reg.yml @@ -36,4 +36,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/detections/endpoint/windows_registry_entries_restored_via_reg.yml b/detections/endpoint/windows_registry_entries_restored_via_reg.yml index 39e55f7395..0406b4c476 100644 --- a/detections/endpoint/windows_registry_entries_restored_via_reg.yml +++ b/detections/endpoint/windows_registry_entries_restored_via_reg.yml @@ -35,4 +35,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog - update_timestamp: true diff --git a/detections/endpoint/windows_service_stop_attempt.yml b/detections/endpoint/windows_service_stop_attempt.yml index fa66d32958..c203b0a66e 100644 --- a/detections/endpoint/windows_service_stop_attempt.yml +++ b/detections/endpoint/windows_service_stop_attempt.yml @@ -29,13 +29,6 @@ drilldown_searches: | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -rba: - message: $process$ was executed on $dest$ attempting to stop service. - risk_objects: - - field: dest - type: system - score: 49 - threat_objects: [] tags: analytic_story: - Prestige Ransomware From c78f07107d112589640deb92e39deb4b9d18fd15 Mon Sep 17 00:00:00 2001 From: research-bot Date: Wed, 22 Jan 2025 17:55:13 -0800 Subject: [PATCH 47/82] updating detections for 5.0 alpha2 --- ...ndows_file_share_discovery_with_powerview.yml | 16 ++++++++-------- ...eventlog_channelaccess_registry_value_set.yml | 2 +- 2 files changed, 9 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/windows_file_share_discovery_with_powerview.yml b/detections/endpoint/windows_file_share_discovery_with_powerview.yml index bd56073432..344bcb30ed 100644 --- a/detections/endpoint/windows_file_share_discovery_with_powerview.yml +++ b/detections/endpoint/windows_file_share_discovery_with_powerview.yml @@ -17,7 +17,7 @@ description: The following analytic detects the execution of the Invoke-ShareFin and sensitive data. search: '`powershell` EventCode=4104 (ScriptBlockText=Invoke-ShareFinder*) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode - ScriptBlockText | rename UserID as user | `security_content_ctime(firstTime)` | + ScriptBlockText | rename UserID as user | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_file_share_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here @@ -29,12 +29,12 @@ references: - https://thedfirreport.com/2023/01/23/sharefinder-how-threat-actors-discover-file-shares/ - https://attack.mitre.org/techniques/T1135/ drilldown_searches: -- name: View the detection results for - "$Computer$" and "$user$" - search: '%original_detection_search% | search Computer = "$Computer$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) @@ -43,12 +43,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Invoke-ShareFinder commandlet was executed on $Computer$ + message: Invoke-ShareFinder commandlet was executed on $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 48 - - field: User + - field: user type: user score: 48 threat_objects: [] diff --git a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml index 8c3b359024..30f031abec 100644 --- a/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml +++ b/detections/endpoint/windows_new_eventlog_channelaccess_registry_value_set.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path IN ("*\\Microsoft\\Windows\\CurrentVersion\\WINEVT\\Channels\\*", "*\Microsoft\Windows\EventLog\*") AND Registry.registry_value_name=ChannelAccess BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid - Registry.process_id Registry.registry_key_name Registry.user Registry.registry_value_name + Registry.process_id Registry.registry_key_name Registry.user Registry.registry_value_name Registry.registry_path | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_eventlog_channelaccess_registry_value_set_filter`' how_to_implement: To successfully implement this search, you must be ingesting data From 5b51fce4f0311ee18d7466f4cf14a6544240868c Mon Sep 17 00:00:00 2001 From: research-bot Date: Wed, 22 Jan 2025 18:05:40 -0800 Subject: [PATCH 48/82] reg path --- ...s_new_custom_security_descriptor_set_on_eventlog_channel.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml index ce54597220..bfeca92a28 100644 --- a/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml +++ b/detections/endpoint/windows_new_custom_security_descriptor_set_on_eventlog_channel.yml @@ -20,7 +20,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime as lastTime FROM datamodel=Endpoint.Registry WHERE Registry.registry_path= "*\\Services\\Eventlog\\*" AND Registry.registry_value_name=CustomSD BY Registry.dest Registry.registry_value_data Registry.action Registry.process_guid Registry.process_id Registry.registry_key_name - Registry.user Registry.registry_value_name | `drop_dm_object_name(Registry)` | where + Registry.user Registry.registry_value_name Registry.registry_path | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_new_custom_security_descriptor_set_on_eventlog_channel_filter`' how_to_implement: To successfully implement this search, you must be ingesting data From 1a4f75aef1cb7535ea56a7ee96515af972edc644 Mon Sep 17 00:00:00 2001 From: research-bot Date: Wed, 22 Jan 2025 18:32:39 -0800 Subject: [PATCH 49/82] updating message --- detections/endpoint/windows_ad_short_lived_server_object.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_ad_short_lived_server_object.yml b/detections/endpoint/windows_ad_short_lived_server_object.yml index 5d9c443b23..b06e00f517 100644 --- a/detections/endpoint/windows_ad_short_lived_server_object.yml +++ b/detections/endpoint/windows_ad_short_lived_server_object.yml @@ -48,7 +48,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Potential DCShadow Attack Detected on $Computer$ + message: A short-lived server object was created and deleted on $Computer$ risk_objects: - field: Computer type: system From ef9aa03385d4916f17c04c73723819c577345a4a Mon Sep 17 00:00:00 2001 From: research-bot Date: Wed, 22 Jan 2025 18:39:19 -0800 Subject: [PATCH 50/82] updating SPL --- ...pre_authentication_flag_disabled_in_useraccountcontrol.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml index 24d391c160..f5d8ed8cf8 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -16,8 +16,7 @@ description: The following analytic detects when the Kerberos Pre-Authentication data_source: - Windows Event Log Security 4738 search: > - `wineventlog_security` EventCode=4738 MSADChangedAttributes=\"*Don't Require Preauth' - - Enabled*\" |rename Account_Name as user | table EventCode, user, dest, Security_ID, + `wineventlog_security` EventCode=4738 MSADChangedAttributes="*\'Don\'t Require Preauth\' - Enabled*" |rename Account_Name as user | table EventCode, user, dest, Security_ID, MSADChangedAttributes | `kerberos_pre_authentication_flag_disabled_in_useraccountcontrol_filter` how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `User Account @@ -68,3 +67,4 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.004/powershell/windows-security.log source: WinEventLog:Security sourcetype: WinEventLog + From 87f86e7b27615a0f8e41d82beb6ac6c3cdabf128 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 23 Jan 2025 12:00:08 +0100 Subject: [PATCH 51/82] crypto_campaign --- .../attempt_to_stop_security_service.yml | 17 +++++++++-------- 1 file changed, 9 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index f3932807b3..3ee0439e23 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -18,14 +18,15 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process - min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop - *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name - Processes.process_name Processes.original_file_name Processes.process Processes.process_id - Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` |lookup security_services_lookup service as - process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop *" + by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + |lookup security_services_lookup service as process OUTPUTNEW category, description + | search category=security + | `attempt_to_stop_security_service_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, From 322008af5f1fdb14e2a29ea2fd3ec78a028c7c96 Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 23 Jan 2025 12:35:12 +0100 Subject: [PATCH 52/82] crypto_campaign --- .../attempt_to_stop_security_service.yml | 28 +++++++++---------- 1 file changed, 13 insertions(+), 15 deletions(-) diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 3ee0439e23..d97c43041d 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -18,15 +18,14 @@ data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop *" - by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id - | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - |lookup security_services_lookup service as process OUTPUTNEW category, description - | search category=security - | `attempt_to_stop_security_service_filter`' +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop + *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` |lookup security_services_lookup service as + process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, @@ -72,13 +71,12 @@ rba: type: process_name tags: analytic_story: - - Azorult - - Data Destruction - - Disabling Security Tools - - Trickbot - - Graceful Wipe Out Attack - WhisperGate - - Crypto Stealer + - Graceful Wipe Out Attack + - Disabling Security Tools + - Data Destruction + - Azorult + - Trickbot asset_type: Endpoint mitre_attack_id: - T1562.001 From 96f48874fd6dbe9f7f1c9db432384986d25f3ad7 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 23 Jan 2025 15:17:46 +0100 Subject: [PATCH 53/82] additional rollback updates --- .../domain_account_discovery_with_net_app.yml | 2 +- .../linux_auditd_add_user_account.yml | 41 +++++++++--- .../linux_auditd_add_user_account_type.yml | 39 ++++++++--- .../linux_auditd_at_application_execution.yml | 42 +++++++++--- .../linux_auditd_auditd_service_stop.yml | 40 +++++++++--- .../linux_auditd_base64_decode_files.yml | 64 +++++++++++++------ ...transfer_size_limits_via_split_syscall.yml | 41 +++++++++--- .../linux_auditd_dd_file_overwrite.yml | 41 +++++++++--- ...ditd_disable_or_modify_system_firewall.yml | 40 +++++++++--- .../linux_auditd_doas_conf_file_creation.yml | 40 +++++++++--- .../linux_auditd_doas_tool_execution.yml | 40 +++++++++--- ...linux_auditd_edit_cron_table_parameter.yml | 41 +++++++++--- ...ditd_kernel_module_using_rmmod_utility.yml | 41 +++++++++--- ..._auditd_nopasswd_entry_in_sudoers_file.yml | 41 +++++++++--- .../linux_auditd_osquery_service_stop.yml | 41 +++++++++--- ...ss_or_modification_of_sshd_config_file.yml | 41 +++++++++--- ...td_possible_access_to_credential_files.yml | 43 ++++++++++--- ...auditd_possible_access_to_sudoers_file.yml | 39 +++++++++-- ...cronjob_entry_on_existing_cronjob_file.yml | 3 +- ...auditd_preload_hijack_via_preload_file.yml | 39 +++++++++-- ...ivate_keys_and_certificate_enumeration.yml | 62 ++++++++++++------ .../linux_auditd_service_restarted.yml | 40 ++++++++++-- .../endpoint/linux_auditd_service_started.yml | 40 ++++++++++-- ...inux_auditd_setuid_using_chmod_utility.yml | 40 ++++++++++-- .../linux_auditd_shred_overwrite_command.yml | 40 ++++++++++-- .../linux_auditd_sysmon_service_stop.yml | 38 +++++++++-- ...system_network_configuration_discovery.yml | 42 ++++++++++-- ..._unix_shell_configuration_modification.yml | 44 +++++++++++-- .../linux_auditd_whoami_user_discovery.yml | 39 +++++++++-- ...print_spooler_failed_to_load_a_plug_in.yml | 30 +++++++-- ...service_creation_using_registry_entry.yml} | 35 ++++++---- 31 files changed, 963 insertions(+), 246 deletions(-) rename detections/endpoint/{windows_service_creation.yml => windows_service_creation_using_registry_entry.yml} (55%) diff --git a/detections/deprecated/domain_account_discovery_with_net_app.yml b/detections/deprecated/domain_account_discovery_with_net_app.yml index 18d6cf1f8a..7299b21596 100644 --- a/detections/deprecated/domain_account_discovery_with_net_app.yml +++ b/detections/deprecated/domain_account_discovery_with_net_app.yml @@ -5,7 +5,7 @@ date: '2025-01-13' author: Teoderick Contreras, Mauricio Velazco, Splunk status: deprecated type: TTP -description: This following analytic has been deprecated in favour of the generic version "". The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query domain users. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt by adversaries to enumerate domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map out user accounts, potentially leading to further exploitation or lateral movement within the network. +description: This following analytic has been deprecated in favour of the generic version "5d0d4830-0133-11ec-bae3-acde48001122". The following analytic detects the execution of `net.exe` or `net1.exe` with command-line arguments used to query domain users. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an attempt by adversaries to enumerate domain users for situational awareness and Active Directory discovery. If confirmed malicious, this behavior could allow attackers to map out user accounts, potentially leading to further exploitation or lateral movement within the network. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index deb04b7e4d..5de241fc97 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -1,16 +1,35 @@ name: Linux Auditd Add User Account id: aae66dc0-74b4-4807-b480-b35f8027abb4 version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the creation of new user accounts on Linux systems using commands like "useradd" or "adduser." It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as adversaries often create new user accounts to establish persistence on compromised hosts. If confirmed malicious, this could allow attackers to maintain access, escalate privileges, and further compromise the system, posing a severe security risk. +description: The following analytic detects the creation of new user accounts on Linux + systems using commands like "useradd" or "adduser." It leverages data from Endpoint + Detection and Response (EDR) agents, focusing on process names and command-line + executions. This activity is significant as adversaries often create new user accounts + to establish persistence on compromised hosts. If confirmed malicious, this could + allow attackers to maintain access, escalate privileges, and further compromise + the system, posing a severe security risk. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as dest | where LIKE (process_exec, "%useradd%") OR LIKE (process_exec, "%adduser%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as + dest | where LIKE (process_exec, "%useradd%") OR LIKE (process_exec, "%adduser%") + | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_add_user_account_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://linuxize.com/post/how-to-create-users-in-linux-using-the-useradd-command/ drilldown_searches: @@ -19,7 +38,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -46,6 +70,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/linux_auditd_add_user/linux_auditd_add_user.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/linux_auditd_add_user/linux_auditd_add_user.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index 179bf9a925..ae4cde478a 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -1,16 +1,33 @@ name: Linux Auditd Add User Account Type id: f8c325ea-506e-4105-8ccf-da1492e90115 version: 4 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the suspicious add user account type. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents. +description: The following analytic detects the suspicious add user account type. + This behavior is critical for a SOC to monitor because it may indicate attempts + to gain unauthorized access or maintain control over a system. Such actions could + be signs of malicious activity. If confirmed, this could lead to serious consequences, + including a compromised system, unauthorized access to sensitive data, or even a + wider breach affecting the entire network. Detecting and responding to these signs + early is essential to prevent potential security incidents. data_source: - Linux Auditd Add User -search: '`linux_auditd` type=ADD_USER | rename hostname as dest| stats count min(_time) as firstTime max(_time) as lastTime by exe pid dest res UID type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_type_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=ADD_USER | rename hostname as dest| stats count min(_time) + as firstTime max(_time) as lastTime by exe pid dest res UID type | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_add_user_account_type_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -19,7 +36,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -47,6 +69,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/linux_auditd_add_user_type/linux_auditd_add_user_type.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/linux_auditd_add_user_type/linux_auditd_add_user_type.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index ce87100fe8..84a3cd77c9 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -1,16 +1,36 @@ name: Linux Auditd At Application Execution id: 9f306e0a-1c36-469e-8892-968ca12470dd version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the execution of the "At" application in Linux, which can be used by attackers to create persistence entries on a compromised host. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent process names associated with "at" or "atd". This activity is significant because the "At" application can be exploited to maintain unauthorized access or deliver additional malicious payloads. If confirmed malicious, this behavior could lead to data theft, ransomware attacks, or other severe consequences. Immediate investigation is required to determine the legitimacy of the execution and mitigate potential risks. +description: The following analytic detects the execution of the "At" application + in Linux, which can be used by attackers to create persistence entries on a compromised + host. This detection leverages data from Endpoint Detection and Response (EDR) agents, + focusing on process names and parent process names associated with "at" or "atd". + This activity is significant because the "At" application can be exploited to maintain + unauthorized access or deliver additional malicious payloads. If confirmed malicious, + this behavior could lead to data theft, ransomware attacks, or other severe consequences. + Immediate investigation is required to determine the legitimacy of the execution + and mitigate potential risks. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/at","/usr/bin/atd") AND NOT (UID IN("daemon")) | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_at_application_execution_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SYSCALL comm IN ("at", "atd") OR exe IN ("/usr/bin/at","/usr/bin/atd") + AND NOT (UID IN("daemon")) | rename host as dest | stats count min(_time) as firstTime + max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_at_application_execution_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/001/ - https://www.linkedin.com/pulse/getting-attacker-ip-address-from-malicious-linux-job-craig-rowland/ @@ -20,7 +40,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -50,6 +75,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_at/linux_auditd_at_execution.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_at/linux_auditd_at_execution.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index dddc777142..301ca8ce13 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -1,16 +1,34 @@ name: Linux Auditd Auditd Service Stop id: 6cb9d0e1-eabe-41de-a11a-5efade354e9d version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the suspicious auditd service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents. +description: The following analytic detects the suspicious auditd service stop. This + behavior is critical for a SOC to monitor because it may indicate attempts to gain + unauthorized access or maintain control over a system. Such actions could be signs + of malicious activity. If confirmed, this could lead to serious consequences, including + a compromised system, unauthorized access to sensitive data, or even a wider breach + affecting the entire network. Detecting and responding to these signs early is essential + to prevent potential security incidents. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("auditd") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_auditd_service_stop_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SERVICE_STOP unit IN ("auditd") | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm + exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_auditd_service_stop_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -19,7 +37,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -46,6 +69,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_auditd_service_stop/linux_auditd_auditd_service_stop.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_auditd_service_stop/linux_auditd_auditd_service_stop.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index 4c97560dad..796827f658 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -1,35 +1,59 @@ -name: Linux Auditd Base64 Decode Files -id: 5890ba10-4e48-4dc0-8a40-3e1ebe75e737 -version: 3 -date: '2025-01-15' +name: Linux Auditd Change File Owner To Root +id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90 +version: 4 +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production -type: Anomaly -description: The following analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. Base64 is commonly used to encode data for safe transmission, but attackers may abuse it to conceal malicious payloads. This detection focuses on identifying unusual or unexpected Base64 decoding processes, particularly when associated with critical files or directories. By monitoring these activities, the analytic helps uncover potential threats, enabling security teams to respond promptly and mitigate risks associated with encoded malware or unauthorized data access. +type: TTP +description: The following analytic detects the use of the 'chown' command to change + a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically + monitoring command-line executions and process details. This activity is significant + as it may indicate an attempt to escalate privileges by adversaries, malware, or + red teamers. If confirmed malicious, this action could allow an attacker to gain + root-level access, leading to full control over the compromised host and potential + persistence within the environment. data_source: -- Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE(process_exec, "%base64%") AND (LIKE(process_exec, "%-d %") OR LIKE(process_exec, "% --d%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_base64_decode_files_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +- Linux Auditd Proctitle +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as + dest | where LIKE (process_exec, "%chown %root%") | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_change_file_owner_to_root_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: -- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html -- https://gtfobins.github.io/gtfobins/dd/ +- https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users +- https://askubuntu.com/questions/617850/changing-from-user-to-superuser drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$process_exec$] event occurred on host - [$dest$] to decode a file using - base64. + message: A [$process_exec$] event occurred on host - [$dest$] to change a file owner + to root. risk_objects: - field: dest type: system - score: 25 + score: 64 threat_objects: [] tags: analytic_story: @@ -39,7 +63,8 @@ tags: - Compromised Linux Host asset_type: Endpoint mitre_attack_id: - - T1140 + - T1222.002 + - T1222 product: - Splunk Enterprise - Splunk Enterprise Security @@ -48,6 +73,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/linux_auditd_base64/linux_auditd_base64.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_chown_root/linux_auditd_chown_root.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index 798a41de8e..f78ea55eae 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -1,16 +1,35 @@ name: Linux Auditd Data Transfer Size Limits Via Split Syscall id: c03d4a49-cf9d-435b-86e9-c6f8c9b6c42e version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious data transfer activities that involve the use of the `split` syscall, potentially indicating an attempt to evade detection by breaking large files into smaller parts. Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network. +description: The following analytic detects suspicious data transfer activities that + involve the use of the `split` syscall, potentially indicating an attempt to evade + detection by breaking large files into smaller parts. Attackers may use this technique + to bypass size-based security controls, facilitating the covert exfiltration of + sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall, + this analytic helps identify potential data exfiltration attempts, allowing security + teams to intervene and prevent the unauthorized transfer of critical information + from the network. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=split OR exe= "*/split" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_data_transfer_size_limits_via_split_syscall_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SYSCALL comm=split OR exe= "*/split" | rename host as + dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL + UID ppid pid success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_data_transfer_size_limits_via_split_syscall_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -19,7 +38,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -47,6 +71,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/linux_auditd_split_syscall/linux_auditd_split_syscall.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/linux_auditd_split_syscall/linux_auditd_split_syscall.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index 6c9556388c..9d205070c0 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -1,16 +1,35 @@ name: Linux Auditd Dd File Overwrite id: d1b74420-4cea-4752-a123-9b40dfcca49a version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the use of the 'dd' command to overwrite files on a Linux system. It leverages data from Linux Auditd telemetry, focusing on process execution logs that include command-line details. This activity is significant because adversaries often use the 'dd' command to destroy or irreversibly overwrite files, disrupting system availability and services. If confirmed malicious, this behavior could lead to data destruction, making recovery difficult and potentially causing significant operational disruptions. +description: The following analytic detects the use of the 'dd' command to overwrite + files on a Linux system. It leverages data from Linux Auditd telemetry, focusing + on process execution logs that include command-line details. This activity is significant + because adversaries often use the 'dd' command to destroy or irreversibly overwrite + files, disrupting system availability and services. If confirmed malicious, this + behavior could lead to data destruction, making recovery difficult and potentially + causing significant operational disruptions. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE(process_exec, "%dd %") AND LIKE(process_exec, "% of=%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_dd_file_overwrite_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE(process_exec, "%dd %") AND LIKE(process_exec, "% of=%") | stats + count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_dd_file_overwrite_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://gtfobins.github.io/gtfobins/dd/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md @@ -20,7 +39,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -46,6 +70,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_dd_overwrite/linux_auditd_dd_overwrite.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_dd_overwrite/linux_auditd_dd_overwrite.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index f1a1585c55..fe40910ff2 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -1,16 +1,34 @@ name: Linux Auditd Disable Or Modify System Firewall id: 07052556-d4b5-4bae-89aa-cbdc1bb11250 version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the suspicious disable or modify system firewall. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents. +description: The following analytic detects the suspicious disable or modify system + firewall. This behavior is critical for a SOC to monitor because it may indicate + attempts to gain unauthorized access or maintain control over a system. Such actions + could be signs of malicious activity. If confirmed, this could lead to serious consequences, + including a compromised system, unauthorized access to sensitive data, or even a + wider breach affecting the entire network. Detecting and responding to these signs + early is essential to prevent potential security incidents. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_disable_or_modify_system_firewall_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SERVICE_STOP unit IN ("firewalld", "ufw") | rename host + as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid + UID comm exe unit dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_disable_or_modify_system_firewall_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -19,7 +37,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -48,6 +71,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/linux_auditd_disable_firewall/linux_auditd_disable_firewall.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/linux_auditd_disable_firewall/linux_auditd_disable_firewall.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 55c71d3dd9..b5d39b01ed 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -1,16 +1,34 @@ name: Linux Auditd Doas Conf File Creation id: 61059783-574b-40d2-ac2f-69b898afd6b4 version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the creation of the doas.conf file on a Linux host. This file is used by the doas utility to allow standard users to perform tasks as root, similar to sudo. The detection leverages Linux Auditd data, focusing on the creation of the doas.conf file. This activity is significant because it can indicate an attempt to gain elevated privileges, potentially by an adversary. If confirmed malicious, this could allow an attacker to execute commands with root commands with root privileges, leading to full system compromise. +description: The following analytic detects the creation of the doas.conf file on + a Linux host. This file is used by the doas utility to allow standard users to perform + tasks as root, similar to sudo. The detection leverages Linux Auditd data, focusing + on the creation of the doas.conf file. This activity is significant because it can + indicate an attempt to gain elevated privileges, potentially by an adversary. If + confirmed malicious, this could allow an attacker to execute commands with root + commands with root privileges, leading to full system compromise. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_doas_conf_file_creation_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=PATH name ="/etc/doas.conf*" | rename host as dest | + stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID + type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_doas_conf_file_creation_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://wiki.gentoo.org/wiki/Doas - https://www.makeuseof.com/how-to-install-and-use-doas/ @@ -20,7 +38,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -47,6 +70,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_audited_doas_conf/linux_audited_doas_conf.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_audited_doas_conf/linux_audited_doas_conf.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index 202bba09f3..77245c77c3 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -1,16 +1,34 @@ name: Linux Auditd Doas Tool Execution id: 91b8ca78-f205-4826-a3ef-cd8d6b24e97b version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the execution of the 'doas' tool on a Linux host. This tool allows standard users to perform tasks with root privileges, similar to 'sudo'. The detection leverages data from Linux Auditd, focusing on process names and command-line executions. This activity is significant as 'doas' can be exploited by adversaries to gain elevated privileges on a compromised host. If confirmed malicious, this could lead to unauthorized administrative access, potentially compromising the entire system. +description: The following analytic detects the execution of the 'doas' tool on a + Linux host. This tool allows standard users to perform tasks with root privileges, + similar to 'sudo'. The detection leverages data from Linux Auditd, focusing on process + names and command-line executions. This activity is significant as 'doas' can be + exploited by adversaries to gain elevated privileges on a compromised host. If confirmed + malicious, this could lead to unauthorized administrative access, potentially compromising + the entire system. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=doas | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_doas_tool_execution_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SYSCALL comm=doas | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid + success dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_doas_tool_execution_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://wiki.gentoo.org/wiki/Doas - https://www.makeuseof.com/how-to-install-and-use-doas/ @@ -20,7 +38,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -48,6 +71,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_doas/linux_auditd_doas.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_doas/linux_auditd_doas.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index 4c16052073..4ad3409e1e 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -1,16 +1,35 @@ name: Linux Auditd Edit Cron Table Parameter id: f4bb7321-7e64-4d1e-b1aa-21f8b019a91f version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the suspicious editing of cron jobs in Linux using the crontab command-line parameter (-e). It identifies this activity by monitoring command-line executions involving 'crontab' and the edit parameter. This behavior is significant for a SOC as cron job manipulations can indicate unauthorized persistence attempts or scheduled malicious actions. If confirmed malicious, this activity could lead to system compromise, unauthorized access, or broader network compromise. +description: The following analytic detects the suspicious editing of cron jobs in + Linux using the crontab command-line parameter (-e). It identifies this activity + by monitoring command-line executions involving 'crontab' and the edit parameter. + This behavior is significant for a SOC as cron job manipulations can indicate unauthorized + persistence attempts or scheduled malicious actions. If confirmed malicious, this + activity could lead to system compromise, unauthorized access, or broader network + compromise. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL SYSCALL=rename (comm IN ("crontab") OR exe IN ("*/crontab")) success=yes AND NOT (UID IN("daemon")) | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_edit_cron_table_parameter_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SYSCALL SYSCALL=rename (comm IN ("crontab") OR exe IN + ("*/crontab")) success=yes AND NOT (UID IN("daemon")) | rename host as dest | stats + count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid + pid dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_edit_cron_table_parameter_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1053/003/ drilldown_searches: @@ -19,7 +38,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -49,6 +73,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_crontab_edit/linux_auditd_crontab_edit.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_crontab_edit/linux_auditd_crontab_edit.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index c242b8d08f..ca781680fa 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -1,16 +1,35 @@ name: Linux Auditd Kernel Module Using Rmmod Utility id: 31810b7a-0abe-42be-a210-0dec8106afee version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious use of the `rmmod` utility for kernel module removal, which may indicate an attacker attempt to unload critical or security-related kernel modules. The `rmmod` command is used to remove modules from the Linux kernel, and unauthorized use can be a tactic to disable security features, conceal malicious activities, or disrupt system operations. By monitoring for unusual or unauthorized `rmmod` activity, this analytic helps identify potential tampering with kernel modules, enabling security teams to take proactive measures to protect system integrity and security. +description: The following analytic detects suspicious use of the `rmmod` utility + for kernel module removal, which may indicate an attacker attempt to unload critical + or security-related kernel modules. The `rmmod` command is used to remove modules + from the Linux kernel, and unauthorized use can be a tactic to disable security + features, conceal malicious activities, or disrupt system operations. By monitoring + for unusual or unauthorized `rmmod` activity, this analytic helps identify potential + tampering with kernel modules, enabling security teams to take proactive measures + to protect system integrity and security. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=rmmod | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_kernel_module_using_rmmod_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SYSCALL comm=rmmod | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid + success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_kernel_module_using_rmmod_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -19,7 +38,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -48,6 +72,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_rmmod/linux_auditd_rmmod.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_rmmod/linux_auditd_rmmod.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 3720c29aba..9b21168ed5 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -1,16 +1,35 @@ name: Linux Auditd Nopasswd Entry In Sudoers File id: 651df959-ad17-4b73-a323-90cb96d5fa1b version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the addition of NOPASSWD entries to the /etc/sudoers file on Linux systems. It leverages Linux Auditd data to identify command lines containing "NOPASSWD:". This activity is significant because it allows users to execute commands with elevated privileges without requiring a password, which can be exploited by adversaries to maintain persistent, privileged access. If confirmed malicious, this could lead to unauthorized privilege escalation, persistent access, and potential compromise of sensitive data and system integrity. +description: The following analytic detects the addition of NOPASSWD entries to the + /etc/sudoers file on Linux systems. It leverages Linux Auditd data to identify command + lines containing "NOPASSWD:". This activity is significant because it allows users + to execute commands with elevated privileges without requiring a password, which + can be exploited by adversaries to maintain persistent, privileged access. If confirmed + malicious, this could lead to unauthorized privilege escalation, persistent access, + and potential compromise of sensitive data and system integrity. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, "%NOPASSWD%") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_nopasswd_entry_in_sudoers_file_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE (process_exec, "%NOPASSWD%") | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_nopasswd_entry_in_sudoers_file_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://askubuntu.com/questions/334318/sudoers-file-enable-nopasswd-for-user-all-commands - https://help.ubuntu.com/community/Sudoers @@ -20,7 +39,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -48,6 +72,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index 3bdf4cc7ec..7d488b6bc3 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -1,16 +1,35 @@ name: Linux Auditd Osquery Service Stop id: 0c320fea-6e87-4b99-a884-74d09d4b655d version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious stopping of the `osquery` service, which may indicate an attempt to disable monitoring and evade detection. `Osquery` is a powerful tool used for querying system information and detecting anomalies, and stopping its service can be a sign that an attacker is trying to disrupt security monitoring or hide malicious activities. By monitoring for unusual or unauthorized stops of the `osquery` service, this analytic helps identify potential efforts to bypass security controls, enabling security teams to investigate and respond to possible threats effectively. +description: The following analytic detects suspicious stopping of the `osquery` service, + which may indicate an attempt to disable monitoring and evade detection. `Osquery` + is a powerful tool used for querying system information and detecting anomalies, + and stopping its service can be a sign that an attacker is trying to disrupt security + monitoring or hide malicious activities. By monitoring for unusual or unauthorized + stops of the `osquery` service, this analytic helps identify potential efforts to + bypass security controls, enabling security teams to investigate and respond to + possible threats effectively. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_osquery_service_stop_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SERVICE_STOP unit IN ("osqueryd") | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm + exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_osquery_service_stop_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -19,7 +38,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -47,6 +71,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_osquerd_service_stop/linux_auditd_osquerd_service_stop.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_osquerd_service_stop/linux_auditd_osquerd_service_stop.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index 70e240b1dc..68d0ffc22c 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -1,16 +1,35 @@ name: Linux Auditd Possible Access Or Modification Of Sshd Config File id: acb3ea33-70f7-47aa-b335-643b3aebcb2f version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious access or modification of the sshd_config file on Linux systems. It leverages data from Linux Auditd, focusing on command-line executions involving processes like "cat," "nano," "vim," and "vi" accessing the sshd_config file. This activity is significant because unauthorized changes to sshd_config can allow threat actors to redirect port connections or use unauthorized keys, potentially compromising the system. If confirmed malicious, this could lead to unauthorized access, privilege escalation, or persistent backdoor access, posing a severe security risk. +description: The following analytic detects suspicious access or modification of the + sshd_config file on Linux systems. It leverages data from Linux Auditd, focusing + on command-line executions involving processes like "cat," "nano," "vim," and "vi" + accessing the sshd_config file. This activity is significant because unauthorized + changes to sshd_config can allow threat actors to redirect port connections or use + unauthorized keys, potentially compromising the system. If confirmed malicious, + this could lead to unauthorized access, privilege escalation, or persistent backdoor + access, posing a severe security risk. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=PATH name="/etc/ssh/ssh_config*" | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID + type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_possible_access_or_modification_of_sshd_config_file_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this commandline + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.hackingarticles.in/ssh-penetration-testing-port-22/ - https://attack.mitre.org/techniques/T1098/004/ @@ -20,7 +39,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -49,6 +73,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/linux_auditd_nopasswd/linux_auditd_ssh_config.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/linux_auditd_nopasswd/linux_auditd_ssh_config.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index d1b5f03bb9..3a4c356dff 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -1,16 +1,37 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects attempts to access or dump the contents of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Linux Auditd, focusing on processes like 'cat', 'nano', 'vim', and 'vi' accessing these files. This activity is significant as it may indicate credential dumping, a technique used by adversaries to gain persistence or escalate privileges. If confirmed malicious, privileges. If confirmed malicious, attackers could obtain hashed passwords for offline cracking, leading to unauthorized access and potential system compromise. +description: The following analytic detects attempts to access or dump the contents + of /etc/passwd and /etc/shadow files on Linux systems. It leverages data from Linux + Auditd, focusing on processes like 'cat', 'nano', 'vim', and 'vi' accessing these + files. This activity is significant as it may indicate credential dumping, a technique + used by adversaries to gain persistence or escalate privileges. If confirmed malicious, + privileges. If confirmed malicious, attackers could obtain hashed passwords for + offline cracking, leading to unauthorized access and potential system compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE (process_exec, "%shadow%") OR LIKE (process_exec, "%passwd%")) AND (LIKE (process_exec, "%cat %") OR LIKE (process_exec, "%nano %")OR LIKE (process_exec, "%vim %") OR LIKE (process_exec, "%vi %")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_credential_files_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where (LIKE (process_exec, "%shadow%") OR LIKE (process_exec, "%passwd%")) + AND (LIKE (process_exec, "%cat %") OR LIKE (process_exec, "%nano %")OR LIKE (process_exec, + "%vim %") OR LIKE (process_exec, "%vi %")) | stats count min(_time) as firstTime + max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter + dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_possible_access_to_credential_files_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://askubuntu.com/questions/445361/what-is-difference-between-etc-shadow-and-etc-passwd - https://attack.mitre.org/techniques/T1003/008/ @@ -20,7 +41,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -48,6 +74,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index b7ae713fdb..e9c03d6886 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -1,16 +1,34 @@ name: Linux Auditd Possible Access To Sudoers File id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects potential access or modification of the /etc/sudoers file on a Linux system. It leverages data from Linux Auditd, focusing on processes like "cat," "nano," "vim," and "vi" accessing the /etc/sudoers file. This activity is significant because the sudoers file controls user permissions for executing commands with elevated privileges. If confirmed malicious, an attacker could gain persistence or escalate privileges, compromising the security of the targeted host. +description: The following analytic detects potential access or modification of the + /etc/sudoers file on a Linux system. It leverages data from Linux Auditd, focusing + on processes like "cat," "nano," "vim," and "vi" accessing the /etc/sudoers file. + This activity is significant because the sudoers file controls user permissions + for executing commands with elevated privileges. If confirmed malicious, an attacker + could gain persistence or escalate privileges, compromising the security of the + targeted host. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/sudoers*" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_possible_access_to_sudoers_file_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: administrator or network operator can execute this command. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=PATH name="/etc/sudoers*" | rename host as dest | stats + count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type + dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_possible_access_to_sudoers_file_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1548/003/ - https://web.archive.org/web/20210708035426/https://www.cobaltstrike.com/downloads/csmanual43.pdf @@ -20,7 +38,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -48,6 +71,8 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log source: /var/log/audit/audit.log sourcetype: linux:audit + \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml index b404a42ce6..d80e3059c5 100644 --- a/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_auditd_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -54,6 +54,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_auditd_cron_file_audited2.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_cron_file_audited/linux_auditd_cron_file_audited2.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index d44e083fbb..1090b25606 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -1,16 +1,35 @@ name: Linux Auditd Preload Hijack Via Preload File id: c1b7abca-55cb-4a39-bdfb-e28c1c12745f version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious preload hijacking via the `preload` file, which may indicate an attacker's attempt to intercept or manipulate library loading processes. The `preload` file can be used to force the loading of specific libraries before others, potentially allowing malicious code to execute or alter application behavior. By monitoring for unusual or unauthorized modifications to the `preload` file, this analytic helps identify attempts to hijack preload mechanisms, enabling security teams to investigate and address potential threats to system integrity and security. +description: The following analytic detects suspicious preload hijacking via the `preload` + file, which may indicate an attacker's attempt to intercept or manipulate library + loading processes. The `preload` file can be used to force the loading of specific + libraries before others, potentially allowing malicious code to execute or alter + application behavior. By monitoring for unusual or unauthorized modifications to + the `preload` file, this analytic helps identify attempts to hijack preload mechanisms, + enabling security teams to investigate and address potential threats to system integrity + and security. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_via_preload_file_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=PATH name="/etc/ld.so.preload*" | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID + type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_preload_hijack_via_preload_file_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -19,7 +38,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -47,6 +71,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_preload_file/linux_auditd_preload_file.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/linux_auditd_preload_file/linux_auditd_preload_file.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml index 0e5f984f6a..2ff0bce4f1 100644 --- a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml +++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml @@ -1,30 +1,55 @@ -name: Linux Auditd Private Keys and Certificate Enumeration -id: 80bb9988-190b-4ee0-a3c3-509545a8f678 -version: 4 -date: '2025-01-15' +name: Linux Auditd Install Kernel Module Using Modprobe Utility +id: 95165985-ace5-4d42-9c42-93a89a5af901 +version: 3 +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information. +description: The following analytic detects the installation of a Linux kernel module + using the modprobe utility. It leverages data from Linux Auditd, focusing on process + names and command-line executions. This activity is significant because installing + a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level + code, potentially leading to elevated privileges and bypassing security detections. + If confirmed malicious, this could allow an attacker to gain persistent, high-level + access to the system, compromising its integrity and security. data_source: -- Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%") OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_private_keys_and_certificate_enumeration_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +- Linux Auditd Syscall +search: '`linux_auditd` type=SYSCALL comm=modprobe | rename host as dest | stats count + min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid + success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: -- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html -- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ +- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup +- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$process_exec$] event occurred on host - [$dest$] to find private keys. + message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to install a + Linux kernel module using the modprobe utility. risk_objects: - field: dest type: system @@ -32,14 +57,14 @@ rba: threat_objects: [] tags: analytic_story: - - Linux Living Off The Land - Linux Privilege Escalation + - Linux Rootkit - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint mitre_attack_id: - - T1552.004 - - T1552 + - T1547.006 + - T1547 product: - Splunk Enterprise - Splunk Enterprise Security @@ -48,6 +73,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_gpg/linux_auditd_find_gpg.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe/linux_auditd_modprobe.log source: /var/log/audit/audit.log - sourcetype: linux:audit + sourcetype: linux:audit \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_service_restarted.yml b/detections/endpoint/linux_auditd_service_restarted.yml index e70eac26b5..a619b94f79 100644 --- a/detections/endpoint/linux_auditd_service_restarted.yml +++ b/detections/endpoint/linux_auditd_service_restarted.yml @@ -1,16 +1,36 @@ name: Linux Auditd Service Restarted id: 8eb3e858-18d3-44a4-a514-52cfa39f154a version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the restarting or re-enabling of services on Linux systems using the `systemctl` or `service` commands. It leverages data from Linux Auditd, focusing on process and command-line execution logs. This activity is significant as adversaries may use it to maintain persistence or execute unauthorized actions. If confirmed malicious, this behavior could lead to repeated execution of malicious payloads, unauthorized access, or data destruction. Security analysts should investigate these events to mitigate risks and prevent further compromise. +description: The following analytic detects the restarting or re-enabling of services + on Linux systems using the `systemctl` or `service` commands. It leverages data + from Linux Auditd, focusing on process and command-line execution logs. This activity + is significant as adversaries may use it to maintain persistence or execute unauthorized + actions. If confirmed malicious, this behavior could lead to repeated execution + of malicious payloads, unauthorized access, or data destruction. Security analysts + should investigate these events to mitigate risks and prevent further compromise. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "%restart%") OR LIKE(process_exec, "%reenable%") OR LIKE(process_exec, "%reload%")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_service_restarted_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this commandline for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service + %") ) AND(LIKE(process_exec, "%restart%") OR LIKE(process_exec, "%reenable%") OR + LIKE(process_exec, "%reload%")) | stats count min(_time) as firstTime max(_time) + as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_service_restarted_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this commandline + for automation purposes. Please update the filter macros to remove false positives. references: - https://attack.mitre.org/techniques/T1543/003/ drilldown_searches: @@ -19,7 +39,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -52,6 +77,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/linux_services_restart/linux_services_restart.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.006/linux_services_restart/linux_services_restart.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_service_started.yml b/detections/endpoint/linux_auditd_service_started.yml index aeb9364bc8..2e878c1779 100644 --- a/detections/endpoint/linux_auditd_service_started.yml +++ b/detections/endpoint/linux_auditd_service_started.yml @@ -1,16 +1,36 @@ name: Linux Auditd Service Started id: b5eed06d-5c97-4092-a3a1-fa4b7e77c71a version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the suspicious service started. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents. +description: The following analytic detects the suspicious service started. This behavior + is critical for a SOC to monitor because it may indicate attempts to gain unauthorized + access or maintain control over a system. Such actions could be signs of malicious + activity. If confirmed, this could lead to serious consequences, including a compromised + system, unauthorized access to sensitive data, or even a wider breach affecting + the entire network. Detecting and responding to these signs early is essential to + prevent potential security incidents. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service %") ) AND(LIKE(process_exec, "% start %") OR LIKE(process_exec, "% enable %")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_service_started_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where (LIKE(process_exec, "%systemctl %") OR LIKE(process_exec, "%service + %") ) AND(LIKE(process_exec, "% start %") OR LIKE(process_exec, "% enable %")) | + stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle + normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_service_started_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -19,7 +39,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -48,6 +73,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/linux_service_start/linux_service_start.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/linux_service_start/linux_service_start.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml index d958d0309d..7c32e22160 100644 --- a/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_auditd_setuid_using_chmod_utility.yml @@ -1,16 +1,36 @@ name: Linux Auditd Setuid Using Chmod Utility id: 8230c407-1b47-4d95-ac2e-718bd6381386 version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the execution of the chmod utility to set the SUID or SGID bit on files, which can allow users to temporarily gain root or group-level access. This detection leverages data from Linux Auditd, focusing on process names and command-line arguments related to chmod. This activity is significant as it can indicate an attempt to escalate privileges or maintain persistence on a system. If confirmed malicious, an attacker could gain elevated access, potentially compromising sensitive data or critical system functions. +description: The following analytic detects the execution of the chmod utility to + set the SUID or SGID bit on files, which can allow users to temporarily gain root + or group-level access. This detection leverages data from Linux Auditd, focusing + on process names and command-line arguments related to chmod. This activity is significant + as it can indicate an attempt to escalate privileges or maintain persistence on + a system. If confirmed malicious, an attacker could gain elevated access, potentially + compromising sensitive data or critical system functions. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, "%chmod %") AND (LIKE (process_exec, "% u+s %") OR LIKE (process_exec, "% g+s %") OR LIKE (process_exec, "% 4777 %") OR LIKE (process_exec, "% 4577 %")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_chmod_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE (process_exec, "%chmod %") AND (LIKE (process_exec, "% u+s + %") OR LIKE (process_exec, "% g+s %") OR LIKE (process_exec, "% 4777 %") OR LIKE + (process_exec, "% 4577 %")) | stats count min(_time) as firstTime max(_time) as + lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`| `linux_auditd_setuid_using_chmod_utility_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/ drilldown_searches: @@ -19,7 +39,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -48,6 +73,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_auditd_setuid/linux_auditd_setuid.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/linux_auditd_setuid/linux_auditd_setuid.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_shred_overwrite_command.yml b/detections/endpoint/linux_auditd_shred_overwrite_command.yml index bcd4d675a9..6d09005763 100644 --- a/detections/endpoint/linux_auditd_shred_overwrite_command.yml +++ b/detections/endpoint/linux_auditd_shred_overwrite_command.yml @@ -1,16 +1,36 @@ name: Linux Auditd Shred Overwrite Command id: ce2bde4d-a1d4-4452-8c87-98440e5adfb3 version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the execution of the 'shred' command on a Linux machine, which is used to overwrite files to make them unrecoverable. It leverages data from Linux Auditd, focusing on process names and command-line arguments. This activity is significant because the 'shred' command can be used in destructive attacks, such as those seen in the Industroyer2 malware targeting energy facilities. If confirmed malicious, this activity could lead to the permanent destruction of critical files, severely impacting system integrity and data availability. +description: The following analytic detects the execution of the 'shred' command on + a Linux machine, which is used to overwrite files to make them unrecoverable. It + leverages data from Linux Auditd, focusing on process names and command-line arguments. + This activity is significant because the 'shred' command can be used in destructive + attacks, such as those seen in the Industroyer2 malware targeting energy facilities. + If confirmed malicious, this activity could lead to the permanent destruction of + critical files, severely impacting system integrity and data availability. data_source: - Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host as dest | where LIKE (process_exec, "%shred%") AND (LIKE (process_exec, "%-n%") OR LIKE (process_exec, "%-z%") OR LIKE (process_exec, "%-u%") OR LIKE (process_exec, "%-s%")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_shred_overwrite_command_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename host + as dest | where LIKE (process_exec, "%shred%") AND (LIKE (process_exec, "%-n%") + OR LIKE (process_exec, "%-z%") OR LIKE (process_exec, "%-u%") OR LIKE (process_exec, + "%-s%")) | stats count min(_time) as firstTime max(_time) as lastTime by process_exec + proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `linux_auditd_shred_overwrite_command_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.welivesecurity.com/2022/04/12/industroyer2-industroyer-reloaded/ - https://cert.gov.ua/article/39518 @@ -20,7 +40,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -50,6 +75,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_shred/linux_auditd_shred.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_shred/linux_auditd_shred.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index 2cb80778a0..fd87cbaabc 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -1,16 +1,34 @@ name: Linux Auditd Sysmon Service Stop id: 20901256-633a-40de-8753-7b88811a460f version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the suspicious sysmon service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents. +description: The following analytic detects the suspicious sysmon service stop. This + behavior is critical for a SOC to monitor because it may indicate attempts to gain + unauthorized access or maintain control over a system. Such actions could be signs + of malicious activity. If confirmed, this could lead to serious consequences, including + a compromised system, unauthorized access to sensitive data, or even a wider breach + affecting the entire network. Detecting and responding to these signs early is essential + to prevent potential security incidents. data_source: - Linux Auditd Service Stop -search: '`linux_auditd` type=SERVICE_STOP unit IN ("sysmon") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_sysmon_service_stop_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SERVICE_STOP unit IN ("sysmon") | rename host as dest + | stats count min(_time) as firstTime max(_time) as lastTime by type pid UID comm + exe unit dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_sysmon_service_stop_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -19,7 +37,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -47,6 +70,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_sysmon_service_stop.log/linux_auditd_sysmon_service_stop.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_sysmon_service_stop.log/linux_auditd_sysmon_service_stop.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml index 8691c24bfe..b518e8fa93 100644 --- a/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml +++ b/detections/endpoint/linux_auditd_system_network_configuration_discovery.yml @@ -1,16 +1,38 @@ name: Linux Auditd System Network Configuration Discovery id: 5db16825-81bd-4923-a8d6-d6a13a59832a version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. Such actions typically involve commands or tools used to identify network interfaces, routing tables, and active connections. Detecting these activities is crucial, as they often precede more targeted attacks like lateral movement or data exfiltration. By identifying unusual or unauthorized network discovery efforts, this analytic helps security teams to swiftly detect and respond to potential reconnaissance operations, mitigating the risk of further compromise. +description: The following analytic detects suspicious system network configuration + discovery activities, which may indicate an adversary's attempt to gather information + about the network environment. Such actions typically involve commands or tools + used to identify network interfaces, routing tables, and active connections. Detecting + these activities is crucial, as they often precede more targeted attacks like lateral + movement or data exfiltration. By identifying unusual or unauthorized network discovery + efforts, this analytic helps security teams to swiftly detect and respond to potential + reconnaissance operations, mitigating the risk of further compromise. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm IN ("arp", "ifconfig", "ip", "netstat", "firewall-cmd", "ufw", "iptables", "ss", "route") | bucket _time span=15m | rename host as dest | stats dc(comm) as unique_commands, values(comm) as comm, values(exe) as exe, values(SYSCALL) as SYSCALL, values(UID) as UID, values(ppid) as ppid, values(pid) as pid, count, min(_time) as firstTime, max(_time) as lastTime by success dest | where unique_commands >= 4 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `linux_auditd_system_network_configuration_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SYSCALL comm IN ("arp", "ifconfig", "ip", "netstat", + "firewall-cmd", "ufw", "iptables", "ss", "route") | bucket _time span=15m | rename + host as dest | stats dc(comm) as unique_commands, values(comm) as comm, values(exe) + as exe, values(SYSCALL) as SYSCALL, values(UID) as UID, values(ppid) as ppid, values(pid) + as pid, count, min(_time) as firstTime, max(_time) as lastTime by success dest | + where unique_commands >= 4 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `linux_auditd_system_network_configuration_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html drilldown_searches: @@ -19,7 +41,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -47,6 +74,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/linux_auditd_net_tool/linux_auditd_net_tool.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/linux_auditd_net_tool/linux_auditd_net_tool.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 9b4c91ba32..43a4fbf7f8 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -1,16 +1,40 @@ name: Linux Auditd Unix Shell Configuration Modification id: 66f737c6-3f7f-46ed-8e9b-cc0e5bf01f04 version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects suspicious modifications to Unix shell configuration files, which may indicate an attempt to alter system behavior or gain unauthorized access. Unix shell configuration files, such as `.bashrc` or `.profile`, control user environment settings and command execution. Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks. +description: The following analytic detects suspicious modifications to Unix shell + configuration files, which may indicate an attempt to alter system behavior or gain + unauthorized access. Unix shell configuration files, such as `.bashrc` or `.profile`, + control user environment settings and command execution. Unauthorized changes to + these files can be used to execute malicious commands, escalate privileges, or hide + malicious activities. By monitoring for unusual or unauthorized modifications to + shell configuration files, this analytic helps identify potential security threats, + allowing security teams to respond quickly and mitigate risks. data_source: - Linux Auditd Path -search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/profile.d", "/etc/bash.bashrc", "/etc/bashrc", "/etc/zsh/zprofile", "/etc/zsh/zshrc", "/etc/zsh/zlogin", "/etc/zsh/zlogout", "/etc/csh.cshrc", "/etc/csh.login", "/root/.bashrc", "/root/.bash_profile", "root/.profile", "/root/.zshrc", "/root/.zprofile", "/home/*/.bashrc", "/home/*/.zshrc", "/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login", "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_unix_shell_configuration_modification_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=PATH name IN ("/etc/profile", "/etc/shells", "/etc/profile.d", + "/etc/bash.bashrc", "/etc/bashrc", "/etc/zsh/zprofile", "/etc/zsh/zshrc", "/etc/zsh/zlogin", + "/etc/zsh/zlogout", "/etc/csh.cshrc", "/etc/csh.login", "/root/.bashrc", "/root/.bash_profile", + "root/.profile", "/root/.zshrc", "/root/.zprofile", "/home/*/.bashrc", "/home/*/.zshrc", + "/home/*/.bash_profile", "/home/*/.zprofile", "/home/*/.profile", "/home/*/.bash_login", + "/home/*/.bash_logout", "/home/*/.zlogin", "/home/*/.zlogout") | rename host as + dest | stats count min(_time) as firstTime max(_time) as lastTime by name nametype + OGID type dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_unix_shell_configuration_modification_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -20,7 +44,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -49,6 +78,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_auditd_unix_shell_mod_config.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_auditd_unix_shell_mod_config/linux_auditd_unix_shell_mod_config.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_whoami_user_discovery.yml b/detections/endpoint/linux_auditd_whoami_user_discovery.yml index b940269f1e..275d9ac8f4 100644 --- a/detections/endpoint/linux_auditd_whoami_user_discovery.yml +++ b/detections/endpoint/linux_auditd_whoami_user_discovery.yml @@ -1,16 +1,35 @@ name: Linux Auditd Whoami User Discovery id: d1ff2e22-310d-446a-80b3-faedaa7b3b52 version: 3 -date: '2025-01-20' +date: '2024-11-13' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the suspicious use of the whoami command, which may indicate an attacker trying to gather information about the current user account on a compromised system. The whoami command is commonly used to verify user privileges and identity, especially during initial stages of an attack to assess the level of access. By monitoring for unusual or unauthorized executions of whoami, this analytic helps in identifying potential reconnaissance activities, enabling security teams to take action before the attacker escalates privileges or conducts further malicious operations. +description: The following analytic detects the suspicious use of the whoami command, + which may indicate an attacker trying to gather information about the current user + account on a compromised system. The whoami command is commonly used to verify user + privileges and identity, especially during initial stages of an attack to assess + the level of access. By monitoring for unusual or unauthorized executions of whoami, + this analytic helps in identifying potential reconnaissance activities, enabling + security teams to take action before the attacker escalates privileges or conducts + further malicious operations. data_source: - Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami" | rename host as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid dest success | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_whoami_user_discovery_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. +search: '`linux_auditd` type=SYSCALL comm=whoami OR exe= "*/whoami" | rename host + as dest | stats count min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL + UID ppid pid dest success | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| + `linux_auditd_whoami_user_discovery_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: - https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html - https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS @@ -20,7 +39,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -48,6 +72,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/linux_auditd_whoami/linux_auditd_whoami.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1033/linux_auditd_whoami/linux_auditd_whoami.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 13f823f51e..40f522d2cb 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -1,16 +1,28 @@ name: Print Spooler Failed to Load a Plug-in id: 1adc9548-da7c-11eb-8f13-acde48001122 version: 4 -date: '2025-01-20' +date: '2024-11-13' author: Mauricio Velazco, Michael Haag, Splunk status: production type: TTP -description: The following analytic detects driver load errors in the Windows PrintService Admin logs, specifically identifying issues related to CVE-2021-34527 (PrintNightmare). It triggers on error messages indicating the print spooler failed to load a plug-in module, such as "meterpreter.dll," with error code 0x45A. This detection method leverages specific event codes and error messages. This activity is significant as it may indicate an exploitation attempt of a known vulnerability. If confirmed malicious, an attacker could gain unauthorized code execution on the affected system, leading to potential system compromise. +description: The following analytic detects driver load errors in the Windows PrintService + Admin logs, specifically identifying issues related to CVE-2021-34527 (PrintNightmare). + It triggers on error messages indicating the print spooler failed to load a plug-in + module, such as "meterpreter.dll," with error code 0x45A. This detection method + leverages specific event codes and error messages. This activity is significant + as it may indicate an exploitation attempt of a known vulnerability. If confirmed + malicious, an attacker could gain unauthorized code execution on the affected system, + leading to potential system compromise. data_source: - Windows Event Log Printservice 808 - Windows Event Log Printservice 4909 -search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `print_spooler_failed_to_load_a_plug_in_filter`' -how_to_implement: You will need to ensure PrintService Admin and Operational logs are being logged to Splunk from critical or all systems. +search: '`printservice` ((ErrorCode="0x45A" (EventCode="808" OR EventCode="4909")) + OR ("The print spooler failed to load a plug-in module" OR "\\drivers\\x64\\")) + | stats count min(_time) as firstTime max(_time) as lastTime by OpCode EventCode + ComputerName Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `print_spooler_failed_to_load_a_plug_in_filter`' +how_to_implement: You will need to ensure PrintService Admin and Operational logs + are being logged to Splunk from critical or all systems. known_false_positives: False positives are unknown and filtering may be required. references: - https://www.truesec.com/hub/blog/fix-for-printnightmare-cve-2021-1675-exploit-to-keep-your-print-servers-running-while-a-patch-is-not-available @@ -22,7 +34,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$ComputerName$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$ComputerName$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$ComputerName$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -51,6 +68,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_admin.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.012/printnightmare/windows-printservice_admin.log source: WinEventLog:Microsoft-Windows-PrintService/Admin sourcetype: WinEventLog diff --git a/detections/endpoint/windows_service_creation.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml similarity index 55% rename from detections/endpoint/windows_service_creation.yml rename to detections/endpoint/windows_service_creation_using_registry_entry.yml index 1df59c5f1f..c5692d89f0 100644 --- a/detections/endpoint/windows_service_creation.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,25 +1,32 @@ -name: Windows Service Creation +name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 version: 8 -date: '2025-01-03' +date: '2025-01-20' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly -description: The following analytic detects modifications to the "ImagePath" registry value part of registry keys that define Windows services "HKLM\\System\\CurrentControlSet\\Services\\*". This activity can be significant because it indicates potential unauthorized service creation, a common persistence technique used by attackers. If confirmed malicious, this could allow an attacker to maintain access, escalate privileges, or move laterally within the network, leading to data theft, ransomware, or other damaging outcomes. +description: The following analytic detects the modification of registry keys that + define Windows services using reg.exe. This detection leverages Splunk to search + for specific keywords in the registry path, value name, and value data fields. This + activity is significant because it indicates potential unauthorized changes to service + configurations, a common persistence technique used by attackers. If confirmed malicious, + this could allow an attacker to maintain access, escalate privileges, or move laterally + within the network, leading to data theft, ransomware, or other damaging outcomes. data_source: - Sysmon EventID 12 - Sysmon EventID 13 -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry - WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services\\*" Registry.registry_value_name - = ImagePath) BY Registry.dest Registry.user Registry.registry_path +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Registry WHERE (Registry.registry_path="*\\SYSTEM\\CurrentControlSet\\Services*" + Registry.registry_value_name = ImagePath) BY Registry.dest Registry.user Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.registry_value_data Registry.process_guid | `drop_dm_object_name(Registry)` | where isnotnull(registry_value_data) - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_filter`' + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_service_creation_using_registry_entry_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the registry value name, registry path, and registry value data from your endpoints. If you are using Sysmon, you must have at least version 2.0 of the official Sysmon TA. https://splunkbase.splunk.com/app/5709 -known_false_positives: Third party tools may used this technique to create services but not so common. +known_false_positives: Third party tools may used this technique to create services + but not so common. references: - https://github.com/redcanaryco/atomic-red-team/blob/36d49de4c8b00bf36054294b4a1fcbab3917d7c5/atomics/T1574.011/T1574.011.md drilldown_searches: @@ -28,7 +35,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -59,6 +71,7 @@ tags: tests: - name: True Positive Test attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog + sourcetype: XmlWinEventLog \ No newline at end of file From 8b128feb637cc46d167a798092fcadad1da0454a Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 23 Jan 2025 15:18:41 +0100 Subject: [PATCH 54/82] fix typo --- detections/endpoint/linux_auditd_auditd_service_stop.yml | 2 +- .../endpoint/linux_auditd_disable_or_modify_system_firewall.yml | 2 +- detections/endpoint/linux_auditd_doas_conf_file_creation.yml | 2 +- detections/endpoint/linux_auditd_osquery_service_stop.yml | 2 +- .../endpoint/linux_auditd_preload_hijack_via_preload_file.yml | 2 +- detections/endpoint/linux_auditd_sysmon_service_stop.yml | 2 +- .../linux_auditd_unix_shell_configuration_modification.yml | 2 +- detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml | 2 +- 8 files changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index 301ca8ce13..228ac764f5 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -46,7 +46,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] event occured on host - [$dest$]. + message: A service event - [$type$] event occurred on host - [$dest$]. risk_objects: - field: dest type: system diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index fe40910ff2..2e53a48f0c 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -46,7 +46,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] to disable or modify system firewall occured + message: A service event - [$type$] to disable or modify system firewall occurred on host - [$dest$] . risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index b5d39b01ed..35d7bc3e8a 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -47,7 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$type$] event occured on host - [$dest$] to create a doas.conf file. + message: A [$type$] event occurred on host - [$dest$] to create a doas.conf file. risk_objects: - field: dest type: system diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index 7d488b6bc3..e1ba5b69d9 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -47,7 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] event occured on host - [$dest$] to stop the + message: A service event - [$type$] event occurred on host - [$dest$] to stop the osquery service. risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml index 1090b25606..2d5b8c3d5e 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_via_preload_file.yml @@ -47,7 +47,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$type$] event has occured on host - [$dest$] to modify the preload file. + message: A [$type$] event has occurred on host - [$dest$] to modify the preload file. risk_objects: - field: dest type: system diff --git a/detections/endpoint/linux_auditd_sysmon_service_stop.yml b/detections/endpoint/linux_auditd_sysmon_service_stop.yml index fd87cbaabc..64021b8def 100644 --- a/detections/endpoint/linux_auditd_sysmon_service_stop.yml +++ b/detections/endpoint/linux_auditd_sysmon_service_stop.yml @@ -46,7 +46,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A service event - [$type$] event occured on host - [$dest$] to stop or + message: A service event - [$type$] event occurred on host - [$dest$] to stop or disable the sysmon service. risk_objects: - field: dest diff --git a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml index 43a4fbf7f8..50d90725bc 100644 --- a/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml +++ b/detections/endpoint/linux_auditd_unix_shell_configuration_modification.yml @@ -53,7 +53,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$type$] event occured on host - [$dest$] to modify the unix shell configuration + message: A [$type$] event occurred on host - [$dest$] to modify the unix shell configuration file. risk_objects: - field: dest diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 40f522d2cb..5e37c7894e 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -43,7 +43,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: Suspicious printer spooler errors have occured on endpoint $ComputerName$ + message: Suspicious printer spooler errors have occurred on endpoint $ComputerName$ with EventCode $EventCode$. risk_objects: - field: ComputerName From aa1c8fab2d3f6699fc7d274fd342f2b0a3c2bf83 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 23 Jan 2025 15:25:13 +0100 Subject: [PATCH 55/82] add missing eol --- detections/endpoint/linux_auditd_add_user_account.yml | 2 +- detections/endpoint/linux_auditd_add_user_account_type.yml | 2 +- detections/endpoint/linux_auditd_at_application_execution.yml | 2 +- detections/endpoint/linux_auditd_auditd_service_stop.yml | 2 +- detections/endpoint/linux_auditd_base64_decode_files.yml | 2 +- ...linux_auditd_data_transfer_size_limits_via_split_syscall.yml | 2 +- detections/endpoint/linux_auditd_dd_file_overwrite.yml | 2 +- .../endpoint/linux_auditd_disable_or_modify_system_firewall.yml | 2 +- detections/endpoint/linux_auditd_doas_conf_file_creation.yml | 2 +- detections/endpoint/linux_auditd_doas_tool_execution.yml | 2 +- detections/endpoint/linux_auditd_edit_cron_table_parameter.yml | 2 +- .../endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml | 2 +- .../endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml | 2 +- detections/endpoint/linux_auditd_osquery_service_stop.yml | 2 +- ...ditd_possible_access_or_modification_of_sshd_config_file.yml | 2 +- .../linux_auditd_possible_access_to_credential_files.yml | 2 +- .../endpoint/linux_auditd_possible_access_to_sudoers_file.yml | 1 - .../linux_auditd_private_keys_and_certificate_enumeration.yml | 2 +- 18 files changed, 17 insertions(+), 18 deletions(-) diff --git a/detections/endpoint/linux_auditd_add_user_account.yml b/detections/endpoint/linux_auditd_add_user_account.yml index 5de241fc97..900f4b6a4e 100644 --- a/detections/endpoint/linux_auditd_add_user_account.yml +++ b/detections/endpoint/linux_auditd_add_user_account.yml @@ -73,4 +73,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/linux_auditd_add_user/linux_auditd_add_user.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_add_user_account_type.yml b/detections/endpoint/linux_auditd_add_user_account_type.yml index ae4cde478a..929dd08741 100644 --- a/detections/endpoint/linux_auditd_add_user_account_type.yml +++ b/detections/endpoint/linux_auditd_add_user_account_type.yml @@ -72,4 +72,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/linux_auditd_add_user_type/linux_auditd_add_user_type.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_at_application_execution.yml b/detections/endpoint/linux_auditd_at_application_execution.yml index 84a3cd77c9..da29fe7c02 100644 --- a/detections/endpoint/linux_auditd_at_application_execution.yml +++ b/detections/endpoint/linux_auditd_at_application_execution.yml @@ -78,4 +78,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_at/linux_auditd_at_execution.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_auditd_service_stop.yml b/detections/endpoint/linux_auditd_auditd_service_stop.yml index 228ac764f5..8efe47b2f9 100644 --- a/detections/endpoint/linux_auditd_auditd_service_stop.yml +++ b/detections/endpoint/linux_auditd_auditd_service_stop.yml @@ -72,4 +72,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_auditd_service_stop/linux_auditd_auditd_service_stop.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index 796827f658..c3afef3870 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -76,4 +76,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_chown_root/linux_auditd_chown_root.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml index f78ea55eae..835309e3f6 100644 --- a/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml +++ b/detections/endpoint/linux_auditd_data_transfer_size_limits_via_split_syscall.yml @@ -74,4 +74,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1030/linux_auditd_split_syscall/linux_auditd_split_syscall.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_dd_file_overwrite.yml b/detections/endpoint/linux_auditd_dd_file_overwrite.yml index 9d205070c0..a37c14e655 100644 --- a/detections/endpoint/linux_auditd_dd_file_overwrite.yml +++ b/detections/endpoint/linux_auditd_dd_file_overwrite.yml @@ -73,4 +73,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/linux_auditd_dd_overwrite/linux_auditd_dd_overwrite.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml index 2e53a48f0c..5dfd17febc 100644 --- a/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml +++ b/detections/endpoint/linux_auditd_disable_or_modify_system_firewall.yml @@ -74,4 +74,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.004/linux_auditd_disable_firewall/linux_auditd_disable_firewall.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml index 35d7bc3e8a..6eea3f2bdf 100644 --- a/detections/endpoint/linux_auditd_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_auditd_doas_conf_file_creation.yml @@ -73,4 +73,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_audited_doas_conf/linux_audited_doas_conf.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_doas_tool_execution.yml b/detections/endpoint/linux_auditd_doas_tool_execution.yml index 77245c77c3..14483461ca 100644 --- a/detections/endpoint/linux_auditd_doas_tool_execution.yml +++ b/detections/endpoint/linux_auditd_doas_tool_execution.yml @@ -74,4 +74,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_doas/linux_auditd_doas.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml index 4ad3409e1e..abcf36a2c5 100644 --- a/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_auditd_edit_cron_table_parameter.yml @@ -76,4 +76,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.003/linux_auditd_crontab_edit/linux_auditd_crontab_edit.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml index ca781680fa..85736a7952 100644 --- a/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml +++ b/detections/endpoint/linux_auditd_kernel_module_using_rmmod_utility.yml @@ -75,4 +75,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_rmmod/linux_auditd_rmmod.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 9b21168ed5..2f6788506b 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -75,4 +75,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_osquery_service_stop.yml b/detections/endpoint/linux_auditd_osquery_service_stop.yml index e1ba5b69d9..edf2a44c84 100644 --- a/detections/endpoint/linux_auditd_osquery_service_stop.yml +++ b/detections/endpoint/linux_auditd_osquery_service_stop.yml @@ -74,4 +74,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1489/linux_auditd_osquerd_service_stop/linux_auditd_osquerd_service_stop.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml index 68d0ffc22c..965112d606 100644 --- a/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_or_modification_of_sshd_config_file.yml @@ -76,4 +76,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098.004/linux_auditd_nopasswd/linux_auditd_ssh_config.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 3a4c356dff..ce1805c364 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -77,4 +77,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index e9c03d6886..89197c710b 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -75,4 +75,3 @@ tests: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log source: /var/log/audit/audit.log sourcetype: linux:audit - \ No newline at end of file diff --git a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml index 2ff0bce4f1..1769ff5a99 100644 --- a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml +++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml @@ -76,4 +76,4 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe/linux_auditd_modprobe.log source: /var/log/audit/audit.log - sourcetype: linux:audit \ No newline at end of file + sourcetype: linux:audit From 3228a5a53e55bfb2bb1fd99a6376d3d7e8948ae2 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 23 Jan 2025 15:26:29 +0100 Subject: [PATCH 56/82] Update linux_auditd_base64_decode_files.yml --- .../linux_auditd_base64_decode_files.yml | 54 +++++++++---------- 1 file changed, 27 insertions(+), 27 deletions(-) diff --git a/detections/endpoint/linux_auditd_base64_decode_files.yml b/detections/endpoint/linux_auditd_base64_decode_files.yml index c3afef3870..57b3c91b7f 100644 --- a/detections/endpoint/linux_auditd_base64_decode_files.yml +++ b/detections/endpoint/linux_auditd_base64_decode_files.yml @@ -1,24 +1,25 @@ -name: Linux Auditd Change File Owner To Root -id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90 -version: 4 +name: Linux Auditd Base64 Decode Files +id: 5890ba10-4e48-4dc0-8a40-3e1ebe75e737 +version: 3 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production -type: TTP -description: The following analytic detects the use of the 'chown' command to change - a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically - monitoring command-line executions and process details. This activity is significant - as it may indicate an attempt to escalate privileges by adversaries, malware, or - red teamers. If confirmed malicious, this action could allow an attacker to gain - root-level access, leading to full control over the compromised host and potential - persistence within the environment. +type: Anomaly +description: The following analytic detects suspicious Base64 decode operations that + may indicate malicious activity, such as data exfiltration or execution of encoded + commands. Base64 is commonly used to encode data for safe transmission, but attackers + may abuse it to conceal malicious payloads. This detection focuses on identifying + unusual or unexpected Base64 decoding processes, particularly when associated with + critical files or directories. By monitoring these activities, the analytic helps + uncover potential threats, enabling security teams to respond promptly and mitigate + risks associated with encoded malware or unauthorized data access. data_source: -- Linux Auditd Proctitle -search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as - dest | where LIKE (process_exec, "%chown %root%") | stats count min(_time) as firstTime - max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| - `linux_auditd_change_file_owner_to_root_filter`' +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where LIKE(process_exec, "%base64%") AND (LIKE(process_exec, "%-d %") OR + LIKE(process_exec, "% --d%")) | stats count min(_time) as firstTime max(_time) as + lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_base64_decode_files_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested @@ -28,11 +29,11 @@ how_to_implement: To implement this detection, the process begins by ingesting a Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. references: -- https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users -- https://askubuntu.com/questions/617850/changing-from-user-to-superuser +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://gtfobins.github.io/gtfobins/dd/ drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' @@ -48,12 +49,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A [$process_exec$] event occurred on host - [$dest$] to change a file owner - to root. + message: A [$process_exec$] event occurred on host - [$dest$] to decode a file using + base64. risk_objects: - field: dest type: system - score: 64 + score: 25 threat_objects: [] tags: analytic_story: @@ -63,8 +64,7 @@ tags: - Compromised Linux Host asset_type: Endpoint mitre_attack_id: - - T1222.002 - - T1222 + - T1140 product: - Splunk Enterprise - Splunk Enterprise Security @@ -74,6 +74,6 @@ tests: - name: True Positive Test attack_data: - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.002/linux_auditd_chown_root/linux_auditd_chown_root.log + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1140/linux_auditd_base64/linux_auditd_base64.log source: /var/log/audit/audit.log sourcetype: linux:audit From 4b3b3d999353e22512fb193347b58f193dbb5db9 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 23 Jan 2025 15:32:11 +0100 Subject: [PATCH 57/82] Update linux_auditd_private_keys_and_certificate_enumeration.yml --- ...ivate_keys_and_certificate_enumeration.yml | 60 ++++++------------- 1 file changed, 17 insertions(+), 43 deletions(-) diff --git a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml index 1769ff5a99..0e5f984f6a 100644 --- a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml +++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml @@ -1,55 +1,30 @@ -name: Linux Auditd Install Kernel Module Using Modprobe Utility -id: 95165985-ace5-4d42-9c42-93a89a5af901 -version: 3 -date: '2024-11-13' +name: Linux Auditd Private Keys and Certificate Enumeration +id: 80bb9988-190b-4ee0-a3c3-509545a8f678 +version: 4 +date: '2025-01-15' author: Teoderick Contreras, Splunk status: production type: Anomaly -description: The following analytic detects the installation of a Linux kernel module - using the modprobe utility. It leverages data from Linux Auditd, focusing on process - names and command-line executions. This activity is significant because installing - a kernel module can indicate an attempt to deploy a rootkit or other malicious kernel-level - code, potentially leading to elevated privileges and bypassing security detections. - If confirmed malicious, this could allow an attacker to gain persistent, high-level - access to the system, compromising its integrity and security. +description: The following analytic detects suspicious attempts to find private keys, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for private keys, this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information. data_source: -- Linux Auditd Syscall -search: '`linux_auditd` type=SYSCALL comm=modprobe | rename host as dest | stats count - min(_time) as firstTime max(_time) as lastTime by comm exe SYSCALL UID ppid pid - success dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| - `linux_auditd_install_kernel_module_using_modprobe_utility_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), - which is essential for correctly parsing and categorizing the data. The next step - involves normalizing the field names to match the field names set by the Splunk - Common Information Model (CIM) to ensure consistency across different data sources - and enhance the efficiency of data modeling. This approach enables effective monitoring - and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. - Please update the filter macros to remove false positives. +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, "%.p12%") OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_private_keys_and_certificate_enumeration_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application for automation purposes. Please update the filter macros to remove false positives. references: -- https://docs.fedoraproject.org/en-US/fedora/rawhide/system-administrators-guide/kernel-module-driver-configuration/Working_with_Kernel_Modules/ -- https://security.stackexchange.com/questions/175953/how-to-load-a-malicious-lkm-at-startup -- https://0x00sec.org/t/kernel-rootkits-getting-your-hands-dirty/1485 +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS drilldown_searches: - name: View the detection results for - "$dest$" search: '%original_detection_search% | search dest = "$dest$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") - starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime - values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) - as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) - as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: A SYSCALL - [$comm$] event was executed on host - [$dest$] to install a - Linux kernel module using the modprobe utility. + message: A [$process_exec$] event occurred on host - [$dest$] to find private keys. risk_objects: - field: dest type: system @@ -57,14 +32,14 @@ rba: threat_objects: [] tags: analytic_story: + - Linux Living Off The Land - Linux Privilege Escalation - - Linux Rootkit - Linux Persistence Techniques - Compromised Linux Host asset_type: Endpoint mitre_attack_id: - - T1547.006 - - T1547 + - T1552.004 + - T1552 product: - Splunk Enterprise - Splunk Enterprise Security @@ -73,7 +48,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.006/linux_auditd_modprobe/linux_auditd_modprobe.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_gpg/linux_auditd_find_gpg.log source: /var/log/audit/audit.log sourcetype: linux:audit From fc93c664a9d1cd57aca52132c8a10bb6f7a9ce2c Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Thu, 23 Jan 2025 15:45:44 +0100 Subject: [PATCH 58/82] rollback changes to risk_notable_import_data files --- playbooks/risk_notable_import_data.json | 2 +- playbooks/risk_notable_import_data.py | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/playbooks/risk_notable_import_data.json b/playbooks/risk_notable_import_data.json index c9558e3e32..12f59821d9 100644 --- a/playbooks/risk_notable_import_data.json +++ b/playbooks/risk_notable_import_data.json @@ -136,7 +136,7 @@ "errors": {}, "id": "1", "type": "end", - "userCode": "\t\n # Error handling in case of playbook not being able to import data properly\n if not format_summary_note:\n raise RuntimeError(\"Error occurred during import data and summary note is missing\")\n \n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n", + "userCode": "\t\n # Error handling in case of playbook not being able to import data properly\n if not format_summary_note:\n raise RuntimeError(\"Error occured during import data and summary note is missing\")\n \n # This function is called after all actions are completed.\n # summary of all the action and/or all details of actions\n # can be collected here.\n\n # summary_json = phantom.get_summary()\n # if 'result' in summary_json:\n # for action_result in summary_json['result']:\n # if 'action_run_id' in action_result:\n # action_results = phantom.get_action_results(action_run_id=action_result['action_run_id'], result_data=False, flatten=False)\n # phantom.debug(action_results)\n\n", "x": 960, "y": 1800 }, diff --git a/playbooks/risk_notable_import_data.py b/playbooks/risk_notable_import_data.py index d12c554957..f699597c80 100644 --- a/playbooks/risk_notable_import_data.py +++ b/playbooks/risk_notable_import_data.py @@ -579,7 +579,7 @@ def on_finish(container, summary): # Error handling in case of playbook not being able to import data properly if not format_summary_note: - raise RuntimeError("Error occurred during import data and summary note is missing") + raise RuntimeError("Error occured during import data and summary note is missing") # This function is called after all actions are completed. # summary of all the action and/or all details of actions From 217666c5d120993139259f6566468b03bb477ba4 Mon Sep 17 00:00:00 2001 From: research-bot Date: Thu, 23 Jan 2025 09:56:40 -0800 Subject: [PATCH 59/82] all but one fixes --- ...urce_and_response_for_verify_push_request.yml | 4 ++-- ...s_defense_evasion_stop_logging_cloudtrail.yml | 3 ++- ...asl_aws_defense_evasion_update_cloudtrail.yml | 2 +- ..._control_list_created_with_all_open_ports.yml | 6 +++--- .../azure_ad_service_principal_enumeration.yml | 16 ++++++++-------- 5 files changed, 16 insertions(+), 15 deletions(-) diff --git a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml index d305ab358d..5b2d38b889 100644 --- a/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml +++ b/detections/application/okta_mismatch_between_source_and_response_for_verify_push_request.yml @@ -60,9 +60,9 @@ references: - https://splunkbase.splunk.com/app/6553 rba: message: A mismatch between source and response for verifying a push request has - occurred for $actor.alternateId$ + occurred for $user$ risk_objects: - - field: actor.alternateId + - field: user type: user score: 64 threat_objects: [] diff --git a/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml index f619aec6a7..28a9d9a628 100644 --- a/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml +++ b/detections/cloud/asl_aws_defense_evasion_stop_logging_cloudtrail.yml @@ -8,7 +8,8 @@ type: TTP description: The following analytic detects `StopLogging` events within AWS CloudTrail logs, a critical action that adversaries may use to evade detection. By halting the logging of their malicious activities, attackers aim to operate undetected within a compromised AWS environment. This detection is achieved by monitoring for specific CloudTrail log entries that indicate the cessation of logging activities. Identifying such behavior is crucial for a Security Operations Center (SOC), as it signals an attempt to undermine the integrity of logging mechanisms, potentially allowing malicious activities to proceed without observation. The impact of this evasion tactic is significant, as it can severely hamper incident response and forensic investigations by obscuring the attacker's actions. data_source: - ASL AWS CloudTrail -search: '`amazon_security_lake` api.operation=StopLogging | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`' +search: '`amazon_security_lake` api.operation=StopLogging | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account.uid + as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_stop_logging_cloudtrail_filter`' how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has stopped cloudtrail logging. Please investigate this activity. references: diff --git a/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml b/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml index 70e9142d20..1b45a81b7f 100644 --- a/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml +++ b/detections/cloud/asl_aws_defense_evasion_update_cloudtrail.yml @@ -8,7 +8,7 @@ type: TTP description: The following analytic detects `UpdateTrail` events within AWS CloudTrail logs, aiming to identify attempts by attackers to evade detection by altering logging configurations. By updating CloudTrail settings with incorrect parameters, such as changing multi-regional logging to a single region, attackers can impair the logging of their activities across other regions. This behavior is crucial for Security Operations Centers (SOCs) to identify, as it indicates an adversary's intent to operate undetected within a compromised AWS environment. The impact of such evasion tactics is significant, potentially allowing malicious activities to proceed without being logged, thereby hindering incident response and forensic investigations. data_source: - ASL AWS CloudTrail -search: '`amazon_security_lake` api.operation=UpdateTrail | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_update_cloudtrail_filter`' +search: '`amazon_security_lake` api.operation=UpdateTrail | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account.uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_defense_evasion_update_cloudtrail_filter`' how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. known_false_positives: While this search has no known false positives, it is possible that an AWS admin has updated cloudtrail logging. Please investigate this activity. references: diff --git a/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml index d6bef2c61e..7d42dfa04e 100644 --- a/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/asl_aws_network_access_control_list_created_with_all_open_ports.yml @@ -16,8 +16,8 @@ search: '`amazon_security_lake` api.operation=CreateNetworkAclEntry OR api.opera | spath input=api.request.data path=networkAclId output=networkAclId | search ruleAction=allow AND egress=false AND aclProtocol=-1 AND cidrBlock=0.0.0.0/0 | fillnull - | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region networkAclId - | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account_uid as aws_account_id + | stats count min(_time) as firstTime max(_time) as lastTime by api.operation actor.user.uid actor.user.account.uid http_request.user_agent src_endpoint.ip cloud.region networkAclId cidrBlock + | rename actor.user.uid as user, src_endpoint.ip as src_ip, cloud.region as region, http_request.user_agent as user_agent, actor.user.account.uid as aws_account_id | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `asl_aws_network_access_control_list_created_with_all_open_ports_filter`' how_to_implement: The detection is based on Amazon Security Lake events from Amazon Web Services (AWS), which is a centralized data lake that provides security-related data from AWS services. To use this detection, you must ingest CloudTrail logs from Amazon Security Lake into Splunk. To run this search, ensure that you ingest events using the latest version of Splunk Add-on for Amazon Web Services (https://splunkbase.splunk.com/app/1876) or the Federated Analytics App. known_false_positives: It's possible that an admin has created this ACL with all ports open for some legitimate purpose however, this should be scoped and not allowed in production environment. @@ -32,7 +32,7 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: User $user$ has created network ACLs with all the ports open to a specified CIDR $requestParameters.cidrBlock$ + message: User $user$ has created network ACLs with all the ports opens to $cidrBlock$ risk_objects: - field: user type: user diff --git a/detections/cloud/azure_ad_service_principal_enumeration.yml b/detections/cloud/azure_ad_service_principal_enumeration.yml index 0b2628a773..67af2a74cc 100644 --- a/detections/cloud/azure_ad_service_principal_enumeration.yml +++ b/detections/cloud/azure_ad_service_principal_enumeration.yml @@ -6,15 +6,15 @@ author: Dean Luxton data_source: - Azure Active Directory MicrosoftGraphActivityLogs type: TTP -status: production +status: production description: >- This detection leverages azure graph activity logs to identify when graph APIs have been used to identify 10 or more service principals. This type of behaviour is associated with tools such as Azure enumberation tools such as AzureHound or ROADtools. search: >- - `azure_monitor_aad` category IN (MicrosoftGraphActivityLogs) TERM(servicePrincipals) + `azure_monitor_aad` category IN (MicrosoftGraphActivityLogs) TERM(servicePrincipals) | fillnull | rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/beta\/servicePrincipals\/(?P.*?)\/" | rex field="properties.requestUri" "https\:\/\/graph.microsoft.com\/v1.0\/servicePrincipals\/(?P.*?)\/" - | eval spn=coalesce(servicePrincipalb,servicePrincipalv1) | stats min(_time) as _time dc(spn) as spn_count values(user) as user values(user_category) as user_category values(src_category) as src_category count by src tenantId properties.userAgent + | eval spn=coalesce(servicePrincipalb,servicePrincipalv1) | stats count min(_time) as _time dc(spn) as spn_count values(user_id) as user_id by src tenantId properties.userAgent | rename properties.userAgent as user_agent | where spn_count>9 | `azure_ad_service_principal_enumeration_filter` how_to_implement: >- @@ -27,16 +27,16 @@ references: - https://splunkbase.splunk.com/app/3110 - https://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Install drilldown_searches: -- name: View the detection results for - "$user$" - search: '%original_detection_search% | search user = "$user$"' +- name: View the detection results for - "$user_id$" + search: '%original_detection_search% | search user_id = "$user_id$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +- name: View risk events for the last 7 days for - "$user_id$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user_id$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: - message: $spn_count$ Service Principals have been enumerated by $user$ from IP $src$ + message: $spn_count$ Service Principals have been enumerated by $user_id$ from IP $src$ risk_objects: - field: tenantId type: other From 2f060093104265a778cf312f2c3fd0f4fae0cc94 Mon Sep 17 00:00:00 2001 From: research-bot Date: Thu, 23 Jan 2025 15:14:57 -0800 Subject: [PATCH 60/82] ctl version to alpha3 --- .github/workflows/appinspect.yml | 2 +- .github/workflows/build.yml | 2 +- .github/workflows/unit-testing.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 74d4aeab10..4c99832ebe 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -18,7 +18,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==v5.0.0-alpha.2 + pip install contentctl==v5.0.0-alpha.3 git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 2437aea9fe..752e516e3f 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,7 +19,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==v5.0.0-alpha.2 + pip install contentctl==v5.0.0-alpha.3 git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 4de315ba24..925207f4cb 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,7 +23,7 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - pip install contentctl==v5.0.0-alpha.2 + pip install contentctl==v5.0.0-alpha.3 # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork From ca11fc70beb1dbbe05d1f25d55defe2b476102e1 Mon Sep 17 00:00:00 2001 From: research-bot Date: Thu, 23 Jan 2025 17:15:55 -0800 Subject: [PATCH 61/82] updating spl to output dest --- ...loading_dotnet_into_memory_via_reflection.yml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index a98579a280..cab7babf13 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -8,7 +8,7 @@ type: Anomaly data_source: - Powershell Script Block Logging 4104 description: The following analytic detects the use of PowerShell scripts to load .NET assemblies into memory via reflection, a technique often used in malicious activities such as those by Empire and Cobalt Strike. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command executed. This behavior is significant as it can indicate advanced attack techniques aiming to execute code in memory, bypassing traditional defenses. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, and persistent access within the environment. -search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Reflection.Assembly]::Load*", "*Reflection.Assembly.Load*", "*UnsafeLoadFrom*", "*.LoadFrom(*", "*.LoadModule(*", "*.LoadWithPartialName*", "*ReflectionOnlyLoad*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText IN ("*Reflection.Assembly]::Load*", "*Reflection.Assembly.Load*", "*UnsafeLoadFrom*", "*.LoadFrom(*", "*.LoadModule(*", "*.LoadWithPartialName*", "*ReflectionOnlyLoad*") | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | rename Computer as dest, UserID as user| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_reflection_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: False positives should be limited as day to day scripts do not use this method. references: @@ -18,20 +18,20 @@ references: - https://static1.squarespace.com/static/552092d5e4b0661088167e5c/t/59c1814829f18782e24f1fe2/1505853768977/Windows+PowerShell+Logging+Cheat+Sheet+ver+Sept+2017+v2.1.pdf - https://www.crowdstrike.com/blog/investigating-powershell-command-and-script-logging/ drilldown_searches: -- name: View the detection results for - "$Computer$" and "$user$" - search: '%original_detection_search% | search Computer = "$Computer$" user = "$user$"' +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$Computer$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$Computer$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$$", "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: message: A suspicious powershell script contains reflective class assembly command in $ScriptBlockText$ to load .net code in memory with EventCode $EventCode$ in - host $Computer$ + host $dest$ risk_objects: - - field: Computer + - field: dest type: system score: 56 - field: user @@ -60,4 +60,4 @@ tests: attack_data: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/reflection.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational - sourcetype: XmlWinEventLog + sourcetype: XmlWinEventLog \ No newline at end of file From 1ef66dba3cdb053e54a713549c2b4508dac752c4 Mon Sep 17 00:00:00 2001 From: ljstella Date: Fri, 24 Jan 2025 08:22:39 -0600 Subject: [PATCH 62/82] Casing- surprisingly important --- detections/endpoint/windows_ad_short_lived_server_object.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_ad_short_lived_server_object.yml b/detections/endpoint/windows_ad_short_lived_server_object.yml index b06e00f517..e6e6c0b674 100644 --- a/detections/endpoint/windows_ad_short_lived_server_object.yml +++ b/detections/endpoint/windows_ad_short_lived_server_object.yml @@ -53,7 +53,7 @@ rba: - field: Computer type: system score: 64 - - field: SubjectUsername + - field: SubjectUserName type: user score: 64 threat_objects: [] From 59938d9e32f8a77d21b958f74eb473bd82aa1905 Mon Sep 17 00:00:00 2001 From: Nasreddine Bencherchali Date: Fri, 24 Jan 2025 21:43:08 +0100 Subject: [PATCH 63/82] restore deleted to deprecated --- .../attempt_to_stop_security_service.yml | 96 ++++++++++++++++ .../change_default_file_association.yml | 82 ++++++++++++++ ...cmdline_tool_not_executed_in_cmd_shell.yml | 102 +++++++++++++++++ ...ate_local_admin_accounts_using_net_exe.yml | 94 ++++++++++++++++ .../deprecated/deleting_of_net_users.yml | 88 +++++++++++++++ ...system_network_configuration_discovery.yml | 91 +++++++++++++++ .../detect_webshell_exploit_behavior.yml | 104 ++++++++++++++++++ .../deprecated/disabling_net_user_account.yml | 85 ++++++++++++++ .../elevated_group_discovery_with_net.yml | 87 +++++++++++++++ .../excessive_service_stop_attempt.yml | 84 ++++++++++++++ .../deprecated/excessive_usage_of_net_app.yml | 89 +++++++++++++++ .../extraction_of_registry_hives.yml | 92 ++++++++++++++++ .../linux_auditd_find_private_keys.yml | 83 ++++++++++++++ .../local_account_discovery_with_net.yml | 58 ++++++++++ .../mshtml_module_load_in_office_product.yml | 80 ++++++++++++++ .../network_connection_discovery_with_net.yml | 58 ++++++++++ .../office_application_drop_executable.yml | 86 +++++++++++++++ ...office_document_creating_schedule_task.yml | 75 +++++++++++++ .../office_document_executing_macro_code.yml | 86 +++++++++++++++ ...ment_spawned_child_process_to_download.yml | 85 ++++++++++++++ ..._product_spawning_rundll32_with_no_dll.yml | 89 +++++++++++++++ .../office_product_writing_cab_or_inf.yml | 92 ++++++++++++++++ .../deprecated/office_spawning_control.yml | 94 ++++++++++++++++ .../password_policy_discovery_with_net.yml | 57 ++++++++++ ...dows_command_shell_fetch_env_variables.yml | 81 ++++++++++++++ .../windows_modify_registry_reg_restore.yml | 60 ++++++++++ ...ndows_msiexec_with_network_connections.yml | 87 +++++++++++++++ ...ows_network_share_interaction_with_net.yml | 80 ++++++++++++++ .../windows_office_product_spawning_msdt.yml | 96 ++++++++++++++++ .../windows_query_registry_reg_save.yml | 60 ++++++++++ ...rvice_stop_via_net__and_sc_application.yml | 79 +++++++++++++ ...id_account_with_never_expires_password.yml | 82 ++++++++++++++ ...ivate_keys_and_certificate_enumeration.yml | 4 +- ...twork_configuration_discovery_activity.yml | 4 +- ...ndows_attempt_to_stop_security_service.yml | 4 +- ..._tool_execution_from_non_shell_process.yml | 4 +- ...te_local_administrator_account_via_net.yml | 4 +- ...windows_excessive_service_stop_attempt.yml | 4 +- .../windows_excessive_usage_of_net_app.yml | 4 +- ...ttp_network_communication_from_msiexec.yml | 4 +- ...s_via_set_command_from_uncommon_parent.yml | 4 +- ...s_network_connection_discovery_via_net.yml | 4 +- ...dows_network_share_interaction_via_net.yml | 4 +- ...new_default_file_association_value_set.yml | 4 +- ...office_product_dropped_cab_or_inf_file.yml | 4 +- ...s_office_product_dropped_uncommon_file.yml | 4 +- ...ws_office_product_loaded_mshtml_module.yml | 4 +- ...ws_office_product_loading_taskschd_dll.yml | 4 +- ...indows_office_product_loading_vbe7_dll.yml | 4 +- ...uct_spawned_child_process_for_download.yml | 4 +- ...windows_office_product_spawned_control.yml | 4 +- .../windows_office_product_spawned_msdt.yml | 4 +- ...e_product_spawned_rundll32_with_no_dll.yml | 4 +- ...ows_password_policy_discovery_with_net.yml | 4 +- ...dows_registry_entries_exported_via_reg.yml | 4 +- ...dows_registry_entries_restored_via_reg.yml | 4 +- ...ows_sensitive_group_discovery_with_net.yml | 4 +- ...ive_registry_hive_dump_via_commandline.yml | 4 +- .../endpoint/windows_service_stop_attempt.yml | 4 +- ...t_password_policy_to_unlimited_via_net.yml | 4 +- ...s_child_process_spawned_from_webserver.yml | 4 +- .../windows_user_deletion_via_net.yml | 4 +- .../windows_user_disabled_via_net.yml | 4 +- .../windows_user_discovery_via_net.yml | 4 +- 64 files changed, 2726 insertions(+), 64 deletions(-) create mode 100644 detections/deprecated/attempt_to_stop_security_service.yml create mode 100644 detections/deprecated/change_default_file_association.yml create mode 100644 detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml create mode 100644 detections/deprecated/create_local_admin_accounts_using_net_exe.yml create mode 100644 detections/deprecated/deleting_of_net_users.yml create mode 100644 detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml create mode 100644 detections/deprecated/detect_webshell_exploit_behavior.yml create mode 100644 detections/deprecated/disabling_net_user_account.yml create mode 100644 detections/deprecated/elevated_group_discovery_with_net.yml create mode 100644 detections/deprecated/excessive_service_stop_attempt.yml create mode 100644 detections/deprecated/excessive_usage_of_net_app.yml create mode 100644 detections/deprecated/extraction_of_registry_hives.yml create mode 100644 detections/deprecated/linux_auditd_find_private_keys.yml create mode 100644 detections/deprecated/local_account_discovery_with_net.yml create mode 100644 detections/deprecated/mshtml_module_load_in_office_product.yml create mode 100644 detections/deprecated/network_connection_discovery_with_net.yml create mode 100644 detections/deprecated/office_application_drop_executable.yml create mode 100644 detections/deprecated/office_document_creating_schedule_task.yml create mode 100644 detections/deprecated/office_document_executing_macro_code.yml create mode 100644 detections/deprecated/office_document_spawned_child_process_to_download.yml create mode 100644 detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml create mode 100644 detections/deprecated/office_product_writing_cab_or_inf.yml create mode 100644 detections/deprecated/office_spawning_control.yml create mode 100644 detections/deprecated/password_policy_discovery_with_net.yml create mode 100644 detections/deprecated/windows_command_shell_fetch_env_variables.yml create mode 100644 detections/deprecated/windows_modify_registry_reg_restore.yml create mode 100644 detections/deprecated/windows_msiexec_with_network_connections.yml create mode 100644 detections/deprecated/windows_network_share_interaction_with_net.yml create mode 100644 detections/deprecated/windows_office_product_spawning_msdt.yml create mode 100644 detections/deprecated/windows_query_registry_reg_save.yml create mode 100644 detections/deprecated/windows_service_stop_via_net__and_sc_application.yml create mode 100644 detections/deprecated/windows_valid_account_with_never_expires_password.yml diff --git a/detections/deprecated/attempt_to_stop_security_service.yml b/detections/deprecated/attempt_to_stop_security_service.yml new file mode 100644 index 0000000000..6527800094 --- /dev/null +++ b/detections/deprecated/attempt_to_stop_security_service.yml @@ -0,0 +1,96 @@ +name: Attempt To Stop Security Service +id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 +version: 9 +date: '2025-01-24' +author: Rico Valdez, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects attempts to stop security-related services + on an endpoint, which may indicate malicious activity. It leverages data from Endpoint + Detection and Response (EDR) agents, specifically searching for processes involving + the "sc.exe" command with the "stop" parameter. This activity is significant because + disabling security services can undermine the organization's security posture, potentially + leading to unauthorized access, data exfiltration, or further attacks like malware + installation or privilege escalation. If confirmed malicious, this behavior could + compromise the endpoint and the entire network, necessitating immediate investigation + and response. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` OR Processes.process_name = sc.exe Processes.process="* stop + *" by Processes.dest Processes.user Processes.parent_process Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` |lookup security_services_lookup service as + process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: None identified. Attempts to disable security-related services + should be identified and understood. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service +- https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + attempting to disable security services on endpoint $dest$ by user $user$. + risk_objects: + - field: user + type: user + score: 20 + - field: dest + type: system + score: 20 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - WhisperGate + - Graceful Wipe Out Attack + - Disabling Security Tools + - Data Destruction + - Azorult + - Trickbot + asset_type: Endpoint + mitre_attack_id: + - T1562.001 + - T1562 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_defend_service_stop/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/change_default_file_association.yml b/detections/deprecated/change_default_file_association.yml new file mode 100644 index 0000000000..d552a13219 --- /dev/null +++ b/detections/deprecated/change_default_file_association.yml @@ -0,0 +1,82 @@ +name: Change Default File Association +id: 462d17d8-1f71-11ec-ad07-acde48001122 +version: 5 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects suspicious registry modifications that + change the default file association to execute a malicious payload. It leverages + data from the Endpoint data model, specifically monitoring registry paths under + "*\\shell\\open\\command\\*" and "*HKCR\\*". This activity is significant because + altering default file associations can allow attackers to execute arbitrary scripts + or payloads when a user opens a file, leading to potential code execution. If confirmed + malicious, this technique can enable attackers to persist on the compromised host + and execute further malicious commands, posing a severe threat to the environment. +data_source: +- Sysmon EventID 12 +- Sysmon EventID 13 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime + max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path + ="*\\shell\\open\\command\\*" Registry.registry_path = "*HKCR\\*" by Registry.dest Registry.user + Registry.registry_path Registry.registry_key_name Registry.registry_value_name | + `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` + | `change_default_file_association_filter`' +how_to_implement: To successfully implement this search, you must be ingesting data + that records registry activity from your hosts to populate the endpoint data model + in the registry node. This is typically populated via endpoint detection-and-response + product, such as Carbon Black or endpoint data sources, such as Sysmon. The data + used for this search is typically generated via logs that report reads and writes + to the registry. +known_false_positives: unknown +references: +- https://dmcxblue.gitbook.io/red-team-notes-2-0/red-team-techniques/privilege-escalation/untitled-3/accessibility-features +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Registry path $registry_path$ was modified, added, or deleted on $dest$. + risk_objects: + - field: dest + type: system + score: 80 + - field: user + type: user + score: 80 + threat_objects: [] +tags: + analytic_story: + - Hermetic Wiper + - Windows Registry Abuse + - Prestige Ransomware + - Windows Privilege Escalation + - Windows Persistence Techniques + - Data Destruction + asset_type: Endpoint + mitre_attack_id: + - T1546.001 + - T1546 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.001/txtfile_reg/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml new file mode 100644 index 0000000000..1df440f488 --- /dev/null +++ b/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml @@ -0,0 +1,102 @@ +name: Cmdline Tool Not Executed In CMD Shell +id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 +version: 7 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, + or similar tools are executed by a non-standard parent process, excluding CMD, PowerShell, + or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry + to monitor process creation events. Such behavior is significant as it may indicate + adversaries using injected processes to perform system discovery, a tactic observed + in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers + to gather critical host information, aiding in further exploitation or lateral movement + within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = "ipconfig.exe" + OR Processes.process_name = "systeminfo.exe" OR Processes.process_name = "net.exe" + OR Processes.process_name = "net1.exe" OR Processes.process_name = "arp.exe" OR + Processes.process_name = "nslookup.exe" OR Processes.process_name = "route.exe" + OR Processes.process_name = "netstat.exe" OR Processes.process_name = "whoami.exe") + AND NOT (Processes.parent_process_name = "cmd.exe" OR Processes.parent_process_name + = "powershell*" OR Processes.parent_process_name="pwsh.exe" OR Processes.parent_process_name + = "explorer.exe") by Processes.parent_process_name Processes.parent_process Processes.process_name + Processes.original_file_name Processes.process_id Processes.process Processes.dest + Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `cmdline_tool_not_executed_in_cmd_shell_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: A network operator or systems administrator may utilize an + automated host discovery application that may generate false positives. Filter as + needed. +references: +- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation +- https://attack.mitre.org/groups/G0046/ +- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A non-standard parent process $parent_process_name$ spawned child process + $process_name$ to execute command-line tool on $dest$. + risk_objects: + - field: dest + type: system + score: 56 + - field: user + type: user + score: 56 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Volt Typhoon + - Rhysida Ransomware + - FIN7 + - DarkGate Malware + - Qakbot + - CISA AA22-277A + - CISA AA23-347A + - Gozi Malware + asset_type: Endpoint + mitre_attack_id: + - T1059 + - T1059.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/jssloader/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/create_local_admin_accounts_using_net_exe.yml b/detections/deprecated/create_local_admin_accounts_using_net_exe.yml new file mode 100644 index 0000000000..08cc384790 --- /dev/null +++ b/detections/deprecated/create_local_admin_accounts_using_net_exe.yml @@ -0,0 +1,94 @@ +name: Create local admin accounts using net exe +id: b89919ed-fe5f-492c-b139-151bb162040e +version: 15 +date: '2025-01-24' +author: Bhavin Patel, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects the creation of local administrator accounts + using the net.exe command. It leverages Endpoint Detection and Response (EDR) data + to identify processes named net.exe or net1.exe with the "/add" parameter and keywords + related to administrator accounts. This activity is significant as it may indicate + an attacker attempting to gain persistent access or escalate privileges. If confirmed + malicious, this could lead to unauthorized access, data theft, or further system + compromise. Review the process details, user context, and related artifacts to determine + the legitimacy of the activity. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count values(Processes.user) as + user values(Processes.parent_process) as parent_process values(parent_process_name) + as parent_process_name min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` AND Processes.process=*/add* AND (Processes.process=*administrators* + OR Processes.process=*administratoren* OR Processes.process=*administrateurs* OR + Processes.process=*administrador* OR Processes.process=*amministratori* OR Processes.process=*administratorer* + OR Processes.process=*Rendszergazda* OR Processes.process=*Администратор* OR Processes.process=*Administratör*) + by Processes.process Processes.process_name Processes.parent_process_name Processes.dest + Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `create_local_admin_accounts_using_net_exe_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators often leverage net.exe to create admin accounts. +references: [] +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators + group. + risk_objects: + - field: user + type: user + score: 30 + - field: dest + type: system + score: 30 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - DHS Report TA18-074A + - Azorult + - CISA AA22-257A + - DarkGate Malware + - CISA AA24-241A + asset_type: Endpoint + mitre_attack_id: + - T1136.001 + - T1136 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.001/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/deleting_of_net_users.yml b/detections/deprecated/deleting_of_net_users.yml new file mode 100644 index 0000000000..53d81b2248 --- /dev/null +++ b/detections/deprecated/deleting_of_net_users.yml @@ -0,0 +1,88 @@ +name: Deleting Of Net Users +id: 1c8c6f66-acce-11eb-aafb-acde48001122 +version: 7 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects the use of net.exe or net1.exe command-line + to delete a user account on a system. It leverages data from Endpoint Detection + and Response (EDR) agents, focusing on process and command-line execution logs. + This activity is significant as it may indicate an attempt to impair user accounts + or cover tracks during lateral movement. If confirmed malicious, this could lead + to unauthorized access removal, disruption of legitimate user activities, or concealment + of adversarial actions, complicating incident response and forensic investigations. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` AND Processes.process="*user*" AND Processes.process="*/delete*" + by Processes.process_name Processes.original_file_name Processes.dest Processes.user + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `deleting_of_net_users_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: System administrators or scripts may delete user accounts via + this technique. Filter as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$ attempting to delete accounts. + risk_objects: + - field: user + type: user + score: 25 + - field: dest + type: system + score: 25 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - XMRig + - Graceful Wipe Out Attack + - DarkGate Malware + asset_type: Endpoint + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml new file mode 100644 index 0000000000..077d4c8017 --- /dev/null +++ b/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml @@ -0,0 +1,91 @@ +name: Detect processes used for System Network Configuration Discovery +id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 +version: 7 +date: '2025-01-24' +author: Bhavin Patel, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic identifies the rapid execution of processes used + for system network configuration discovery on an endpoint. It leverages data from + Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, + parent processes, and command-line executions. This activity is significant as it + may indicate an attacker attempting to map the network, which is a common precursor + to lateral movement or further exploitation. If confirmed malicious, this behavior + could allow an attacker to gain insights into the network topology, identify critical + systems, and plan subsequent attacks, potentially leading to data exfiltration or + system compromise. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count values(Processes.process) + as process values(Processes.parent_process) as parent_process min(_time) as firstTime + max(_time) as lastTime from datamodel=Endpoint.Processes where NOT Processes.user + IN ("","unknown") by Processes.dest Processes.process_name Processes.parent_process_name + Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` + | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime + lastTime dest user process_name process parent_process parent_process_name eventcount + | `detect_processes_used_for_system_network_configuration_discovery_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: It is uncommon for normal users to execute a series of commands + used for network discovery. System administrators often use scripts to execute these + commands. These can generate false positives. +references: [] +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning multiple $process_name$ was + identified on endpoint $dest$ by user $user$ typically not a normal behavior of + the process. + risk_objects: + - field: user + type: user + score: 32 + - field: dest + type: system + score: 32 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Unusual Processes + asset_type: Endpoint + mitre_attack_id: + - T1016 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1016/discovery_commands/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/detect_webshell_exploit_behavior.yml b/detections/deprecated/detect_webshell_exploit_behavior.yml new file mode 100644 index 0000000000..3b28ad33f1 --- /dev/null +++ b/detections/deprecated/detect_webshell_exploit_behavior.yml @@ -0,0 +1,104 @@ +name: Detect Webshell Exploit Behavior +id: 22597426-6dbd-49bd-bcdc-4ec19857192f +version: 7 +date: '2025-01-24' +author: Steven Dick +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic identifies the execution of suspicious processes + typically associated with webshell activity on web servers. It detects when processes + like `cmd.exe`, `powershell.exe`, or `bash.exe` are spawned by web server processes + such as `w3wp.exe` or `nginx.exe`. This behavior is significant as it may indicate + an adversary exploiting a web application vulnerability to install a webshell, providing + persistent access and command execution capabilities. If confirmed malicious, this + activity could allow attackers to maintain control over the compromised server, + execute arbitrary commands, and potentially escalate privileges or exfiltrate sensitive + data. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) + as firstTime from datamodel=Endpoint.Processes where (Processes.process_name IN + ("arp.exe","at.exe","bash.exe","bitsadmin.exe","certutil.exe","cmd.exe","cscript.exe", + "dsget.exe","dsquery.exe","find.exe","findstr.exe","fsutil.exe","hostname.exe","ipconfig.exe","ksh.exe","nbstat.exe", + "net.exe","net1.exe","netdom.exe","netsh.exe","netstat.exe","nltest.exe","nslookup.exe","ntdsutil.exe","pathping.exe", + "ping.exe","powershell.exe","pwsh.exe","qprocess.exe","query.exe","qwinsta.exe","reg.exe","rundll32.exe","sc.exe", + "scrcons.exe","schtasks.exe","sh.exe","systeminfo.exe","tasklist.exe","tracert.exe","ver.exe","vssadmin.exe", + "wevtutil.exe","whoami.exe","wmic.exe","wscript.exe","wusa.exe","zsh.exe") AND Processes.parent_process_name + IN ("w3wp.exe", "http*.exe", "nginx*.exe", "php*.exe", "php-cgi*.exe","tomcat*.exe")) + by Processes.dest,Processes.user,Processes.parent_process,Processes.parent_process_name,Processes.process,Processes.process_name + | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_webshell_exploit_behavior_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Legitimate OS functions called by vendor applications, baseline + the environment and filter before enabling. Recommend throttle by dest/process_name +references: +- https://attack.mitre.org/techniques/T1505/003/ +- https://github.com/nsacyber/Mitigating-Web-Shells +- https://www.hackingarticles.in/multiple-ways-to-exploit-tomcat-manager/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Webshell Exploit Behavior - $parent_process_name$ spawned $process_name$ + on $dest$. + risk_objects: + - field: user + type: user + score: 80 + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - ProxyNotShell + - CISA AA22-257A + - HAFNIUM Group + - Citrix ShareFile RCE CVE-2023-24489 + - ProxyShell + - Flax Typhoon + - CISA AA22-264A + - SysAid On-Prem Software CVE-2023-47246 Vulnerability + - Compromised Windows Host + - WS FTP Server Critical Vulnerabilities + - BlackByte Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1505 + - T1505.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/generic_webshell_exploit/generic_webshell_exploit.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/disabling_net_user_account.yml b/detections/deprecated/disabling_net_user_account.yml new file mode 100644 index 0000000000..2a10320558 --- /dev/null +++ b/detections/deprecated/disabling_net_user_account.yml @@ -0,0 +1,85 @@ +name: Disabling Net User Account +id: c0325326-acd6-11eb-98c2-acde48001122 +version: 7 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects the use of the `net.exe` utility to disable + a user account via the command line. It leverages data from Endpoint Detection and + Response (EDR) agents, focusing on process execution logs and command-line arguments. + This activity is significant as it may indicate an adversary's attempt to disrupt + user availability, potentially as a precursor to further malicious actions. If confirmed + malicious, this could lead to denial of service for legitimate users, aiding the + attacker in maintaining control or covering their tracks. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.parent_process) as parent_process values(Processes.process_id) + as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` AND Processes.process="*user*" AND Processes.process="*/active:no*" + by Processes.process_name Processes.original_file_name Processes.dest Processes.user + Processes.parent_process_name | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `disabling_net_user_account_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + disabling a user account on endpoint $dest$ by user $user$. + risk_objects: + - field: user + type: user + score: 42 + - field: dest + type: system + score: 42 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - XMRig + asset_type: Endpoint + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/elevated_group_discovery_with_net.yml b/detections/deprecated/elevated_group_discovery_with_net.yml new file mode 100644 index 0000000000..14e1b5ab5a --- /dev/null +++ b/detections/deprecated/elevated_group_discovery_with_net.yml @@ -0,0 +1,87 @@ +name: Elevated Group Discovery With Net +id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a +version: 6 +date: '2025-01-24' +author: Mauricio Velazco, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects the execution of `net.exe` or `net1.exe` + with command-line arguments used to query elevated domain groups. It leverages data + from Endpoint Detection and Response (EDR) agents, focusing on process names and + command-line executions. This activity is significant as it indicates potential + reconnaissance efforts by adversaries to identify high-privileged users within Active + Directory. If confirmed malicious, this behavior could lead to further attacks aimed + at compromising privileged accounts, escalating privileges, or gaining unauthorized + access to sensitive systems and data. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process="*group*" + AND Processes.process="*/do*") (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise + Admins*" OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" + OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" + OR Processes.process="*Dns Admins*") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `elevated_group_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://adsecurity.org/?p=3658 +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Elevated domain group discovery enumeration on $dest$ by $user$ + risk_objects: + - field: dest + type: system + score: 21 + threat_objects: [] +tags: + analytic_story: + - Active Directory Discovery + - Volt Typhoon + - Rhysida Ransomware + - BlackSuit Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1069 + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/excessive_service_stop_attempt.yml b/detections/deprecated/excessive_service_stop_attempt.yml new file mode 100644 index 0000000000..3e27dc456b --- /dev/null +++ b/detections/deprecated/excessive_service_stop_attempt.yml @@ -0,0 +1,84 @@ +name: Excessive Service Stop Attempt +id: ae8d3f4a-acd7-11eb-8846-acde48001122 +version: 7 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: Anomaly +description: The following analytic has been deprecated. + The following analytic detects multiple attempts to stop or delete services + on a system using `net.exe`, `sc.exe`, or `net1.exe`. It leverages Endpoint Detection + and Response (EDR) telemetry, focusing on process names and command-line executions + within a one-minute window. This activity is significant as it may indicate an adversary + attempting to disable security or critical services to evade detection and further + their objectives. If confirmed malicious, this could lead to the attacker gaining + persistence, escalating privileges, or disrupting essential services, thereby compromising + the system's security posture. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name + = "sc.exe" OR Processes.process_name = "net1.exe" AND Processes.process="*stop*" + OR Processes.process="*delete*" by Processes.process_name Processes.original_file_name + Processes.parent_process_name Processes.dest Processes.user _time span=1m | where + count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_service_stop_attempt_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: unknown +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An excessive amount of $process_name$ was executed on $dest$ attempting + to disable services. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - XMRig + - Ransomware + - BlackByte Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/excessive_usage_of_net_app.yml b/detections/deprecated/excessive_usage_of_net_app.yml new file mode 100644 index 0000000000..e48ea823d4 --- /dev/null +++ b/detections/deprecated/excessive_usage_of_net_app.yml @@ -0,0 +1,89 @@ +name: Excessive Usage Of Net App +id: 45e52536-ae42-11eb-b5c6-acde48001122 +version: 6 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: Anomaly +description: The following analytic has been deprecated. + The following analytic detects excessive usage of `net.exe` or `net1.exe` + within a one-minute interval. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process names, parent processes, and command-line executions. + This behavior is significant as it may indicate an adversary attempting to create, + delete, or disable multiple user accounts rapidly, a tactic observed in Monero mining + incidents. If confirmed malicious, this activity could lead to unauthorized user + account manipulation, potentially compromising system integrity and enabling further + malicious actions. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process_name + Processes.parent_process_name Processes.original_file_name Processes.dest Processes.user + _time span=1m | where count >=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `excessive_usage_of_net_app_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: unknown. Filter as needed. Modify the time span as needed. +references: +- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Excessive usage of net1.exe or net.exe within 1m, with command line $process$ + has been detected on $dest$ by $user$ + risk_objects: + - field: user + type: user + score: 28 + - field: dest + type: system + score: 28 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Prestige Ransomware + - Graceful Wipe Out Attack + - XMRig + - Windows Post-Exploitation + - Azorult + - Ransomware + - Rhysida Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1531 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/extraction_of_registry_hives.yml b/detections/deprecated/extraction_of_registry_hives.yml new file mode 100644 index 0000000000..565dccabfa --- /dev/null +++ b/detections/deprecated/extraction_of_registry_hives.yml @@ -0,0 +1,92 @@ +name: Extraction of Registry Hives +id: 8bbb7d58-b360-11eb-ba21-acde48001122 +version: 6 +date: '2025-01-24' +author: Michael Haag, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects the use of `reg.exe` to export Windows + Registry hives, which may contain sensitive credentials. This detection leverages + data from Endpoint Detection and Response (EDR) agents, focusing on command-line + executions involving `save` or `export` actions targeting the `sam`, `system`, or + `security` hives. This activity is significant as it indicates potential offline + credential access attacks, often executed from untrusted processes or scripts. If + confirmed malicious, attackers could gain access to credential data, enabling further + compromise and lateral movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_reg` (Processes.process=*save* + OR Processes.process=*export*) AND (Processes.process="*\sam *" OR Processes.process="*\system + *" OR Processes.process="*\security *") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.parent_process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `extraction_of_registry_hives_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: It is possible some agent based products will generate false + positives. Filter as needed. +references: +- https://www.mandiant.com/resources/shining-a-light-on-darkside-ransomware-operations +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md +- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Suspicious use of `reg.exe` exporting Windows Registry hives containing + credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ + risk_objects: + - field: user + type: user + score: 56 + - field: dest + type: system + score: 56 + threat_objects: + - field: parent_process_name + type: parent_process_name +tags: + analytic_story: + - Volt Typhoon + - Credential Dumping + - CISA AA23-347A + - DarkSide Ransomware + - CISA AA22-257A + asset_type: Endpoint + mitre_attack_id: + - T1003.002 + - T1003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/linux_auditd_find_private_keys.yml b/detections/deprecated/linux_auditd_find_private_keys.yml new file mode 100644 index 0000000000..e9b889bc9e --- /dev/null +++ b/detections/deprecated/linux_auditd_find_private_keys.yml @@ -0,0 +1,83 @@ +name: Linux Auditd Find Private Keys +id: 80bb9988-190b-4ee0-a3c3-509545a8f678 +version: 5 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects suspicious attempts to find private keys, + which may indicate an attacker's effort to access sensitive cryptographic information. + Private keys are crucial for securing encrypted communications and data, and unauthorized + access to them can lead to severe security breaches, including data decryption and + identity theft. By monitoring for unusual or unauthorized searches for private keys, + this analytic helps identify potential threats to cryptographic security, enabling + security teams to take swift action to protect the integrity and confidentiality + of encrypted information. +data_source: +- Linux Auditd Execve +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | where (LIKE (process_exec, "%find%") OR LIKE (process_exec, "%grep%")) AND + (LIKE (process_exec, "%.pem%") OR LIKE (process_exec, "%.cer%") OR LIKE (process_exec, + "%.crt%") OR LIKE (process_exec, "%.pgp%") OR LIKE (process_exec, "%.key%") OR LIKE + (process_exec, "%.gpg%")OR LIKE (process_exec, "%.ppk%") OR LIKE (process_exec, + "%.p12%")OR LIKE (process_exec, "%.pfx%")OR LIKE (process_exec, "%.p7b%")) | stats + count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | + `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_find_private_keys_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line + executions and process details on Unix/Linux systems. These logs should be ingested + and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can use this application + for automation purposes. Please update the filter macros to remove false positives. +references: +- https://www.splunk.com/en_us/blog/security/deep-dive-on-persistence-privilege-escalation-technique-and-detection-in-linux-platform.html +- https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A [$process_exec$] event occurred on host - [$dest$] to find private keys. + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: [] +tags: + analytic_story: + - Linux Living Off The Land + - Linux Privilege Escalation + - Linux Persistence Techniques + - Compromised Linux Host + asset_type: Endpoint + mitre_attack_id: + - T1552.004 + - T1552 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1552.004/linux_auditd_find_gpg/linux_auditd_find_gpg.log + source: /var/log/audit/audit.log + sourcetype: linux:audit diff --git a/detections/deprecated/local_account_discovery_with_net.yml b/detections/deprecated/local_account_discovery_with_net.yml new file mode 100644 index 0000000000..7ac754da20 --- /dev/null +++ b/detections/deprecated/local_account_discovery_with_net.yml @@ -0,0 +1,58 @@ +name: Local Account Discovery with Net +id: 5d0d4830-0133-11ec-bae3-acde48001122 +version: 6 +date: '2025-01-24' +author: Mauricio Velazco, Splunk +status: deprecated +type: Hunting +description: The following analytic has been deprecated. + The following analytic detects the execution of `net.exe` or `net1.exe` + with command-line arguments `user` or `users` to query local user accounts. It leverages + data from Endpoint Detection and Response (EDR) agents, focusing on process names + and command-line executions. This activity is significant as it indicates potential + reconnaissance efforts by adversaries to enumerate local users, which is a common + step in situational awareness and Active Directory discovery. If confirmed malicious, + this behavior could lead to further attacks, including privilege escalation and + lateral movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` (Processes.process=*user + OR Processes.process=*users) by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `local_account_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1087/001/ +tags: + analytic_story: + - Active Directory Discovery + - Sandworm Tools + asset_type: Endpoint + mitre_attack_id: + - T1087 + - T1087.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1087.001/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/mshtml_module_load_in_office_product.yml b/detections/deprecated/mshtml_module_load_in_office_product.yml new file mode 100644 index 0000000000..f617d2f40e --- /dev/null +++ b/detections/deprecated/mshtml_module_load_in_office_product.yml @@ -0,0 +1,80 @@ +name: MSHTML Module Load in Office Product +id: 5f1c168e-118b-11ec-84ff-acde48001122 +version: 7 +date: '2025-01-24' +author: Michael Haag, Mauricio Velazco, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects the loading of the mshtml.dll module into + an Office product, which is indicative of CVE-2021-40444 exploitation. It leverages + Sysmon EventID 7 to monitor image loads by specific Office processes. This activity + is significant because it can indicate an attempt to exploit a vulnerability in + the MSHTML component via a malicious document. If confirmed malicious, this could + allow an attacker to execute arbitrary code, potentially leading to system compromise, + data exfiltration, or further network penetration. +data_source: +- Sysmon EventID 7 +search: '`sysmon` EventID=7 process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", + "msaccess.exe","Graph.exe","winproj.exe") loaded_file_path IN ("*\\mshtml.dll", + "*\\Microsoft.mshtml.dll","*\\IE.Interop.MSHTML.dll","*\\MshtmlDac.dll","*\\MshtmlDed.dll","*\\MshtmlDer.dll") + | stats count min(_time) as firstTime max(_time) as lastTime by user_id, dest, process_name, + loaded_file, loaded_file_path, original_file_name, process_guid | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `mshtml_module_load_in_office_product_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process names and image loads from your endpoints. If you are using + Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +known_false_positives: Limited false positives will be present, however, tune as necessary. + Some applications may legitimately load mshtml.dll. +references: +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://strontic.github.io/xcyclopedia/index-dll +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on endpoint $dest$ loading + mshtml.dll. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + asset_type: Endpoint + cve: + - CVE-2021-40444 + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_mshtml.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/network_connection_discovery_with_net.yml b/detections/deprecated/network_connection_discovery_with_net.yml new file mode 100644 index 0000000000..0002699f31 --- /dev/null +++ b/detections/deprecated/network_connection_discovery_with_net.yml @@ -0,0 +1,58 @@ +name: Network Connection Discovery With Net +id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d +version: 6 +date: '2025-01-24' +author: Mauricio Velazco, Splunk +status: deprecated +type: Hunting +description: The following analytic has been deprecated. + The following analytic identifies the execution of `net.exe` or `net1.exe` + with command-line arguments used to list network connections on a compromised system. + It leverages data from Endpoint Detection and Response (EDR) agents, focusing on + process names and command-line executions. This activity is significant as it indicates + potential network reconnaissance by adversaries or Red Teams, aiming to gather situational + awareness and Active Directory information. If confirmed malicious, this behavior + could allow attackers to map the network, identify critical assets, and plan further + attacks, potentially leading to data exfiltration or lateral movement. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` AND (Processes.process=*use*) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `network_connection_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1049/ +tags: + analytic_story: + - Active Directory Discovery + - Azorult + - Windows Post-Exploitation + - Prestige Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1049 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1049/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/office_application_drop_executable.yml b/detections/deprecated/office_application_drop_executable.yml new file mode 100644 index 0000000000..94ddc48e52 --- /dev/null +++ b/detections/deprecated/office_application_drop_executable.yml @@ -0,0 +1,86 @@ +name: Office Application Drop Executable +id: 73ce70c4-146d-11ec-9184-acde48001122 +version: 9 +date: '2025-01-24' +author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects Microsoft Office applications dropping + or creating executables or scripts on a Windows OS. It leverages process creation + and file system events from the Endpoint data model to identify Office applications + like Word or Excel generating files with extensions such as .exe, .dll, or .ps1. + This behavior is significant as it is often associated with spear-phishing attacks + where malicious files are dropped to compromise the host. If confirmed malicious, + this activity could lead to code execution, privilege escalation, or persistent + access, posing a severe threat to the environment. +data_source: +- Sysmon EventID 1 AND Sysmon EventID 11 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + Processes.process_guid | `drop_dm_object_name(Processes)` |join process_guid, _time + [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*.exe","*.dll","*.pif","*.scr","*.js","*.vbs","*.vbe","*.ps1") + by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name + Filesystem.process_guid Filesystem.file_path | `drop_dm_object_name(Filesystem)` + | fields _time dest file_create_time file_name file_path process_name process_path + process process_guid] | dedup file_create_time | table dest, process_name, process, + file_create_time, file_name, file_path, process_guid | `office_application_drop_executable_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: office macro for automation may do this behavior +references: +- https://www.mandiant.com/resources/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation +- https://attack.mitre.org/groups/G0046/ +- https://www.joesandbox.com/analysis/702680/0/html +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: process $process_name$ drops a file $file_name$ in host $dest$ + risk_objects: + - field: dest + type: system + score: 64 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - CVE-2023-21716 Word RTF Heap Corruption + - Warzone RAT + - FIN7 + - Compromised Windows Host + - AgentTesla + - PlugX + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/fin7/fin7_macro_js_1/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/office_document_creating_schedule_task.yml b/detections/deprecated/office_document_creating_schedule_task.yml new file mode 100644 index 0000000000..0198d43de6 --- /dev/null +++ b/detections/deprecated/office_document_creating_schedule_task.yml @@ -0,0 +1,75 @@ +name: Office Document Creating Schedule Task +id: cc8b7b74-9d0f-11eb-8342-acde48001122 +version: 10 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects an Office document creating a scheduled + task, either through a macro VBA API or by loading `taskschd.dll`. This detection + leverages Sysmon EventCode 7 to identify when Office applications load the `taskschd.dll` + file. This activity is significant as it is a common technique used by malicious + macro malware to establish persistence or initiate beaconing. If confirmed malicious, + this could allow an attacker to maintain persistence, execute arbitrary commands, + or schedule future malicious activities, posing a significant threat to the environment. +data_source: +- Sysmon EventID 7 +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", + "msaccess.exe") loaded_file_path = "*\\taskschd.dll" | stats min(_time) as firstTime + max(_time) as lastTime count by user_id, dest, process_name,loaded_file, loaded_file_path, + original_file_name, process_guid | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `office_document_creating_schedule_task_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: False positives may occur if legitimate office documents are + creating scheduled tasks. Ensure to investigate the scheduled task and the command + to be executed. If the task is benign, add the task name to the exclusion list. + Some applications may legitimately load taskschd.dll. +references: +- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/ +- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/ +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An Office document was identified creating a scheduled task on $dest$. + Investigate further. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] +tags: + analytic_story: + - Spearphishing Attachments + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/office_document_executing_macro_code.yml b/detections/deprecated/office_document_executing_macro_code.yml new file mode 100644 index 0000000000..920e9483f5 --- /dev/null +++ b/detections/deprecated/office_document_executing_macro_code.yml @@ -0,0 +1,86 @@ +name: Office Document Executing Macro Code +id: b12c89bc-9d06-11eb-a592-acde48001122 +version: 9 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic identifies office documents executing macro code. + It leverages Sysmon EventCode 7 to detect when processes like WINWORD.EXE or EXCEL.EXE + load specific DLLs associated with macros (e.g., VBE7.DLL). This activity is significant + because macros are a common attack vector for delivering malicious payloads, such + as malware. If confirmed malicious, this could lead to unauthorized code execution, + data exfiltration, or further compromise of the system. Disabling macros by default + is recommended to mitigate this risk. +data_source: +- Sysmon EventID 7 +search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") + loaded_file_path IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL") | stats min(_time) + as firstTime max(_time) as lastTime values(loaded_file) as loaded_file count by + dest EventCode process_name process_guid | `security_content_ctime(firstTime)` | + `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints. + If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. + Also be sure to include those monitored dll to your own sysmon config. +known_false_positives: False positives may occur if legitimate office documents are + executing macro code. Ensure to investigate the macro code and the command to be + executed. If the macro code is benign, add the document name to the exclusion list. + Some applications may legitimately load VBE7INTL.DLL, VBE7.DLL, or VBEUI.DLL. +references: +- https://www.joesandbox.com/analysis/386500/0/html +- https://www.joesandbox.com/analysis/702680/0/html +- https://bazaar.abuse.ch/sample/02cbc1ab80695fc12ff8822b926957c3a600247b9ca412a137f69cb5716c8781/ +- https://www.fortinet.com/blog/threat-research/latest-remcos-rat-phishing +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +- https://www.fortinet.com/blog/threat-research/leveraging-microsoft-office-documents-to-deliver-agent-tesla-and-njrat +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Office document executing a macro on $dest$ + risk_objects: + - field: dest + type: system + score: 35 + threat_objects: [] +tags: + analytic_story: + - Spearphishing Attachments + - Trickbot + - IcedID + - DarkCrystal RAT + - AgentTesla + - Qakbot + - Azorult + - Remcos + - PlugX + - NjRAT + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/office_document_spawned_child_process_to_download.yml b/detections/deprecated/office_document_spawned_child_process_to_download.yml new file mode 100644 index 0000000000..def3130752 --- /dev/null +++ b/detections/deprecated/office_document_spawned_child_process_to_download.yml @@ -0,0 +1,85 @@ +name: Office Document Spawned Child Process To Download +id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 +version: 10 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic identifies Office applications spawning child + processes to download content via HTTP/HTTPS. It leverages data from Endpoint Detection + and Response (EDR) agents, focusing on process creation events where Office applications + like Word or Excel initiate network connections, excluding common browsers. This + activity is significant as it often indicates the use of malicious documents to + execute living-off-the-land binaries (LOLBins) for payload delivery. If confirmed + malicious, this behavior could lead to unauthorized code execution, data exfiltration, + or further malware deployment, posing a severe threat to the organization's security. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe", + "Graph.exe","winproj.exe") Processes.process IN ("*http:*","*https:*") NOT (Processes.original_file_name + IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) by Processes.dest + Processes.user Processes.parent_process_name Processes.process_name Processes.process + Processes.process_id Processes.parent_process_id Processes.original_file_name | + `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `office_document_spawned_child_process_to_download_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Default browser not in the filter list. +references: +- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/ +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Office document spawning suspicious child process on $dest$ + risk_objects: + - field: dest + type: system + score: 35 + threat_objects: [] +tags: + analytic_story: + - Spearphishing Attachments + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + - PlugX + - NjRAT + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml b/detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml new file mode 100644 index 0000000000..34040e8cb5 --- /dev/null +++ b/detections/deprecated/office_product_spawning_rundll32_with_no_dll.yml @@ -0,0 +1,89 @@ +name: Office Product Spawning Rundll32 with no DLL +id: c661f6be-a38c-11eb-be57-acde48001122 +version: 10 +date: '2025-01-24' +author: Michael Haag, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects any Windows Office Product spawning `rundll32.exe` + without a `.dll` file extension. This behavior is identified using Endpoint Detection + and Response (EDR) telemetry, focusing on process and parent process relationships. + This activity is significant as it is a known tactic of the IcedID malware family, + which can lead to unauthorized code execution. If confirmed malicious, this could + allow attackers to execute arbitrary code, potentially leading to data exfiltration, + system compromise, or further malware deployment. Immediate investigation and containment + are recommended. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe", + "msaccess.exe", "Graph.exe","winproj.exe") `process_rundll32` (Processes.process!=*.dll*) + by Processes.dest Processes.user Processes.parent_process_name Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `office_product_spawning_rundll32_with_no_dll_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positives should be limited, but if any are present, + filter as needed. +references: +- https://www.joesandbox.com/analysis/395471/0/html +- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/ +- https://any.run/malware-trends/icedid +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Office process $parent_process_name$ observed executing a suspicious child + process $process_name$ with process id $process_id$ and no dll commandline $process$ + on host $dest$ + risk_objects: + - field: dest + type: system + score: 63 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - CVE-2023-36884 Office and Windows HTML RCE Vulnerability + - Compromised Windows Host + asset_type: Endpoint + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/office_product_writing_cab_or_inf.yml b/detections/deprecated/office_product_writing_cab_or_inf.yml new file mode 100644 index 0000000000..dbea8b4ac3 --- /dev/null +++ b/detections/deprecated/office_product_writing_cab_or_inf.yml @@ -0,0 +1,92 @@ +name: Office Product Writing cab or inf +id: f48cd1d4-125a-11ec-a447-acde48001122 +version: 10 +date: '2025-01-24' +author: Michael Haag, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects Office products writing .cab or .inf files, + indicative of CVE-2021-40444 exploitation. It leverages the Endpoint.Processes and + Endpoint.Filesystem data models to identify Office applications creating these file + types. This activity is significant as it may signal an attempt to load malicious + ActiveX controls and download remote payloads, a known attack vector. If confirmed + malicious, this could lead to remote code execution, allowing attackers to gain + control over the affected system and potentially compromise sensitive data. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +- Sysmon EventID 11 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where Processes.process_name IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") + by _time span=1h Processes.process_id Processes.process_name Processes.process Processes.dest + Processes.process_guid | `drop_dm_object_name(Processes)` |rename process_guid as + proc_guid | join proc_guid, _time [ | tstats `security_content_summariesonly` count + min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem + where Filesystem.file_name IN ("*.inf","*.cab") by _time span=1h Filesystem.dest + Filesystem.file_create_time Filesystem.file_name Filesystem.file_path Filesystem.process_guid + | `drop_dm_object_name(Filesystem)` |rename process_guid as proc_guid | fields _time + dest file_create_time file_name file_path process_name process_path process proc_guid] + | dedup file_create_time | table dest, process_name, process, file_create_time, + file_name, file_path, proc_guid | `office_product_writing_cab_or_inf_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` + node. +known_false_positives: The query is structured in a way that `action` (read, create) + is not defined. Review the results of this query, filter, and tune as necessary. + It may be necessary to generate this query specific to your endpoint product. +references: +- https://twitter.com/vxunderground/status/1436326057179860992?s=20 +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://twitter.com/RonnyTNL/status/1436334640617373699?s=20 +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on $dest$ writing an inf or + cab file to this. This is not typical of $process_name$. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - Compromised Windows Host + asset_type: Endpoint + cve: + - CVE-2021-40444 + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_cabinf.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/office_spawning_control.yml b/detections/deprecated/office_spawning_control.yml new file mode 100644 index 0000000000..ac4c987bc2 --- /dev/null +++ b/detections/deprecated/office_spawning_control.yml @@ -0,0 +1,94 @@ +name: Office Spawning Control +id: 053e027c-10c7-11ec-8437-acde48001122 +version: 10 +date: '2025-01-24' +author: Michael Haag, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic identifies instances where `control.exe` is spawned + by a Microsoft Office product. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process and parent process relationships. This activity + is significant because it can indicate exploitation attempts related to CVE-2021-40444, + where `control.exe` is used to execute malicious .cpl or .inf files. If confirmed + malicious, this behavior could allow an attacker to execute arbitrary code, potentially + leading to system compromise, data exfiltration, or further lateral movement within + the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe","wordpad.exe","wordview.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") + Processes.process_name=control.exe by Processes.dest Processes.user Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)`| `office_spawning_control_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Limited false positives should be present. +references: +- https://strontic.github.io/xcyclopedia/library/control.exe-1F13E714A0FEA8887707DFF49287996F.html +- https://app.any.run/tasks/36c14029-9df8-439c-bba0-45f2643b0c70/ +- https://attack.mitre.org/techniques/T1218/011/ +- https://www.echotrail.io/insights/search/control.exe/ +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.002/T1218.002.yaml +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ clicking a suspicious attachment. + risk_objects: + - field: dest + type: system + score: 80 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - Microsoft MSHTML Remote Code Execution CVE-2021-40444 + - Compromised Windows Host + asset_type: Endpoint + cve: + - CVE-2021-40444 + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_control.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/password_policy_discovery_with_net.yml b/detections/deprecated/password_policy_discovery_with_net.yml new file mode 100644 index 0000000000..0656e661c8 --- /dev/null +++ b/detections/deprecated/password_policy_discovery_with_net.yml @@ -0,0 +1,57 @@ +name: Password Policy Discovery with Net +id: 09336538-065a-11ec-8665-acde48001122 +version: 7 +date: '2025-01-24' +author: Teoderick Contreras, Mauricio Velazco, Splunk +status: deprecated +type: Hunting +description: The following analytic has been deprecated. + The following analytic identifies the execution of `net.exe` or `net1.exe` + with command line arguments aimed at obtaining the domain password policy. It leverages + data from Endpoint Detection and Response (EDR) agents, focusing on process names + and command-line executions. This activity is significant as it indicates potential + reconnaissance efforts by adversaries to gather information about Active Directory + password policies. If confirmed malicious, this behavior could allow attackers to + understand password complexity requirements, aiding in brute-force or password-guessing + attacks, ultimately compromising user accounts and gaining unauthorized access to + the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` AND Processes.process + = "*accounts*" AND Processes.process = "*/domain*" by Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id Processes.parent_process_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `password_policy_discovery_with_net_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +tags: + analytic_story: + - Active Directory Discovery + asset_type: Endpoint + mitre_attack_id: + - T1201 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/pwd_policy_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/windows_command_shell_fetch_env_variables.yml b/detections/deprecated/windows_command_shell_fetch_env_variables.yml new file mode 100644 index 0000000000..90618ba3e5 --- /dev/null +++ b/detections/deprecated/windows_command_shell_fetch_env_variables.yml @@ -0,0 +1,81 @@ +name: Windows Command Shell Fetch Env Variables +id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 +version: 5 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic identifies a suspicious process command line fetching + environment variables with a non-shell parent process. It leverages data from Endpoint + Detection and Response (EDR) agents, focusing on command-line executions and parent + process names. This activity is significant as it is commonly associated with malware + like Qakbot, which uses this technique to gather system information. If confirmed + malicious, this behavior could indicate that the parent process has been compromised, + potentially allowing attackers to execute arbitrary commands, escalate privileges, + or persist within the environment. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process = "*cmd /c + set" OR Processes.process = "*cmd.exe /c set" AND NOT (Processes.parent_process_name + = "cmd.exe" OR Processes.parent_process_name = "powershell*" OR Processes.parent_process_name="pwsh.exe" + OR Processes.parent_process_name = "explorer.exe") by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id Processes.original_file_name | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_command_shell_fetch_env_variables_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: shell process that are not included in this search may cause + False positive. Filter is needed. +references: +- https://twitter.com/pr0xylife/status/1585612370441031680?s=46&t=Dc3CJi4AnM-8rNoacLbScg +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: non-shell parent process has a child process $process_name$ with a commandline + $process$ to fetch env variables on $dest$ + risk_objects: + - field: dest + type: system + score: 56 + threat_objects: [] +tags: + analytic_story: + - Qakbot + asset_type: Endpoint + mitre_attack_id: + - T1055 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/qakbot/qbot_wermgr/sysmon_wermgr.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/windows_modify_registry_reg_restore.yml b/detections/deprecated/windows_modify_registry_reg_restore.yml new file mode 100644 index 0000000000..f63d1b0214 --- /dev/null +++ b/detections/deprecated/windows_modify_registry_reg_restore.yml @@ -0,0 +1,60 @@ +name: Windows Modify Registry Reg Restore +id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e +version: 5 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: Hunting +description: The following analytic has been deprecated. + The following analytic detects the execution of reg.exe with the "restore" + parameter, indicating an attempt to restore registry backup data on a host. This + detection leverages data from Endpoint Detection and Response (EDR) agents, focusing + on process execution logs and command-line arguments. This activity is significant + as it may indicate post-exploitation actions, such as those performed by tools like + winpeas, which use "reg save" and "reg restore" to manipulate registry settings. + If confirmed malicious, this could allow an attacker to revert registry changes, + potentially bypassing security controls and maintaining persistence. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process + = "* restore *" by Processes.process_name Processes.original_file_name Processes.process + Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process + Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_modify_registry_reg_restore_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: network administrator can use this command tool to backup registry + before updates or modifying critical registries. +references: +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser +- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS +- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ +tags: + analytic_story: + - Windows Post-Exploitation + - Prestige Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/windows_msiexec_with_network_connections.yml b/detections/deprecated/windows_msiexec_with_network_connections.yml new file mode 100644 index 0000000000..26347f6535 --- /dev/null +++ b/detections/deprecated/windows_msiexec_with_network_connections.yml @@ -0,0 +1,87 @@ +name: Windows MSIExec With Network Connections +id: 827409a1-5393-4d8d-8da4-bbb297c262a7 +version: 6 +date: '2025-01-24' +author: Michael Haag, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects MSIExec making network connections over + ports 443 or 80. This behavior is identified by correlating process creation events + from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, + MSIExec does not perform network communication to the internet, making this activity + unusual and potentially indicative of malicious behavior. If confirmed malicious, + an attacker could be using MSIExec to download or communicate with external servers, + potentially leading to data exfiltration, command and control (C2) communication, + or further malware deployment. +data_source: +- Sysmon EventID 1 AND Sysmon EventID 3 +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where `process_msiexec` by _time Processes.user Processes.process_id Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_id [| tstats `security_content_summariesonly` count FROM datamodel=Network_Traffic.All_Traffic + where All_Traffic.dest_port IN ("80","443") by All_Traffic.process_id All_Traffic.dest + All_Traffic.dest_port All_Traffic.dest_ip | `drop_dm_object_name(All_Traffic)` ] + | table _time user dest parent_process_name process_name process_path process process_id + dest_port dest_ip | `windows_msiexec_with_network_connections_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positives will be present and filtering is required. +references: +- https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.007/T1218.007.md +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $process_name$ was identified on endpoint $dest$ contacting + a remote destination $dest_ip$ + risk_objects: + - field: user + type: user + score: 35 + - field: dest + type: system + score: 35 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Windows System Binary Proxy Execution MSIExec + asset_type: Endpoint + mitre_attack_id: + - T1218.007 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.007/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/windows_network_share_interaction_with_net.yml b/detections/deprecated/windows_network_share_interaction_with_net.yml new file mode 100644 index 0000000000..fea71519c1 --- /dev/null +++ b/detections/deprecated/windows_network_share_interaction_with_net.yml @@ -0,0 +1,80 @@ +name: Windows Network Share Interaction With Net +id: 4dc3951f-b3f8-4f46-b412-76a483f72277 +version: 6 +date: '2025-01-24' +author: Dean Luxton +status: deprecated +type: TTP +data_source: +- Sysmon EventID 1 +description: The following analytic has been deprecated. + This analytic detects network share discovery and collection activities + performed on Windows systems using the Net command. Attackers often use network + share discovery to identify accessible shared resources within a network, which + can be a precursor to privilege escalation or data exfiltration. By monitoring Windows + Event Logs for the usage of the Net command to list and interact with network shares, + this detection helps identify potential reconnaissance and collection activities. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime values(Processes.user_category) as user_category values(Processes.user_bunit) + as user_bunit FROM datamodel=Endpoint.Processes WHERE `process_net` BY Processes.user + Processes.dest Processes.process_exec Processes.parent_process_exec Processes.process + Processes.parent_process | `drop_dm_object_name(Processes)` | regex process="net[\s\.ex1]+view|net[\s\.ex1]+share|net[\s\.ex1]+use\s" + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_network_share_interaction_with_net_filter`' +how_to_implement: The detection is based on data originating from either Endpoint + Detection and Response (EDR) telemetry or EventCode 4688 with process command line + logging enabled. These sources provide security-related telemetry from the endpoints. + To implement this search, you must ingest logs that contain the process name, parent + process, and complete command-line executions. These logs must be mapped to the + Splunk Common Information Model (CIM) to normalize the field names capture the data + within the datamodel schema. +known_false_positives: Unknown +references: +- https://attack.mitre.org/techniques/T1135/ +drilldown_searches: +- name: View the detection results for - "$dest$" and "$user$" + search: '%original_detection_search% | search dest = "$dest$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$", + "$user$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: User $user$ leveraged net.exe on $dest$ to interact with network shares, + executed by parent process $parent_process$ + risk_objects: + - field: dest + type: system + score: 20 + - field: user + type: user + score: 20 + threat_objects: [] +tags: + analytic_story: + - Active Directory Discovery + - Active Directory Privilege Escalation + - Network Discovery + asset_type: Endpoint + atomic_guid: + - ab39a04f-0c93-4540-9ff2-83f862c385ae + mitre_attack_id: + - T1135 + - T1039 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1135/net_share/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/windows_office_product_spawning_msdt.yml b/detections/deprecated/windows_office_product_spawning_msdt.yml new file mode 100644 index 0000000000..ad36ac3325 --- /dev/null +++ b/detections/deprecated/windows_office_product_spawning_msdt.yml @@ -0,0 +1,96 @@ +name: Windows Office Product Spawning MSDT +id: 127eba64-c981-40bf-8589-1830638864a7 +version: 9 +date: '2025-01-24' +author: Michael Haag, Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects a Microsoft Office product spawning the + Windows msdt.exe process. This detection leverages data from Endpoint Detection + and Response (EDR) agents, focusing on process creation events where Office applications + are the parent process. This activity is significant as it may indicate an attempt + to exploit protocol handlers to bypass security controls, even if macros are disabled. + If confirmed malicious, this behavior could allow an attacker to execute arbitrary + code, potentially leading to system compromise, data exfiltration, or further lateral + movement within the network. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name + IN ("winword.exe","excel.exe","powerpnt.exe","outlook.exe","mspub.exe","visio.exe","onenote.exe","onenotem.exe","onenoteviewer.exe","onenoteim.exe","msaccess.exe") + Processes.process_name=msdt.exe by Processes.dest Processes.user Processes.parent_process_name + Processes.parent_process Processes.process_name Processes.original_file_name Processes.process + Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `windows_office_product_spawning_msdt_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: False positives should be limited, however filter as needed. +references: +- https://isc.sans.edu/diary/rss/28694 +- https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e +- https://twitter.com/nao_sec/status/1530196847679401984?s=20&t=ZiXYI4dQuA-0_dzQzSUb3A +- https://app.any.run/tasks/713f05d2-fe78-4b9d-a744-f7c133e3fafb/ +- https://www.virustotal.com/gui/file/4a24048f81afbe9fb62e7a6a49adbd1faf41f266b5f9feecdceb567aec096784/detection +- https://strontic.github.io/xcyclopedia/library/msdt.exe-152D4C9F63EFB332CCB134C6953C0104.html +- https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/trojanized-onenote-document-leads-to-formbook-malware/ +drilldown_searches: +- name: View the detection results for - "$user$" and "$dest$" + search: '%original_detection_search% | search user = "$user$" dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$user$" and "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$user$", + "$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) + as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk + Message" values(analyticstories) as "Analytic Stories" values(annotations._all) + as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" + by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: Office process $parent_process_name$ has spawned a child process $process_name$ + on host $dest$. + risk_objects: + - field: user + type: user + score: 100 + - field: dest + type: system + score: 100 + threat_objects: + - field: parent_process_name + type: parent_process_name + - field: process_name + type: process_name +tags: + analytic_story: + - Spearphishing Attachments + - Compromised Windows Host + - Microsoft Support Diagnostic Tool Vulnerability CVE-2022-30190 + asset_type: Endpoint + cve: + - CVE-2022-30190 + mitre_attack_id: + - T1566 + - T1566.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/msdt.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/windows_query_registry_reg_save.yml b/detections/deprecated/windows_query_registry_reg_save.yml new file mode 100644 index 0000000000..291c0cf7a0 --- /dev/null +++ b/detections/deprecated/windows_query_registry_reg_save.yml @@ -0,0 +1,60 @@ +name: Windows Query Registry Reg Save +id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 +version: 6 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: Hunting +description: The following analytic has been deprecated. + The following analytic detects the execution of the reg.exe process with + the "save" parameter. This detection leverages data from Endpoint Detection and + Response (EDR) agents, focusing on process execution logs and command-line arguments. + This activity is significant because threat actors often use the "reg save" command + to dump credentials or test registry modification capabilities on compromised hosts. + If confirmed malicious, this behavior could allow attackers to escalate privileges, + persist in the environment, or access sensitive information stored in the registry. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_reg` AND Processes.process + = "* save *" by Processes.process_name Processes.original_file_name Processes.process + Processes.process_id Processes.process_guid Processes.parent_process_name Processes.parent_process + Processes.parent_process_guid Processes.dest Processes.user | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_query_registry_reg_save_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: network administrator can use this command tool to backup registry + before updates or modifying critical registries. +references: +- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/quser +- https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS +- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ +tags: + analytic_story: + - Windows Post-Exploitation + - CISA AA23-347A + - Prestige Ransomware + asset_type: Endpoint + mitre_attack_id: + - T1012 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/winpeas/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/windows_service_stop_via_net__and_sc_application.yml b/detections/deprecated/windows_service_stop_via_net__and_sc_application.yml new file mode 100644 index 0000000000..00ff416650 --- /dev/null +++ b/detections/deprecated/windows_service_stop_via_net__and_sc_application.yml @@ -0,0 +1,79 @@ +name: Windows Service Stop Via Net and SC Application +id: 827af04b-0d08-479b-9b84-b7d4644e4b80 +version: 5 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: Anomaly +description: The following analytic has been deprecated. + The following analytic identifies attempts to stop services on a system + using `net.exe` or `sc.exe`. It leverages data from Endpoint Detection and Response + (EDR) agents, focusing on process names, GUIDs, and command-line executions. This + activity is significant as adversaries often terminate security or critical services + to evade detection and further their objectives. If confirmed malicious, this behavior + could allow attackers to disable security defenses, facilitate ransomware encryption, + or disrupt essential services, leading to potential data loss or system compromise. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_net` OR Processes.process_name + = "sc.exe" OR Processes.original_file_name= "sc.exe" AND Processes.process="*stop*" + by Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.process_guid Processes.parent_process_name Processes.parent_process Processes.parent_process_guid + Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_service_stop_via_net__and_sc_application_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: Windows OS or software may stop and restart services due to + some critical update. +references: +- https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/ +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: $process$ was executed on $dest$ attempting to stop service. + risk_objects: + - field: dest + type: system + score: 49 + threat_objects: [] +tags: + analytic_story: + - Prestige Ransomware + - Graceful Wipe Out Attack + asset_type: Endpoint + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/prestige_ransomware/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/deprecated/windows_valid_account_with_never_expires_password.yml b/detections/deprecated/windows_valid_account_with_never_expires_password.yml new file mode 100644 index 0000000000..01b416d1d5 --- /dev/null +++ b/detections/deprecated/windows_valid_account_with_never_expires_password.yml @@ -0,0 +1,82 @@ +name: Windows Valid Account With Never Expires Password +id: 73a931db-1830-48b3-8296-cd9cfa09c3c8 +version: 6 +date: '2025-01-24' +author: Teoderick Contreras, Splunk +status: deprecated +type: TTP +description: The following analytic has been deprecated. + The following analytic detects the use of net.exe to update user account + policies to set passwords as non-expiring. It leverages data from Endpoint Detection + and Response (EDR) agents, focusing on command-line executions involving "/maxpwage:unlimited". + This activity is significant as it can indicate an attempt to maintain persistence, + escalate privileges, evade defenses, or facilitate lateral movement. If confirmed + malicious, this behavior could allow an attacker to maintain long-term access to + compromised accounts, potentially leading to further exploitation and unauthorized + access to sensitive information. +data_source: +- Sysmon EventID 1 +- Windows Event Log Security 4688 +- CrowdStrike ProcessRollup2 +search: '| tstats `security_content_summariesonly` values(Processes.process) as process + min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_net` AND Processes.process="* accounts *" AND Processes.process="* + /maxpwage:unlimited" by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.original_file_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `windows_valid_account_with_never_expires_password_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: This behavior is not commonly seen in production environment + and not advisable, filter as needed. +references: +- https://app.any.run/tasks/a6f2ffe2-e6e2-4396-ae2e-04ea0143f2d8/ +- https://docs.microsoft.com/en-us/troubleshoot/windows-server/networking/net-commands-on-operating-systems +drilldown_searches: +- name: View the detection results for - "$dest$" + search: '%original_detection_search% | search dest = "$dest$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$dest$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ attempting to make non-expiring password on host user accounts. + risk_objects: + - field: dest + type: system + score: 100 + threat_objects: [] +tags: + analytic_story: + - Azorult + - Compromised Windows Host + asset_type: Endpoint + mitre_attack_id: + - T1489 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: + https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/azorult/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml index 0e5f984f6a..29d3189d49 100644 --- a/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml +++ b/detections/endpoint/linux_auditd_private_keys_and_certificate_enumeration.yml @@ -1,6 +1,6 @@ name: Linux Auditd Private Keys and Certificate Enumeration -id: 80bb9988-190b-4ee0-a3c3-509545a8f678 -version: 4 +id: 892eb674-3344-4143-8e52-4775b1daf3f1 +version: 1 date: '2025-01-15' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml index 1d0ac6798c..593947e09e 100644 --- a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml +++ b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml @@ -1,6 +1,6 @@ name: Potential System Network Configuration Discovery Activity -id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 -version: 6 +id: 3f0b95e3-3195-46ac-bea3-84fb59e7fac5 +version: 1 date: '2025-01-20' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index fa9264062b..44e85bbc42 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -1,6 +1,6 @@ name: Windows Attempt To Stop Security Service -id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 -version: 8 +id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 +version: 1 date: '2025-01-13' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml index 1201456848..76789b01ac 100644 --- a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -1,6 +1,6 @@ name: Windows Cmdline Tool Execution From Non-Shell Process -id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 -version: 6 +id: 2afa393f-b88d-41b7-9793-623c93a2dfde +version: 1 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml index 033b7f012f..518245a6d4 100644 --- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -1,6 +1,6 @@ name: Windows Create Local Administrator Account Via Net -id: b89919ed-fe5f-492c-b139-151bb162040e -version: 14 +id: 2c568c34-bb57-4b43-9d75-19c605b98e70 +version: 1 date: '2025-01-13' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/windows_excessive_service_stop_attempt.yml b/detections/endpoint/windows_excessive_service_stop_attempt.yml index 650ee8c56d..9267afdd3c 100644 --- a/detections/endpoint/windows_excessive_service_stop_attempt.yml +++ b/detections/endpoint/windows_excessive_service_stop_attempt.yml @@ -1,6 +1,6 @@ name: Windows Excessive Service Stop Attempt -id: ae8d3f4a-acd7-11eb-8846-acde48001122 -version: 6 +id: 8f3a614f-6b98-4f7d-82dd-d0df38452a8b +version: 1 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_excessive_usage_of_net_app.yml b/detections/endpoint/windows_excessive_usage_of_net_app.yml index 303b508b62..68d8e0a30f 100644 --- a/detections/endpoint/windows_excessive_usage_of_net_app.yml +++ b/detections/endpoint/windows_excessive_usage_of_net_app.yml @@ -1,6 +1,6 @@ name: Windows Excessive Usage Of Net App -id: 45e52536-ae42-11eb-b5c6-acde48001122 -version: 5 +id: 355ba810-0a20-4215-8485-9ce3f87f2e38 +version: 1 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index 94d5502310..46426413d7 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -1,6 +1,6 @@ name: Windows HTTP Network Communication From MSIExec -id: 827409a1-5393-4d8d-8da4-bbb297c262a7 -version: 5 +id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 +version: 1 date: '2025-01-17' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml index 4be4f5ad84..713dc4223e 100644 --- a/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml +++ b/detections/endpoint/windows_list_env_variables_via_set_command_from_uncommon_parent.yml @@ -1,6 +1,6 @@ name: Windows List ENV Variables Via SET Command From Uncommon Parent -id: 048839e4-1eaa-43ff-8a22-86d17f6fcc13 -version: 4 +id: aec157f4-8783-4584-aca6-754c4dc7fba9 +version: 1 date: '2025-01-17' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_network_connection_discovery_via_net.yml b/detections/endpoint/windows_network_connection_discovery_via_net.yml index 85a981ccaf..e746c54512 100644 --- a/detections/endpoint/windows_network_connection_discovery_via_net.yml +++ b/detections/endpoint/windows_network_connection_discovery_via_net.yml @@ -1,6 +1,6 @@ name: Windows Network Connection Discovery Via Net -id: 640337e5-6e41-4b7f-af06-9d9eab5e1e2d -version: 5 +id: 86a5b949-679b-4197-8d4c-9c180a818c45 +version: 1 date: '2025-01-13' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/windows_network_share_interaction_via_net.yml b/detections/endpoint/windows_network_share_interaction_via_net.yml index 47a8dd8772..b6fcefc3dc 100644 --- a/detections/endpoint/windows_network_share_interaction_via_net.yml +++ b/detections/endpoint/windows_network_share_interaction_via_net.yml @@ -1,6 +1,6 @@ name: Windows Network Share Interaction Via Net -id: 4dc3951f-b3f8-4f46-b412-76a483f72277 -version: 4 +id: e51fbdb0-0be0-474f-92ea-d289f71a695e +version: 1 date: '2025-01-20' author: Dean Luxton status: production diff --git a/detections/endpoint/windows_new_default_file_association_value_set.yml b/detections/endpoint/windows_new_default_file_association_value_set.yml index 3b77265c00..ad44980ccf 100644 --- a/detections/endpoint/windows_new_default_file_association_value_set.yml +++ b/detections/endpoint/windows_new_default_file_association_value_set.yml @@ -1,6 +1,6 @@ name: Windows New Default File Association Value Set -id: 462d17d8-1f71-11ec-ad07-acde48001122 -version: 4 +id: 7d1f031f-f1c9-43be-8b0b-c4e3e8a8928a +version: 1 date: '2025-01-15' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml index b365b97975..52313880e5 100644 --- a/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml +++ b/detections/endpoint/windows_office_product_dropped_cab_or_inf_file.yml @@ -1,6 +1,6 @@ name: Windows Office Product Dropped Cab or Inf File -id: f48cd1d4-125a-11ec-a447-acde48001122 -version: 9 +id: dbdd251e-dd45-4ec9-a555-f5e151391746 +version: 1 date: '2025-01-20' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml index 3db3fc6cf0..bf3090d832 100644 --- a/detections/endpoint/windows_office_product_dropped_uncommon_file.yml +++ b/detections/endpoint/windows_office_product_dropped_uncommon_file.yml @@ -1,6 +1,6 @@ name: Windows Office Product Dropped Uncommon File -id: 73ce70c4-146d-11ec-9184-acde48001122 -version: 8 +id: 7ac0fced-9eae-4381-a748-90dcd1aa9393 +version: 1 date: '2025-01-20' author: Teoderick Contreras, Michael Haag, Splunk, TheLawsOfChaos, Github status: production diff --git a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml index fa747992b2..2d546a5b2b 100644 --- a/detections/endpoint/windows_office_product_loaded_mshtml_module.yml +++ b/detections/endpoint/windows_office_product_loaded_mshtml_module.yml @@ -1,6 +1,6 @@ name: Windows Office Product Loaded MSHTML Module -id: 5f1c168e-118b-11ec-84ff-acde48001122 -version: 6 +id: 4cc015c9-687c-40d2-adcc-46350f66e10c +version: 1 date: '2025-01-20' author: Michael Haag, Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml index 4e37e4291b..b16c25faa3 100644 --- a/detections/endpoint/windows_office_product_loading_taskschd_dll.yml +++ b/detections/endpoint/windows_office_product_loading_taskschd_dll.yml @@ -1,6 +1,6 @@ name: Windows Office Product Loading Taskschd DLL -id: cc8b7b74-9d0f-11eb-8342-acde48001122 -version: 9 +id: d7297cfa-1f04-4714-bfbe-3679e0666959 +version: 1 date: '2025-01-20' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml index 35b2ea4bd6..d4aa93a79a 100644 --- a/detections/endpoint/windows_office_product_loading_vbe7_dll.yml +++ b/detections/endpoint/windows_office_product_loading_vbe7_dll.yml @@ -1,6 +1,6 @@ name: Windows Office Product Loading VBE7 DLL -id: b12c89bc-9d06-11eb-a592-acde48001122 -version: 8 +id: 7cfec906-2697-43f7-898b-83634a051d9a +version: 1 date: '2025-01-20' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml index 0a06c8cf3f..0b215898be 100644 --- a/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml +++ b/detections/endpoint/windows_office_product_spawned_child_process_for_download.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned Child Process For Download -id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 -version: 9 +id: f02b64b8-cbea-4f75-bf77-7a05111566b1 +version: 1 date: '2025-01-14' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_office_product_spawned_control.yml b/detections/endpoint/windows_office_product_spawned_control.yml index 1cf0c90c7e..5590c761b9 100644 --- a/detections/endpoint/windows_office_product_spawned_control.yml +++ b/detections/endpoint/windows_office_product_spawned_control.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned Control -id: 053e027c-10c7-11ec-8437-acde48001122 -version: 9 +id: 081c485d-ac8d-4bee-ad4c-525772fead4d +version: 1 date: '2025-01-14' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_office_product_spawned_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml index 42115bf883..3a79e47208 100644 --- a/detections/endpoint/windows_office_product_spawned_msdt.yml +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned MSDT -id: 127eba64-c981-40bf-8589-1830638864a7 -version: 0 +id: a3148fad-3734-4b7f-9a71-62f08d39fab1 +version: 1 date: '2025-01-14' author: Michael Haag, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml index 12f546c88a..21813278bb 100644 --- a/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml +++ b/detections/endpoint/windows_office_product_spawned_rundll32_with_no_dll.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned Rundll32 With No DLL -id: c661f6be-a38c-11eb-be57-acde48001122 -version: 9 +id: f28e787e-69ca-480e-9f98-ab970e6d4bcc +version: 1 date: '2025-01-14' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_password_policy_discovery_with_net.yml b/detections/endpoint/windows_password_policy_discovery_with_net.yml index 9253379379..42bbaeb646 100644 --- a/detections/endpoint/windows_password_policy_discovery_with_net.yml +++ b/detections/endpoint/windows_password_policy_discovery_with_net.yml @@ -1,6 +1,6 @@ name: Windows Password Policy Discovery with Net -id: 09336538-065a-11ec-8665-acde48001122 -version: 6 +id: e52f7865-be78-46bf-b7ed-150fbe447613 +version: 1 date: '2025-01-13' author: Teoderick Contreras, Mauricio Velazco, Nasreddine Bencherchali, Splunk status: production diff --git a/detections/endpoint/windows_registry_entries_exported_via_reg.yml b/detections/endpoint/windows_registry_entries_exported_via_reg.yml index 70e5fc6a36..b19bc42c31 100644 --- a/detections/endpoint/windows_registry_entries_exported_via_reg.yml +++ b/detections/endpoint/windows_registry_entries_exported_via_reg.yml @@ -1,6 +1,6 @@ name: Windows Registry Entries Exported Via Reg -id: cbee60c1-b776-456f-83c2-faa56bdbe6c6 -version: 4 +id: 466379bc-0f47-476c-8202-16ef38112e0d +version: 1 date: '2025-01-15' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_registry_entries_restored_via_reg.yml b/detections/endpoint/windows_registry_entries_restored_via_reg.yml index 0406b4c476..ae180959c0 100644 --- a/detections/endpoint/windows_registry_entries_restored_via_reg.yml +++ b/detections/endpoint/windows_registry_entries_restored_via_reg.yml @@ -1,6 +1,6 @@ name: Windows Registry Entries Restored Via Reg -id: d0072bd2-6d73-4c1b-bc77-ded6d2da3a4e -version: 4 +id: a17af481-e2ad-494c-9da6-afb4d243a019 +version: 1 date: '2025-01-14' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml index 128c59a6e9..6a7c924fe9 100644 --- a/detections/endpoint/windows_sensitive_group_discovery_with_net.yml +++ b/detections/endpoint/windows_sensitive_group_discovery_with_net.yml @@ -1,6 +1,6 @@ name: Windows Sensitive Group Discovery With Net -id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a -version: 5 +id: d9eb7cda-5622-4722-bc88-7f2442f4b5af +version: 1 date: '2025-01-13' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 77cda7a286..27d9a6ccb8 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -1,6 +1,6 @@ name: Windows Sensitive Registry Hive Dump Via CommandLine -id: 8bbb7d58-b360-11eb-ba21-acde48001122 -version: 5 +id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e +version: 1 date: '2025-01-15' author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk status: production diff --git a/detections/endpoint/windows_service_stop_attempt.yml b/detections/endpoint/windows_service_stop_attempt.yml index c203b0a66e..86253b0dc4 100644 --- a/detections/endpoint/windows_service_stop_attempt.yml +++ b/detections/endpoint/windows_service_stop_attempt.yml @@ -1,6 +1,6 @@ name: Windows Service Stop Attempt -id: 827af04b-0d08-479b-9b84-b7d4644e4b80 -version: 4 +id: dd0f07ea-f08f-4d88-96e5-cb58156e82b6 +version: 1 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml index f5a9198094..9224034cad 100644 --- a/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml +++ b/detections/endpoint/windows_set_account_password_policy_to_unlimited_via_net.yml @@ -1,6 +1,6 @@ name: Windows Set Account Password Policy To Unlimited Via Net -id: 73a931db-1830-48b3-8296-cd9cfa09c3c8 -version: 5 +id: 11f93009-8083-43fd-82a7-821fcbdc8342 +version: 1 date: '2025-01-13' author: Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production diff --git a/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml index 9a5312f111..57257bec13 100644 --- a/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml +++ b/detections/endpoint/windows_suspicious_child_process_spawned_from_webserver.yml @@ -1,6 +1,6 @@ name: Windows Suspicious Child Process Spawned From WebServer -id: 22597426-6dbd-49bd-bcdc-4ec19857192f -version: '6' +id: 2d4470ef-7158-4b47-b68b-1f7f16382156 +version: 1 date: '2025-01-13' author: Steven Dick status: production diff --git a/detections/endpoint/windows_user_deletion_via_net.yml b/detections/endpoint/windows_user_deletion_via_net.yml index 7f807ec463..33ae19c5ea 100644 --- a/detections/endpoint/windows_user_deletion_via_net.yml +++ b/detections/endpoint/windows_user_deletion_via_net.yml @@ -1,6 +1,6 @@ name: Windows User Deletion Via Net -id: 1c8c6f66-acce-11eb-aafb-acde48001122 -version: 6 +id: b0b6fd2c-8953-4d1b-8f7b-56075ea6ab3e +version: 1 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_user_disabled_via_net.yml b/detections/endpoint/windows_user_disabled_via_net.yml index b4c7b6a922..dd390a4128 100644 --- a/detections/endpoint/windows_user_disabled_via_net.yml +++ b/detections/endpoint/windows_user_disabled_via_net.yml @@ -1,6 +1,6 @@ name: Windows User Disabled Via Net -id: c0325326-acd6-11eb-98c2-acde48001122 -version: 6 +id: b0359e05-c87b-4354-83d8-aee0d890243f +version: 1 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_user_discovery_via_net.yml b/detections/endpoint/windows_user_discovery_via_net.yml index 2307f15e4a..9f736b6b2d 100644 --- a/detections/endpoint/windows_user_discovery_via_net.yml +++ b/detections/endpoint/windows_user_discovery_via_net.yml @@ -1,6 +1,6 @@ name: Windows User Discovery Via Net -id: 5d0d4830-0133-11ec-bae3-acde48001122 -version: 5 +id: 7742987e-88c1-476b-a626-a869e088ab72 +version: 1 date: '2025-01-13' author: Mauricio Velazco, Teoderick Contreras, Nasreddine Bencherchali, Splunk status: production From 63f0fb8915b5d51395e4c2f3898d59f3f9e16f7f Mon Sep 17 00:00:00 2001 From: research-bot Date: Fri, 24 Jan 2025 14:13:10 -0800 Subject: [PATCH 64/82] capitalize --- .../powershell_loading_dotnet_into_memory_via_reflection.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index cab7babf13..d848c784db 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,4 +1,4 @@ -name: PowerShell Loading DotNET Into Memory via Reflection +name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 version: 6 date: '2025-01-16' From 6c3e7df1ad7949fdfc58ce8c4260428fdcbc0c63 Mon Sep 17 00:00:00 2001 From: research-bot Date: Fri, 24 Jan 2025 17:03:47 -0800 Subject: [PATCH 65/82] notable to finding 2 --- .../application/email_attachments_with_lots_of_spaces.yml | 2 +- detections/application/okta_risk_threshold_exceeded.yml | 6 +++--- .../suspicious_email_attachment_extensions.yml | 2 +- ...zure_ad_authentication_failed_during_mfa_challenge.yml | 2 +- .../detect_web_traffic_to_dynamic_domain_providers.yml | 8 +++----- detections/endpoint/batch_file_write_to_system32.yml | 2 +- detections/endpoint/common_ransomware_extensions.yml | 3 +-- ...persistence_and_privilege_escalation_risk_behavior.yml | 4 ++-- detections/endpoint/powershell_start_or_stop_service.yml | 2 +- .../endpoint/windows_drivers_loaded_by_signature.yml | 4 ++-- .../windows_process_injection_with_public_source_path.yml | 2 +- .../windows_raw_access_to_disk_volume_partition.yml | 3 +-- .../windows_raw_access_to_master_boot_record_drive.yml | 3 +-- detections/endpoint/windows_runmru_command_execution.yml | 2 +- detections/endpoint/windows_system_file_on_disk.yml | 2 +- ...etect_hosts_connecting_to_dynamic_domain_providers.yml | 7 +++---- detections/network/detect_outbound_smb_traffic.yml | 2 +- detections/network/dns_query_length_outliers___mltk.yml | 7 +++---- detections/network/smb_traffic_spike___mltk.yml | 7 +++---- ..._public_facing_application_via_apache_commons_text.yml | 2 +- 20 files changed, 32 insertions(+), 40 deletions(-) diff --git a/detections/application/email_attachments_with_lots_of_spaces.yml b/detections/application/email_attachments_with_lots_of_spaces.yml index 68b4b36694..e75c27439a 100644 --- a/detections/application/email_attachments_with_lots_of_spaces.yml +++ b/detections/application/email_attachments_with_lots_of_spaces.yml @@ -29,7 +29,7 @@ how_to_implement: "You need to ingest data from emails. Specifically, the sender this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/` and add the correct hostname to the \"\ Phantom Instance\" field in the Adaptive Response Actions when configuring this - detection search. The notable event will be sent to Phantom and the playbook will + detection search. The finding based event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox." diff --git a/detections/application/okta_risk_threshold_exceeded.yml b/detections/application/okta_risk_threshold_exceeded.yml index 5e36be6c59..f96b59ed7a 100644 --- a/detections/application/okta_risk_threshold_exceeded.yml +++ b/detections/application/okta_risk_threshold_exceeded.yml @@ -28,9 +28,9 @@ search: '| tstats `security_content_summariesonly` values(All_Risk.analyticstori | search mitre_technique_id_count > 5 | `okta_risk_threshold_exceeded_filter`' how_to_implement: This search leverages the Risk Framework from Enterprise Security. Ensure that "Suspicious Okta Activity", "Okta Account Takeover", and "Okta MFA Exhaustion" - analytic stories are enabled. TTPs may be set to Notables for point detections; - anomalies should not be notables but rather risk generators. The correlation relies - on risk before generating a notable. Modify the value as needed. + analytic stories are enabled. TTPs may be set to finding for point detections; + anomalies should not be findings but rather intermediate findings. The correlation relies + on intermediate findings before generating a findings. Modify the value as needed. known_false_positives: False positives will be limited to the number of events generated by the analytics tied to the stories. Analytics will need to be tested and tuned, and the risk score reduced as needed based on the organization. diff --git a/detections/application/suspicious_email_attachment_extensions.yml b/detections/application/suspicious_email_attachment_extensions.yml index 0f01351ca0..3a44f76bfa 100644 --- a/detections/application/suspicious_email_attachment_extensions.yml +++ b/detections/application/suspicious_email_attachment_extensions.yml @@ -26,7 +26,7 @@ how_to_implement: "You need to ingest data from emails. Specifically, the sender Delete\" can be configured to run when any results are found by this detection search. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, and add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response - Actions when configuring this detection search. The notable event will be sent to + Actions when configuring this detection search. The finding event will be sent to Phantom and the playbook will gather further information about the file attachment and its network behaviors. If Phantom finds malicious behavior and an analyst approves of the results, the email will be deleted from the user's inbox.'" diff --git a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml index 70c74ac118..0ccbb9b85a 100644 --- a/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml +++ b/detections/cloud/azure_ad_authentication_failed_during_mfa_challenge.yml @@ -34,7 +34,7 @@ how_to_implement: You must install the latest version of Splunk Add-on for Micro known_false_positives: "False positives have been minimized by removing attempts that result in 'MFA successfully completed messages', which were found to be generated when a user opts to use a different MFA method than the default.\nFurther reductions - in notable events can be achieved through filtering 'MFA denied; duplicate authentication + in finding events can be achieved through filtering 'MFA denied; duplicate authentication attempt' messages within the auth_msg field, as they could arguably be considered as false positives." references: diff --git a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml index 04e8be45b6..853d302d85 100644 --- a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml +++ b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml @@ -19,13 +19,11 @@ how_to_implement: "This search requires you to be ingesting web-traffic logs. Yo which contains a non-exhaustive list of dynamic DNS providers. Consider periodically updating this local lookup file with new domains.\nThis search produces fields (`isDynDNS`) that are not yet supported by ES Incident Review and therefore cannot be viewed - when a notable event is raised. These fields contribute additional context to the - notable. To see the additional metadata, add the following fields, if not already + when a finding event is raised. These fields contribute additional context to the + finding. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n* **Label:** IsDynamicDNS, **Field:** - isDynDNS\nDetailed documentation on how to create a new field within Incident Review - may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` - Deprecated because duplicate." + isDynDNS\n Deprecated because duplicate." known_false_positives: It is possible that list of dynamic DNS providers is outdated and/or that the URL being requested is legitimate. references: [] diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 8702c43326..b7fa5f29ff 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -30,7 +30,7 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: It is possible for this search to generate a notable event +known_false_positives: It is possible for this search to generate a finding event for a batch file write to a path that includes the string "system32", but is not the actual Windows system directory. As such, you should confirm the path of the batch file identified by the search. In addition, a false positive may be generated diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index f13150655f..281a998ed1 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -27,8 +27,7 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ how_to_implement: 'You must be ingesting data that records the filesystem activity from your hosts to populate the Endpoint Filesystem data model node. To see the additional metadata, add the following fields, if not already present, please review - the detailed documentation on how to create a new field within Incident Review may - be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' + the detailed documentation on how to create a new field within Incident Review' known_false_positives: It is possible for a legitimate file with these extensions to be created. If this is a true ransomware attack, there will be a large number of files created with these extensions. diff --git a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml index 3fd5724dd5..5062079c03 100644 --- a/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml +++ b/detections/endpoint/linux_persistence_and_privilege_escalation_risk_behavior.yml @@ -29,9 +29,9 @@ search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | where source_count >= 4 | `linux_persistence_and_privilege_escalation_risk_behavior_filter`' how_to_implement: Ensure Linux anomaly and TTP analytics are enabled. TTP may be set - to Notables for point detections, anomaly should not be notables but risk generators. + to finding for point detections, anomaly should not be findings but risk generators. The correlation relies on more than x amount of distict detection names generated - before generating a notable. Modify the value as needed. Default value is set to + before generating a finding. Modify the value as needed. Default value is set to 4. This value may need to be increased based on activity in your environment. known_false_positives: False positives will be present based on many factors. Tune the correlation as needed to reduce too many triggers. diff --git a/detections/endpoint/powershell_start_or_stop_service.yml b/detections/endpoint/powershell_start_or_stop_service.yml index 01a0fa23c4..4779e1c10c 100644 --- a/detections/endpoint/powershell_start_or_stop_service.yml +++ b/detections/endpoint/powershell_start_or_stop_service.yml @@ -23,7 +23,7 @@ how_to_implement: To successfully implement this analytic, you will need to enab https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: This behavior may be noisy, as these cmdlets are commonly used by system administrators or other legitimate users to manage services. Therefore, - it is recommended not to enable this analytic as a direct notable or TTP. Instead, + it is recommended not to enable this analytic as a direct finding Instead, it should be used as part of a broader set of security controls to detect and investigate potential threats. references: diff --git a/detections/endpoint/windows_drivers_loaded_by_signature.yml b/detections/endpoint/windows_drivers_loaded_by_signature.yml index b5ebbbb517..7e3badca4e 100644 --- a/detections/endpoint/windows_drivers_loaded_by_signature.yml +++ b/detections/endpoint/windows_drivers_loaded_by_signature.yml @@ -23,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin endpoints. If you are using Sysmon, you must have the latest version of the Sysmon TA. Most EDR products provide the ability to review driver loads, or module loads, and using a query as such help with hunting for malicious drivers. -known_false_positives: This analytic is meant to assist with identifying drivers loaded - in the environment and not to be setup for notables off the bat. +known_false_positives: This analytic is meant to assist with identifying and hunting drivers loaded + in the environment. references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ - https://attack.mitre.org/techniques/T1014/ diff --git a/detections/endpoint/windows_process_injection_with_public_source_path.yml b/detections/endpoint/windows_process_injection_with_public_source_path.yml index 02c9d32e09..6ff6638edb 100644 --- a/detections/endpoint/windows_process_injection_with_public_source_path.yml +++ b/detections/endpoint/windows_process_injection_with_public_source_path.yml @@ -25,7 +25,7 @@ how_to_implement: To successfully implement this search, you must be ingesting d in the processes node. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. known_false_positives: Some security products or third party applications may utilize - CreateRemoteThread, filter as needed before enabling as a notable. + CreateRemoteThread, filter as needed. references: - https://unit42.paloaltonetworks.com/brute-ratel-c4-tool/ tags: diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 512144998e..d6193ca528 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -23,8 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: This event is really notable but we found minimal number of - normal application from system32 folder like svchost.exe accessing it too. In this +known_false_positives: There are som minimal number of normal applications from system32 folder like svchost.exe accessing the MBR. In this case we used 'system32' and 'syswow64' path as a filter for this detection. references: - https://blog.talosintelligence.com/2022/02/threat-advisory-hermeticwiper.html diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index f5262cc967..3692033d81 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -23,8 +23,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the raw access read event (like sysmon eventcode 9), process name and process guid from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: This event is really notable but we found minimal number of - normal application from system32 folder like svchost.exe accessing it too. In this +known_false_positives: There are som minimal number of normal applications from system32 folder like svchost.exe accessing the MBR. In this case we used 'system32' and 'syswow64' path as a filter for this detection. references: - https://www.splunk.com/en_us/blog/security/threat-advisory-strt-ta02-destructive-software.html diff --git a/detections/endpoint/windows_runmru_command_execution.yml b/detections/endpoint/windows_runmru_command_execution.yml index 83723be901..f673019307 100644 --- a/detections/endpoint/windows_runmru_command_execution.yml +++ b/detections/endpoint/windows_runmru_command_execution.yml @@ -35,7 +35,7 @@ known_false_positives: This detection may generate a few false positives, such a legitimate software updates or legitimate system maintenance activities that modify the RunMRU key. However, the exclusion of MRUList value changes helps reduce the number of false positives by focusing only on actual command entries. Add any specific - false positives to the built in filter to reduce notables as needed. + false positives to the built in filter to reduce findings as needed. references: - https://medium.com/@ahmed.moh.farou2/fake-captcha-campaign-on-arabic-pirated-movie-sites-delivers-lumma-stealer-4f203f7adabf - https://medium.com/@shaherzakaria8/downloading-trojan-lumma-infostealer-through-capatcha-1f25255a0e71 diff --git a/detections/endpoint/windows_system_file_on_disk.yml b/detections/endpoint/windows_system_file_on_disk.yml index 385415afd9..8550359fdd 100644 --- a/detections/endpoint/windows_system_file_on_disk.yml +++ b/detections/endpoint/windows_system_file_on_disk.yml @@ -24,7 +24,7 @@ how_to_implement: To successfully implement this search you need to be ingesting In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. In addition, filtering may occur by adding NOT (Filesystem.file_path IN ("*\\Windows\\*", "*\\Program File*", "*\\systemroot\\*","%SystemRoot%*", "system32\*")). - This will level out the noise generated to potentally lead to generating notables. + This will level out the noise generated to potentally lead to generating findings. known_false_positives: False positives will be present. Filter as needed. references: - https://redcanary.com/blog/tracking-driver-inventory-to-expose-rootkits/ diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index c8886d955a..c5f4d94b92 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -26,13 +26,12 @@ how_to_implement: "First, you'll need to ingest data from your DNS operations. T which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of `dynamic_dns_providers_local.csv`.\n This search produces fields (query, answer, isDynDNS) that are not yet supported - by ES Incident Review and therefore cannot be viewed when a notable event is raised. - These fields contribute additional context to the notable event. To see the additional + by ES Incident Review and therefore cannot be viewed when a finding is raised. + These fields contribute additional context to the finding. To see the additional metadata, add the following fields, if not already present, to Incident Review. Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n* **Label:** DNS Query, **Field:** query\n* **Label:** DNS Answer, - **Field:** answer\n* **Label:** IsDynamicDNS, **Field:** isDynDNS\nDetailed documentation - on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`" + **Field:** answer\n* **Label:** IsDynamicDNS, **Field:** isDynDNS\n" known_false_positives: Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified. diff --git a/detections/network/detect_outbound_smb_traffic.yml b/detections/network/detect_outbound_smb_traffic.yml index 3f581ed759..3a2cbf6989 100644 --- a/detections/network/detect_outbound_smb_traffic.yml +++ b/detections/network/detect_outbound_smb_traffic.yml @@ -30,7 +30,7 @@ how_to_implement: This search also requires you to be ingesting your network tra known_false_positives: It is likely that the outbound Server Message Block (SMB) traffic is legitimate, if the company's internal networks are not well-defined in the Assets and Identity Framework. Categorize the internal CIDR blocks as `internal` in the - lookup file to avoid creating notable events for traffic destined to those CIDR + lookup file to avoid creating findings for traffic destined to those CIDR blocks. Any other network connection that is going out to the Internet should be investigated and blocked. Best practices suggest preventing external communications of all SMB versions and related protocols at the network boundary. diff --git a/detections/network/dns_query_length_outliers___mltk.yml b/detections/network/dns_query_length_outliers___mltk.yml index 0aad3d7e34..629215e272 100644 --- a/detections/network/dns_query_length_outliers___mltk.yml +++ b/detections/network/dns_query_length_outliers___mltk.yml @@ -31,13 +31,12 @@ how_to_implement: "To successfully implement this search, you will need to ensur available for use. You should periodically re-run the support search to rebuild the model with the latest data available in your environment.\nThis search produces fields (`query`,`query_length`,`count`) that are not yet supported by ES Incident - Review and therefore cannot be viewed when a notable event is raised. These fields - contribute additional context to the notable. To see the additional metadata, add + Review and therefore cannot be viewed when a finding event is raised. These fields + contribute additional context to the finding. To see the additional metadata, add the following fields, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n * **Label:** DNS Query, **Field:** query\n* **Label:** DNS Query Length, **Field:** - query_length\n* **Label:** Number of events, **Field:** count\nDetailed documentation - on how to create a new field within Incident Review may be found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`" + query_length\n* **Label:** Number of events, **Field:** count\n" known_false_positives: If you are seeing more results than desired, you may consider reducing the value for threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data. diff --git a/detections/network/smb_traffic_spike___mltk.yml b/detections/network/smb_traffic_spike___mltk.yml index f8b5a6e950..0ec7d9fe16 100644 --- a/detections/network/smb_traffic_spike___mltk.yml +++ b/detections/network/smb_traffic_spike___mltk.yml @@ -31,12 +31,11 @@ how_to_implement: "To successfully implement this search, you will need to ensur should periodically re-run the support search to rebuild the model with the latest data available in your environment.\nThis search produces a field (Number of events,count) that are not yet supported by ES Incident Review and therefore cannot be viewed - when a notable event is raised. This field contributes additional context to the - notable. To see the additional metadata, add the following field, if not already + when a finding is raised. This field contributes additional context to the + finding. To see the additional metadata, add the following field, if not already present, to Incident Review - Event Attributes (Configure > Incident Management > Incident Review Settings > Add New Entry):\n* **Label:** Number of events, **Field:** - count\nDetailed documentation on how to create a new field within Incident Review - is found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`" + count" known_false_positives: If you are seeing more results than desired, you may consider reducing the value of the threshold in the search. You should also periodically re-run the support search to re-build the ML model on the latest data. Please update diff --git a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml index f9e9808237..d9b87dfcf0 100644 --- a/detections/web/exploit_public_facing_application_via_apache_commons_text.yml +++ b/detections/web/exploit_public_facing_application_via_apache_commons_text.yml @@ -33,7 +33,7 @@ how_to_implement: To implement, one must be collecting network traffic that is n and tie to a specific network source type to hunt in. Tune as needed, or remove the other_lookups statement. known_false_positives: False positives are present when the values are set to 1 for - utf and lookup. It's possible to raise this to TTP (direct notable) if removal of + utf and lookup. It's possible to raise this to TTP (direct finding) if removal of other_lookups occur and Score is raised to 2 (down from 4). references: - https://sysdig.com/blog/cve-2022-42889-text4shell/ From 61d31bd4b14e369cebab37a535990018bac75ff3 Mon Sep 17 00:00:00 2001 From: pyth0n1c Date: Fri, 24 Jan 2025 17:08:40 -0800 Subject: [PATCH 66/82] Add status deprecated/production to all stories and baselines as appropriate --- baselines/baseline_of_blocked_outbound_traffic_from_aws.yml | 1 + .../baseline_of_cloud_infrastructure_api_calls_per_user.yml | 1 + baselines/baseline_of_cloud_instances_destroyed.yml | 1 + baselines/baseline_of_cloud_instances_launched.yml | 1 + .../baseline_of_cloud_security_group_api_calls_per_user.yml | 1 + baselines/baseline_of_command_line_length___mltk.yml | 1 + baselines/baseline_of_dns_query_length___mltk.yml | 1 + baselines/baseline_of_kubernetes_container_network_io.yml | 1 + baselines/baseline_of_kubernetes_container_network_io_ratio.yml | 1 + baselines/baseline_of_kubernetes_process_resource.yml | 1 + baselines/baseline_of_kubernetes_process_resource_ratio.yml | 1 + baselines/baseline_of_network_acl_activity_by_arn.yml | 1 + baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml | 1 + baselines/baseline_of_security_group_activity_by_arn.yml | 1 + baselines/baseline_of_smb_traffic___mltk.yml | 1 + baselines/count_of_assets_by_category.yml | 1 + baselines/count_of_unique_ips_connecting_to_ports.yml | 1 + baselines/create_a_list_of_approved_aws_service_accounts.yml | 1 + .../add_prohibited_processes_to_enterprise_security.yml | 1 + baselines/deprecated/baseline_of_api_calls_per_user_arn.yml | 1 + ...seline_of_excessive_aws_instances_launched_by_user___mltk.yml | 1 + ...line_of_excessive_aws_instances_terminated_by_user___mltk.yml | 1 + .../previously_seen_api_call_per_user_roles_in_cloudtrail.yml | 1 + .../previously_seen_aws_provisioning_activity_sources.yml | 1 + baselines/deprecated/previously_seen_ec2_amis.yml | 1 + baselines/deprecated/previously_seen_ec2_instance_types.yml | 1 + baselines/deprecated/previously_seen_ec2_launches_by_user.yml | 1 + baselines/deprecated/previously_seen_users_in_cloudtrail.yml | 1 + .../deprecated/update_previously_seen_users_in_cloudtrail.yml | 1 + baselines/discover_dns_records.yml | 1 + baselines/dnstwist_domain_names.yml | 1 + baselines/identify_systems_creating_remote_desktop_traffic.yml | 1 + baselines/identify_systems_receiving_remote_desktop_traffic.yml | 1 + baselines/identify_systems_using_remote_desktop.yml | 1 + baselines/monitor_successful_backups.yml | 1 + baselines/monitor_unsuccessful_backups.yml | 1 + baselines/previously_seen_aws_cross_account_activity.yml | 1 + .../previously_seen_aws_cross_account_activity___initial.yml | 1 + .../previously_seen_aws_cross_account_activity___update.yml | 1 + baselines/previously_seen_aws_regions.yml | 1 + .../previously_seen_cloud_api_calls_per_user_role___initial.yml | 1 + .../previously_seen_cloud_api_calls_per_user_role___update.yml | 1 + ...previously_seen_cloud_compute_creations_by_user___initial.yml | 1 + .../previously_seen_cloud_compute_creations_by_user___update.yml | 1 + baselines/previously_seen_cloud_compute_images___initial.yml | 1 + baselines/previously_seen_cloud_compute_images___update.yml | 1 + .../previously_seen_cloud_compute_instance_types___initial.yml | 1 + .../previously_seen_cloud_compute_instance_types___update.yml | 1 + ...ously_seen_cloud_instance_modifications_by_user___initial.yml | 1 + ...iously_seen_cloud_instance_modifications_by_user___update.yml | 1 + ...iously_seen_cloud_provisioning_activity_sources___initial.yml | 1 + ...viously_seen_cloud_provisioning_activity_sources___update.yml | 1 + baselines/previously_seen_cloud_regions___initial.yml | 1 + baselines/previously_seen_cloud_regions___update.yml | 1 + baselines/previously_seen_command_line_arguments.yml | 1 + baselines/previously_seen_ec2_modifications_by_user.yml | 1 + baselines/previously_seen_running_windows_services___initial.yml | 1 + baselines/previously_seen_running_windows_services___update.yml | 1 + baselines/previously_seen_s3_bucket_access_by_remote_ip.yml | 1 + baselines/previously_seen_users_in_cloudtrail___initial.yml | 1 + baselines/previously_seen_users_in_cloudtrail___update.yml | 1 + baselines/previously_seen_zoom_child_processes___initial.yml | 1 + baselines/previously_seen_zoom_child_processes___update.yml | 1 + baselines/systems_ready_for_spectre_meltdown_windows_patch.yml | 1 + baselines/windows_updates_install_failures.yml | 1 + baselines/windows_updates_install_successes.yml | 1 + stories/3cx_supply_chain_attack.yml | 1 + ...ubernetes_behavior_using_splunk_infrastructure_monitoring.yml | 1 + stories/acidpour.yml | 1 + stories/acidrain.yml | 1 + stories/active_directory_discovery.yml | 1 + stories/active_directory_kerberos_attacks.yml | 1 + stories/active_directory_lateral_movement.yml | 1 + stories/active_directory_password_spraying.yml | 1 + stories/active_directory_privilege_escalation.yml | 1 + ...on_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml | 1 + stories/agenttesla.yml | 1 + stories/amadey.yml | 1 + stories/apache_struts_vulnerability.yml | 1 + stories/apt29_diplomatic_deceptions_with_wineloader.yml | 1 + stories/asset_tracking.yml | 1 + stories/asyncrat.yml | 1 + ...tlassian_confluence_server_and_data_center_cve_2022_26134.yml | 1 + stories/awfulshred.yml | 1 + stories/aws_cross_account_activity.yml | 1 + stories/aws_defense_evasion.yml | 1 + stories/aws_iam_privilege_escalation.yml | 1 + stories/aws_identity_and_access_management_account_takeover.yml | 1 + stories/aws_network_acl_activity.yml | 1 + stories/aws_security_hub_alerts.yml | 1 + stories/aws_user_monitoring.yml | 1 + stories/azorult.yml | 1 + stories/azure_active_directory_account_takeover.yml | 1 + stories/azure_active_directory_persistence.yml | 1 + stories/azure_active_directory_privilege_escalation.yml | 1 + stories/baron_samedit_cve_2021_3156.yml | 1 + stories/bishopfox_sliver_adversary_emulation_framework.yml | 1 + stories/bits_jobs.yml | 1 + stories/blackbyte_ransomware.yml | 1 + stories/blacklotus_campaign.yml | 1 + stories/blackmatter_ransomware.yml | 1 + stories/blacksuit_ransomware.yml | 1 + stories/brand_monitoring.yml | 1 + stories/braodo_stealer.yml | 1 + stories/brute_ratel_c4.yml | 1 + stories/caddy_wiper.yml | 1 + stories/chaos_ransomware.yml | 1 + stories/cisa_aa22_257a.yml | 1 + stories/cisa_aa22_264a.yml | 1 + stories/cisa_aa22_277a.yml | 1 + stories/cisa_aa22_320a.yml | 1 + stories/cisa_aa23_347a.yml | 1 + stories/cisa_aa24_241a.yml | 1 + ...s_xe_software_web_management_user_interface_vulnerability.yml | 1 + .../citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml | 1 + stories/citrix_netscaler_adc_cve_2023_3519.yml | 1 + stories/citrix_sharefile_rce_cve_2023_24489.yml | 1 + stories/cleo_file_transfer_software.yml | 1 + stories/clop_ransomware.yml | 1 + stories/cloud_cryptomining.yml | 1 + stories/cloud_federated_credential_abuse.yml | 1 + stories/cobalt_strike.yml | 1 + stories/coldroot_macos_rat.yml | 1 + stories/collection_and_staging.yml | 1 + stories/command_and_control.yml | 1 + stories/compromised_linux_host.yml | 1 + stories/compromised_user_account.yml | 1 + stories/compromised_windows_host.yml | 1 + ...fluence_data_center_and_confluence_server_vulnerabilities.yml | 1 + stories/connectwise_screenconnect_vulnerabilities.yml | 1 + stories/credential_dumping.yml | 1 + stories/critical_alerts.yml | 1 + stories/crushftp_vulnerabilities.yml | 1 + stories/crypto_stealer.yml | 1 + stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml | 1 + stories/cve_2023_21716_word_rtf_heap_corruption.yml | 1 + ...scalation_vulnerability_confluence_data_center_and_server.yml | 1 + stories/cve_2023_23397_outlook_elevation_of_privilege.yml | 1 + .../cve_2023_36884_office_and_windows_html_rce_vulnerability.yml | 1 + stories/cyclops_blink.yml | 1 + stories/darkcrystal_rat.yml | 1 + stories/darkgate_malware.yml | 1 + stories/darkside_ransomware.yml | 1 + stories/data_destruction.yml | 1 + stories/data_exfiltration.yml | 1 + stories/data_protection.yml | 1 + ...defense_evasion_or_unauthorized_access_via_sddl_tampering.yml | 1 + stories/deobfuscate_decode_files_or_information.yml | 1 + stories/deprecated/aws_cryptomining.yml | 1 + stories/deprecated/aws_suspicious_provisioning_activities.yml | 1 + stories/deprecated/common_phishing_frameworks.yml | 1 + .../container_implantation_monitoring_and_investigation.yml | 1 + stories/deprecated/host_redirection.yml | 1 + stories/deprecated/kubernetes_sensitive_role_activity.yml | 1 + stories/deprecated/lateral_movement.yml | 1 + stories/deprecated/monitor_backup_solution.yml | 1 + stories/deprecated/monitor_for_unauthorized_software.yml | 1 + stories/deprecated/office_365_detections.yml | 1 + stories/deprecated/spectre_and_meltdown_vulnerabilities.yml | 1 + stories/deprecated/suspicious_aws_ec2_activities.yml | 1 + stories/deprecated/unusual_aws_ec2_modifications.yml | 1 + stories/deprecated/web_fraud_detection.yml | 1 + stories/detect_zerologon_attack.yml | 1 + stories/dev_sec_ops.yml | 1 + stories/dhs_report_ta18_074a.yml | 1 + stories/disabling_security_tools.yml | 1 + stories/dns_amplification_attacks.yml | 1 + stories/dns_hijacking.yml | 1 + stories/domain_trust_discovery.yml | 1 + stories/double_zero_destructor.yml | 1 + stories/dynamic_dns.yml | 1 + stories/emotet_malware_dhs_report_ta18_201a.yml | 1 + stories/f5_authentication_bypass_with_tmui.yml | 1 + stories/f5_big_ip_vulnerability_cve_2022_1388.yml | 1 + stories/f5_tmui_rce_cve_2020_5902.yml | 1 + stories/fin7.yml | 1 + stories/flax_typhoon.yml | 1 + stories/forest_blizzard.yml | 1 + stories/fortinet_fortinac_cve_2022_39952.yml | 1 + stories/gcp_account_takeover.yml | 1 + stories/gcp_cross_account_activity.yml | 1 + stories/gomir.yml | 1 + stories/gozi_malware.yml | 1 + stories/graceful_wipe_out_attack.yml | 1 + stories/hafnium_group.yml | 1 + stories/handala_wiper.yml | 1 + stories/hermetic_wiper.yml | 1 + stories/hidden_cobra_malware.yml | 1 + stories/icedid.yml | 1 + stories/iis_components.yml | 1 + stories/industroyer2.yml | 1 + stories/information_sabotage.yml | 1 + stories/ingress_tool_transfer.yml | 1 + stories/insider_threat.yml | 1 + stories/ivanti_connect_secure_vpn_vulnerabilities.yml | 1 + stories/ivanti_epm_vulnerabilities.yml | 1 + stories/ivanti_epmm_remote_unauthenticated_access.yml | 1 + stories/ivanti_sentry_authentication_bypass_cve_2023_38035.yml | 1 + stories/ivanti_virtual_traffic_manager_cve_2024_7593.yml | 1 + stories/jboss_vulnerability.yml | 1 + stories/jenkins_server_vulnerabilities.yml | 1 + stories/jetbrains_teamcity_unauthenticated_rce.yml | 1 + stories/jetbrains_teamcity_vulnerabilities.yml | 1 + stories/juniper_junos_remote_code_execution.yml | 1 + stories/kubernetes_scanning_activity.yml | 1 + stories/kubernetes_security.yml | 1 + stories/kubernetes_sensitive_object_access_activity.yml | 1 + stories/linux_living_off_the_land.yml | 1 + stories/linux_persistence_techniques.yml | 1 + stories/linux_post_exploitation.yml | 1 + stories/linux_privilege_escalation.yml | 1 + stories/linux_rootkit.yml | 1 + stories/living_off_the_land.yml | 1 + stories/local_privilege_escalation_with_krbrelayup.yml | 1 + stories/lockbit_ransomware.yml | 1 + stories/log4shell_cve_2021_44228.yml | 1 + stories/lumma_stealer.yml | 1 + stories/malicious_powershell.yml | 1 + stories/masquerading___rename_system_utilities.yml | 1 + stories/meduza_stealer.yml | 1 + stories/metasploit.yml | 1 + stories/meterpreter.yml | 1 + .../microsoft_mshtml_remote_code_execution_cve_2021_40444.yml | 1 + ...t_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml | 1 + ...soft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml | 1 + stories/monitor_for_updates.yml | 1 + stories/moonpeak.yml | 1 + stories/moveit_transfer_authentication_bypass.yml | 1 + stories/moveit_transfer_critical_vulnerability.yml | 1 + stories/netsh_abuse.yml | 1 + stories/network_discovery.yml | 1 + stories/njrat.yml | 1 + stories/nobelium_group.yml | 1 + stories/office_365_account_takeover.yml | 1 + stories/office_365_collection_techniques.yml | 1 + stories/office_365_persistence_mechanisms.yml | 1 + stories/okta_account_takeover.yml | 1 + stories/okta_mfa_exhaustion.yml | 1 + stories/openssl_cve_2022_3602.yml | 1 + stories/orangeworm_attack_group.yml | 1 + stories/outlook_rce_cve_2024_21378.yml | 1 + stories/papercut_mf_ng_vulnerability.yml | 1 + ...potam_ntlm_relay_on_active_directory_certificate_services.yml | 1 + stories/phemedrone_stealer.yml | 1 + stories/plugx.yml | 1 + ...door_activity_associated_with_mudcarp_espionage_campaigns.yml | 1 + stories/prestige_ransomware.yml | 1 + stories/printnightmare_cve_2021_34527.yml | 1 + stories/prohibited_traffic_allowed_or_protocol_mismatch.yml | 1 + stories/proxynotshell.yml | 1 + stories/proxyshell.yml | 1 + stories/pxa_stealer.yml | 1 + stories/qakbot.yml | 1 + stories/ransomware.yml | 1 + stories/ransomware_cloud.yml | 1 + stories/redline_stealer.yml | 1 + stories/remcos.yml | 1 + stories/reverse_network_proxy.yml | 1 + stories/revil_ransomware.yml | 1 + stories/rhysida_ransomware.yml | 1 + stories/router_and_infrastructure_security.yml | 1 + stories/ryuk_ransomware.yml | 1 + ...maccountname_spoofing_and_domain_controller_impersonation.yml | 1 + stories/samsam_ransomware.yml | 1 + stories/sandworm_tools.yml | 1 + stories/scheduled_tasks.yml | 1 + stories/shrinklocker.yml | 1 + stories/signed_binary_proxy_execution_installutil.yml | 1 + stories/silver_sparrow.yml | 1 + stories/snake_keylogger.yml | 1 + stories/snake_malware.yml | 1 + stories/sneaky_active_directory_persistence_tricks.yml | 1 + stories/spearphishing_attachments.yml | 1 + stories/spring4shell_cve_2022_22965.yml | 1 + stories/sql_injection.yml | 1 + .../subvert_trust_controls_sip_and_trust_provider_hijacking.yml | 1 + stories/suspicious_aws_login_activities.yml | 1 + stories/suspicious_aws_s3_activities.yml | 1 + stories/suspicious_aws_traffic.yml | 1 + stories/suspicious_cloud_authentication_activities.yml | 1 + stories/suspicious_cloud_instance_activities.yml | 1 + stories/suspicious_cloud_provisioning_activities.yml | 1 + stories/suspicious_cloud_user_activities.yml | 1 + stories/suspicious_command_line_executions.yml | 1 + stories/suspicious_compiled_html_activity.yml | 1 + stories/suspicious_dns_traffic.yml | 1 + stories/suspicious_emails.yml | 1 + stories/suspicious_gcp_storage_activities.yml | 1 + stories/suspicious_mshta_activity.yml | 1 + stories/suspicious_okta_activity.yml | 1 + stories/suspicious_regsvcs_regasm_activity.yml | 1 + stories/suspicious_regsvr32_activity.yml | 1 + stories/suspicious_rundll32_activity.yml | 1 + stories/suspicious_windows_registry_activities.yml | 1 + stories/suspicious_wmi_use.yml | 1 + stories/suspicious_zoom_child_processes.yml | 1 + stories/swift_slicer.yml | 1 + stories/sysaid_on_prem_software_cve_2023_47246_vulnerability.yml | 1 + stories/text4shell_cve_2022_42889.yml | 1 + stories/trickbot.yml | 1 + stories/trusted_developer_utilities_proxy_execution.yml | 1 + stories/trusted_developer_utilities_proxy_execution_msbuild.yml | 1 + stories/unusual_processes.yml | 1 + stories/use_of_cleartext_protocols.yml | 1 + stories/valleyrat.yml | 1 + stories/vmware_aria_operations_vrealize_cve_2023_20887.yml | 1 + ..._esxi_ad_integration_authentication_bypass_cve_2024_37085.yml | 1 + .../vmware_server_side_injection_and_privilege_escalation.yml | 1 + stories/volt_typhoon.yml | 1 + stories/warzone_rat.yml | 1 + stories/whispergate.yml | 1 + stories/windows_applocker.yml | 1 + stories/windows_attack_surface_reduction.yml | 1 + stories/windows_bootkits.yml | 1 + stories/windows_certificate_services.yml | 1 + stories/windows_defense_evasion_tactics.yml | 1 + stories/windows_discovery_techniques.yml | 1 + stories/windows_dns_sigred_cve_2020_1350.yml | 1 + stories/windows_drivers.yml | 1 + ...or_reporting_service_elevation_of_privilege_vulnerability.yml | 1 + stories/windows_file_extension_and_association_abuse.yml | 1 + stories/windows_log_manipulation.yml | 1 + stories/windows_persistence_techniques.yml | 1 + stories/windows_post_exploitation.yml | 1 + stories/windows_privilege_escalation.yml | 1 + stories/windows_registry_abuse.yml | 1 + stories/windows_service_abuse.yml | 1 + stories/windows_system_binary_proxy_execution_msiexec.yml | 1 + stories/winrar_spoofing_attack_cve_2023_38831.yml | 1 + stories/winter_vivern.yml | 1 + stories/wordpress_vulnerabilities.yml | 1 + stories/ws_ftp_server_critical_vulnerabilities.yml | 1 + stories/xmrig.yml | 1 + stories/xorddos.yml | 1 + stories/zscaler_browser_proxy_threats.yml | 1 + 335 files changed, 335 insertions(+) diff --git a/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml b/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml index 3a8db22f36..6c3e89a2d9 100644 --- a/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml +++ b/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the diff --git a/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml b/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml index 91be9465f9..fc25a264eb 100644 --- a/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml +++ b/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-07' author: David Dorsey, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model diff --git a/baselines/baseline_of_cloud_instances_destroyed.yml b/baselines/baseline_of_cloud_instances_destroyed.yml index b8df805a56..7c5bf16935 100644 --- a/baselines/baseline_of_cloud_instances_destroyed.yml +++ b/baselines/baseline_of_cloud_instances_destroyed.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-25' author: David Dorsey, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. diff --git a/baselines/baseline_of_cloud_instances_launched.yml b/baselines/baseline_of_cloud_instances_launched.yml index 3555b055c2..ef6e0e51b8 100644 --- a/baselines/baseline_of_cloud_instances_launched.yml +++ b/baselines/baseline_of_cloud_instances_launched.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-14' author: David Dorsey, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The diff --git a/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml b/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml index e1bef841f4..f9ba8051dc 100644 --- a/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml +++ b/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-07' author: David Dorsey, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt diff --git a/baselines/baseline_of_command_line_length___mltk.yml b/baselines/baseline_of_command_line_length___mltk.yml index 1fbadefc68..8746b93a71 100644 --- a/baselines/baseline_of_command_line_length___mltk.yml +++ b/baselines/baseline_of_command_line_length___mltk.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-05-08' author: Rico Valdez, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model diff --git a/baselines/baseline_of_dns_query_length___mltk.yml b/baselines/baseline_of_dns_query_length___mltk.yml index 7b326473e9..e638540f4f 100644 --- a/baselines/baseline_of_dns_query_length___mltk.yml +++ b/baselines/baseline_of_dns_query_length___mltk.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-05-08' author: Rico Valdez, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build diff --git a/baselines/baseline_of_kubernetes_container_network_io.yml b/baselines/baseline_of_kubernetes_container_network_io.yml index 74505f05a9..63ecf5e914 100644 --- a/baselines/baseline_of_kubernetes_container_network_io.yml +++ b/baselines/baseline_of_kubernetes_container_network_io.yml @@ -4,6 +4,7 @@ version: 4 date: '2024-09-24' author: Matthew Moore, Splunk type: Baseline +status: production description: This baseline rule calculates the average and standard deviation of inbound and outbound network IO for each Kubernetes container. It uses metrics from the Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule generates diff --git a/baselines/baseline_of_kubernetes_container_network_io_ratio.yml b/baselines/baseline_of_kubernetes_container_network_io_ratio.yml index 135f36eb3e..05799ca815 100644 --- a/baselines/baseline_of_kubernetes_container_network_io_ratio.yml +++ b/baselines/baseline_of_kubernetes_container_network_io_ratio.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Matthew Moore, Splunk type: Baseline +status: production description: This baseline rule calculates the average ratio of inbound to outbound network IO for each Kubernetes container. It uses metrics from the Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule generates a lookup table diff --git a/baselines/baseline_of_kubernetes_process_resource.yml b/baselines/baseline_of_kubernetes_process_resource.yml index 5fff3368d3..cb7c999811 100644 --- a/baselines/baseline_of_kubernetes_process_resource.yml +++ b/baselines/baseline_of_kubernetes_process_resource.yml @@ -4,6 +4,7 @@ version: 1 date: '2023-12-18' author: Matthew Moore, Splunk type: Baseline +status: production description: This baseline rule calculates the average and standard deviation of various process resources in a Kubernetes environment. It uses metrics from the Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule generates a lookup diff --git a/baselines/baseline_of_kubernetes_process_resource_ratio.yml b/baselines/baseline_of_kubernetes_process_resource_ratio.yml index b767c26d4c..a92b872bd1 100644 --- a/baselines/baseline_of_kubernetes_process_resource_ratio.yml +++ b/baselines/baseline_of_kubernetes_process_resource_ratio.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Matthew Moore, Splunk type: Baseline +status: production description: This baseline rule calculates the average and standard deviation of the ratio of various process resources in a Kubernetes environment. It uses metrics from the Kubernetes API and the Splunk Infrastructure Monitoring Add-on. The rule diff --git a/baselines/baseline_of_network_acl_activity_by_arn.yml b/baselines/baseline_of_network_acl_activity_by_arn.yml index b6d39532c0..e56f565690 100644 --- a/baselines/baseline_of_network_acl_activity_by_arn.yml +++ b/baselines/baseline_of_network_acl_activity_by_arn.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-05-21' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then diff --git a/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml b/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml index 4ae9abb798..a8661c3264 100644 --- a/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml +++ b/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-07-17' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted diff --git a/baselines/baseline_of_security_group_activity_by_arn.yml b/baselines/baseline_of_security_group_activity_by_arn.yml index cd9a7837f5..c5a8812fba 100644 --- a/baselines/baseline_of_security_group_activity_by_arn.yml +++ b/baselines/baseline_of_security_group_activity_by_arn.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-04-17' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted diff --git a/baselines/baseline_of_smb_traffic___mltk.yml b/baselines/baseline_of_smb_traffic___mltk.yml index 88765d150a..7dfa90cf4b 100644 --- a/baselines/baseline_of_smb_traffic___mltk.yml +++ b/baselines/baseline_of_smb_traffic___mltk.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-05-08' author: Rico Valdez, Splunk type: Baseline +status: production description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The diff --git a/baselines/count_of_assets_by_category.yml b/baselines/count_of_assets_by_category.yml index edd45150fe..7824f09bb9 100644 --- a/baselines/count_of_assets_by_category.yml +++ b/baselines/count_of_assets_by_category.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search shows you every asset category you have and the assets that belong to those categories. search: '| from datamodel Identity_Management.All_Assets | stats count values(nt_host) diff --git a/baselines/count_of_unique_ips_connecting_to_ports.yml b/baselines/count_of_unique_ips_connecting_to_ports.yml index cee44026b8..f11befde8a 100644 --- a/baselines/count_of_unique_ips_connecting_to_ports.yml +++ b/baselines/count_of_unique_ips_connecting_to_ports.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-13' author: David Dorsey, Splunk type: Baseline +status: production description: The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. search: '| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts diff --git a/baselines/create_a_list_of_approved_aws_service_accounts.yml b/baselines/create_a_list_of_approved_aws_service_accounts.yml index 2070b5f700..f8b46ac7ff 100644 --- a/baselines/create_a_list_of_approved_aws_service_accounts.yml +++ b/baselines/create_a_list_of_approved_aws_service_accounts.yml @@ -4,6 +4,7 @@ version: 2 date: '2018-12-03' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. diff --git a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml b/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml index 2364121ba3..607a5f9829 100644 --- a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml +++ b/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-15' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. diff --git a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml b/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml index 2b4bb26ab1..461b657a67 100644 --- a/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml +++ b/baselines/deprecated/baseline_of_api_calls_per_user_arn.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-04-09' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml index 96be5c56e5..ade1932593 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml +++ b/baselines/deprecated/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-11-14' author: Jason Brewer, Splunk type: Baseline +status: deprecated description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is diff --git a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml index 080da29767..a6d890da08 100644 --- a/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml +++ b/baselines/deprecated/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-11-14' author: Jason Brewer, Splunk type: Baseline +status: deprecated description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search diff --git a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml index e347df4a88..71a860c70b 100644 --- a/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml +++ b/baselines/deprecated/previously_seen_api_call_per_user_roles_in_cloudtrail.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-04-16' author: Bhavin Patel, Splunk type: Baseline +status: deprecated description: This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user diff --git a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml b/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml index c468db240d..b0c5e90290 100644 --- a/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml +++ b/baselines/deprecated/previously_seen_aws_provisioning_activity_sources.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-16' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. diff --git a/baselines/deprecated/previously_seen_ec2_amis.yml b/baselines/deprecated/previously_seen_ec2_amis.yml index be58902ef0..1550cdf588 100644 --- a/baselines/deprecated/previously_seen_ec2_amis.yml +++ b/baselines/deprecated/previously_seen_ec2_amis.yml @@ -4,6 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search builds a table of previously seen AMIs used to launch EC2 instances search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId diff --git a/baselines/deprecated/previously_seen_ec2_instance_types.yml b/baselines/deprecated/previously_seen_ec2_instance_types.yml index f6dfa52c5d..cfff4e6d58 100644 --- a/baselines/deprecated/previously_seen_ec2_instance_types.yml +++ b/baselines/deprecated/previously_seen_ec2_instance_types.yml @@ -4,6 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search builds a table of previously seen EC2 instance types search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time) diff --git a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml b/baselines/deprecated/previously_seen_ec2_launches_by_user.yml index fac412ebec..d1aa8e8045 100644 --- a/baselines/deprecated/previously_seen_ec2_launches_by_user.yml +++ b/baselines/deprecated/previously_seen_ec2_launches_by_user.yml @@ -4,6 +4,7 @@ version: 2 date: '2025-01-16' author: David Dorsey, Splunk type: Baseline +status: deprecated description: This search builds a table of previously seen ARNs that have launched a EC2 instance. search: '`cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn diff --git a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml b/baselines/deprecated/previously_seen_users_in_cloudtrail.yml index 779198e56c..f8e40480d7 100644 --- a/baselines/deprecated/previously_seen_users_in_cloudtrail.yml +++ b/baselines/deprecated/previously_seen_users_in_cloudtrail.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-04-30' author: Jason Brewer, Splunk type: Baseline +status: deprecated description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 diff --git a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml b/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml index e277b9e21f..063ad93dcc 100644 --- a/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml +++ b/baselines/deprecated/update_previously_seen_users_in_cloudtrail.yml @@ -4,6 +4,7 @@ version: 2 date: '2025-01-16' author: Jason Brewer, Splunk type: Baseline +status: deprecated description: This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. diff --git a/baselines/discover_dns_records.yml b/baselines/discover_dns_records.yml index d6e55f2da8..2faf30e568 100644 --- a/baselines/discover_dns_records.yml +++ b/baselines/discover_dns_records.yml @@ -4,6 +4,7 @@ version: 1 date: '2025-01-16' author: Jose Hernandez, Splunk type: Baseline +status: production description: The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution diff --git a/baselines/dnstwist_domain_names.yml b/baselines/dnstwist_domain_names.yml index 2fae219f27..dbfba119f7 100644 --- a/baselines/dnstwist_domain_names.yml +++ b/baselines/dnstwist_domain_names.yml @@ -4,6 +4,7 @@ version: 2 date: '2018-10-08' author: David Dorsey, Splunk type: Baseline +status: production description: This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. diff --git a/baselines/identify_systems_creating_remote_desktop_traffic.yml b/baselines/identify_systems_creating_remote_desktop_traffic.yml index 616b6beb32..f466963093 100644 --- a/baselines/identify_systems_creating_remote_desktop_traffic.yml +++ b/baselines/identify_systems_creating_remote_desktop_traffic.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-15' author: David Dorsey, Splunk type: Baseline +status: production description: This search counts the numbers of times the system has generated remote desktop traffic. search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic diff --git a/baselines/identify_systems_receiving_remote_desktop_traffic.yml b/baselines/identify_systems_receiving_remote_desktop_traffic.yml index e9f2f3148e..19fc44ca03 100644 --- a/baselines/identify_systems_receiving_remote_desktop_traffic.yml +++ b/baselines/identify_systems_receiving_remote_desktop_traffic.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-15' author: David Dorsey, Splunk type: Baseline +status: production description: This search counts the numbers of times the system has created remote desktop traffic search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic diff --git a/baselines/identify_systems_using_remote_desktop.yml b/baselines/identify_systems_using_remote_desktop.yml index 8e315c2ae3..434b290d1f 100644 --- a/baselines/identify_systems_using_remote_desktop.yml +++ b/baselines/identify_systems_using_remote_desktop.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-04-01' author: David Dorsey, Splunk type: Baseline +status: production description: This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes diff --git a/baselines/monitor_successful_backups.yml b/baselines/monitor_successful_backups.yml index c738c4698b..fe0c140a5a 100644 --- a/baselines/monitor_successful_backups.yml +++ b/baselines/monitor_successful_backups.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-12' author: David Dorsey, Splunk type: Baseline +status: production description: This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. diff --git a/baselines/monitor_unsuccessful_backups.yml b/baselines/monitor_unsuccessful_backups.yml index 8834fe6fa1..83195cbae0 100644 --- a/baselines/monitor_unsuccessful_backups.yml +++ b/baselines/monitor_unsuccessful_backups.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-12' author: David Dorsey, Splunk type: Baseline +status: production description: This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. diff --git a/baselines/previously_seen_aws_cross_account_activity.yml b/baselines/previously_seen_aws_cross_account_activity.yml index 47e3777161..ed2cad1585 100644 --- a/baselines/previously_seen_aws_cross_account_activity.yml +++ b/baselines/previously_seen_aws_cross_account_activity.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-04' author: David Dorsey, Splunk type: Baseline +status: production description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. diff --git a/baselines/previously_seen_aws_cross_account_activity___initial.yml b/baselines/previously_seen_aws_cross_account_activity___initial.yml index 532f7d9cb3..6fad8d0f18 100644 --- a/baselines/previously_seen_aws_cross_account_activity___initial.yml +++ b/baselines/previously_seen_aws_cross_account_activity___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline +status: production description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. diff --git a/baselines/previously_seen_aws_cross_account_activity___update.yml b/baselines/previously_seen_aws_cross_account_activity___update.yml index 526e8761f8..9cb9c956b9 100644 --- a/baselines/previously_seen_aws_cross_account_activity___update.yml +++ b/baselines/previously_seen_aws_cross_account_activity___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline +status: production description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. diff --git a/baselines/previously_seen_aws_regions.yml b/baselines/previously_seen_aws_regions.yml index 5f086d0138..da7bd98582 100644 --- a/baselines/previously_seen_aws_regions.yml +++ b/baselines/previously_seen_aws_regions.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-01-08' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last diff --git a/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml b/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml index 66917eb309..76a9d53576 100644 --- a/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml +++ b/baselines/previously_seen_cloud_api_calls_per_user_role___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-03' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. diff --git a/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml b/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml index e49adc7a96..dadd790f96 100644 --- a/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml +++ b/baselines/previously_seen_cloud_api_calls_per_user_role___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-03' author: David Dorsey, Splunk type: Baseline +status: production description: This search updates the table of the first and last times seen for every user role and command combination. search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml b/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml index 865f24389d..ed6a275c00 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml +++ b/baselines/previously_seen_cloud_compute_creations_by_user___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline +status: production description: This search builds a table of previously seen users that have launched a cloud compute instance. search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_creations_by_user___update.yml b/baselines/previously_seen_cloud_compute_creations_by_user___update.yml index ca1fe683b6..29d5b5952f 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user___update.yml +++ b/baselines/previously_seen_cloud_compute_creations_by_user___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-15' author: Rico Valdez, Splunk type: Baseline +status: production description: This search builds a table of previously seen users that have launched a cloud compute instance. search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_images___initial.yml b/baselines/previously_seen_cloud_compute_images___initial.yml index eb3b830b1a..963cdf7af0 100644 --- a/baselines/previously_seen_cloud_compute_images___initial.yml +++ b/baselines/previously_seen_cloud_compute_images___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-10-08' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of previously seen images used to launch cloud compute instances search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_images___update.yml b/baselines/previously_seen_cloud_compute_images___update.yml index 63773389da..580b2ad13c 100644 --- a/baselines/previously_seen_cloud_compute_images___update.yml +++ b/baselines/previously_seen_cloud_compute_images___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-12' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of previously seen images used to launch cloud compute instances search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_instance_types___initial.yml b/baselines/previously_seen_cloud_compute_instance_types___initial.yml index 60e2a0386a..1f325d98c9 100644 --- a/baselines/previously_seen_cloud_compute_instance_types___initial.yml +++ b/baselines/previously_seen_cloud_compute_instance_types___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-03' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of previously seen cloud compute instance types search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_compute_instance_types___update.yml b/baselines/previously_seen_cloud_compute_instance_types___update.yml index cf50524d02..4c426ae70e 100644 --- a/baselines/previously_seen_cloud_compute_instance_types___update.yml +++ b/baselines/previously_seen_cloud_compute_instance_types___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-03' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of previously seen cloud compute instance types search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml b/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml index dc993e3fb5..4685a5d45e 100644 --- a/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml +++ b/baselines/previously_seen_cloud_instance_modifications_by_user___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-07-29' author: Rico Valdez, Splunk type: Baseline +status: production description: This search builds a table of previously seen users that have modified a cloud instance. search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml b/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml index b89c7d40bf..68d81025a8 100644 --- a/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml +++ b/baselines/previously_seen_cloud_instance_modifications_by_user___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-07-29' author: Rico Valdez, Splunk type: Baseline +status: production description: This search updates a table of previously seen Cloud Instance modifications that have been made by a user search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen diff --git a/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml b/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml index e5a85d2ea8..0296b5697c 100644 --- a/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml +++ b/baselines/previously_seen_cloud_provisioning_activity_sources___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-19' author: Rico Valdez, Splunk type: Baseline +status: production description: This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This diff --git a/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml b/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml index b7b4696662..6997f09948 100644 --- a/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml +++ b/baselines/previously_seen_cloud_provisioning_activity_sources___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-08-20' author: David Dorsey, Splunk type: Baseline +status: production description: This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs diff --git a/baselines/previously_seen_cloud_regions___initial.yml b/baselines/previously_seen_cloud_regions___initial.yml index 2af26937ff..68a9aaac84 100644 --- a/baselines/previously_seen_cloud_regions___initial.yml +++ b/baselines/previously_seen_cloud_regions___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-02' author: David Dorsey, Splunk type: Baseline +status: production description: This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the diff --git a/baselines/previously_seen_cloud_regions___update.yml b/baselines/previously_seen_cloud_regions___update.yml index 6bd55881bb..fe6e4e31a4 100644 --- a/baselines/previously_seen_cloud_regions___update.yml +++ b/baselines/previously_seen_cloud_regions___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-09-02' author: David Dorsey, Splunk type: Baseline +status: production description: This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the diff --git a/baselines/previously_seen_command_line_arguments.yml b/baselines/previously_seen_command_line_arguments.yml index 223e790d2b..f797569828 100644 --- a/baselines/previously_seen_command_line_arguments.yml +++ b/baselines/previously_seen_command_line_arguments.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-03-01' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. diff --git a/baselines/previously_seen_ec2_modifications_by_user.yml b/baselines/previously_seen_ec2_modifications_by_user.yml index 8c1d9a7dd8..fdf51c1460 100644 --- a/baselines/previously_seen_ec2_modifications_by_user.yml +++ b/baselines/previously_seen_ec2_modifications_by_user.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-04-05' author: David Dorsey, Splunk type: Baseline +status: production description: This search builds a table of previously seen ARNs that have launched a EC2 instance. search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn diff --git a/baselines/previously_seen_running_windows_services___initial.yml b/baselines/previously_seen_running_windows_services___initial.yml index 3bd5dd8724..429efbceae 100644 --- a/baselines/previously_seen_running_windows_services___initial.yml +++ b/baselines/previously_seen_running_windows_services___initial.yml @@ -4,6 +4,7 @@ version: 3 date: '2020-06-23' author: David Dorsey, Splunk type: Baseline +status: production description: This collects the services that have been started across your entire enterprise. search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) diff --git a/baselines/previously_seen_running_windows_services___update.yml b/baselines/previously_seen_running_windows_services___update.yml index cb43f77348..e5ef21ba42 100644 --- a/baselines/previously_seen_running_windows_services___update.yml +++ b/baselines/previously_seen_running_windows_services___update.yml @@ -4,6 +4,7 @@ version: 3 date: '2020-06-23' author: David Dorsey, Splunk type: Baseline +status: production description: This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within diff --git a/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml b/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml index 35b04b57b8..ed80570f70 100644 --- a/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml +++ b/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-28' author: Bhavin Patel, Splunk type: Baseline +status: production description: This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking diff --git a/baselines/previously_seen_users_in_cloudtrail___initial.yml b/baselines/previously_seen_users_in_cloudtrail___initial.yml index c4993b029c..39b4d4f14c 100644 --- a/baselines/previously_seen_users_in_cloudtrail___initial.yml +++ b/baselines/previously_seen_users_in_cloudtrail___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-05-28' author: Rico Valdez, Splunk type: Baseline +status: production description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last diff --git a/baselines/previously_seen_users_in_cloudtrail___update.yml b/baselines/previously_seen_users_in_cloudtrail___update.yml index b2e2ffe0f8..06983af330 100644 --- a/baselines/previously_seen_users_in_cloudtrail___update.yml +++ b/baselines/previously_seen_users_in_cloudtrail___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-05-28' author: Rico Valdez, Splunk type: Baseline +status: production description: This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. diff --git a/baselines/previously_seen_zoom_child_processes___initial.yml b/baselines/previously_seen_zoom_child_processes___initial.yml index a5ea66b367..812ab81ab0 100644 --- a/baselines/previously_seen_zoom_child_processes___initial.yml +++ b/baselines/previously_seen_zoom_child_processes___initial.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-05-20' author: David Dorsey, Splunk type: Baseline +status: production description: This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. diff --git a/baselines/previously_seen_zoom_child_processes___update.yml b/baselines/previously_seen_zoom_child_processes___update.yml index 69a8b515ae..350131e49a 100644 --- a/baselines/previously_seen_zoom_child_processes___update.yml +++ b/baselines/previously_seen_zoom_child_processes___update.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-05-20' author: David Dorsey, Splunk type: Baseline +status: production description: This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name diff --git a/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml b/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml index 5326bc7c88..7b26e9e44d 100644 --- a/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml +++ b/baselines/systems_ready_for_spectre_meltdown_windows_patch.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-01-08' author: David Dorsey, Splunk type: Baseline +status: production description: Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this diff --git a/baselines/windows_updates_install_failures.yml b/baselines/windows_updates_install_failures.yml index 9eab1ba798..d9bd881691 100644 --- a/baselines/windows_updates_install_failures.yml +++ b/baselines/windows_updates_install_failures.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-14' author: David Dorsey, Splunk type: Baseline +status: production description: This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. diff --git a/baselines/windows_updates_install_successes.yml b/baselines/windows_updates_install_successes.yml index 9f460357c8..cac97fe4e8 100644 --- a/baselines/windows_updates_install_successes.yml +++ b/baselines/windows_updates_install_successes.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-14' author: David Dorsey, Splunk type: Baseline +status: production description: This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. diff --git a/stories/3cx_supply_chain_attack.yml b/stories/3cx_supply_chain_attack.yml index ad37e5a890..6829373141 100644 --- a/stories/3cx_supply_chain_attack.yml +++ b/stories/3cx_supply_chain_attack.yml @@ -3,6 +3,7 @@ id: c4d7618c-73a7-4f7c-8071-060c36850785 version: 1 date: '2023-03-30' author: Michael Haag, Splunk +status: production description: 'On March 29, 2023, CrowdStrike Falcon OverWatch observed unexpected malicious activity emanating from a legitimate, signed binary, 3CXDesktopApp, a softphone application from 3CX. The malicious activity includes beaconing to actor controlled infrastructure, deployment of second stage payloads, and, in a small number of cases, hands on keyboard activity. (CrowdStrike)' narrative: 'On March 22, 2023, cybersecurity firm SentinelOne observed a surge in behavioral detections of trojanized 3CXDesktopApp installers, a popular PABX voice and video conferencing software. The multi-stage attack chain, which automatically quarantines trojanized installers, involves downloading ICO files with base64 data from GitHub and eventually leads to a 3rd stage infostealer DLL that is still under analysis. While the Mac installer remains unconfirmed as trojanized, ongoing investigations are also examining other potentially compromised applications, such as Chrome extensions. The threat actor behind the supply chain compromise, which started in February 2022, has used a code signing certificate to sign the trojanized binaries, but connections to existing threat clusters remain unclear. SentinelOne updated their IOCs on March 30th, 2023, with contributions from the research community and continues to monitor the situation for further developments. 3CX identified the vulnerability in the recent versions 18.12.407 and 18.12.416 for the desktop app. A new certificate for the app will also be produced.' references: diff --git a/stories/abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml b/stories/abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml index 36115ecb93..47f4cfcb1d 100644 --- a/stories/abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml +++ b/stories/abnormal_kubernetes_behavior_using_splunk_infrastructure_monitoring.yml @@ -3,6 +3,7 @@ id: 7589023b-3d98-42b3-ab1c-bb498e68fc2d version: 1 date: '2024-01-08' author: 'Matthew Moore, Patrick Bareiss, Splunk' +status: production description: Kubernetes, a complex container orchestration system, is susceptible to a variety of security threats. This story delves into the different strategies and methods adversaries employ to exploit Kubernetes environments. These include attacks on the control plane, exploitation of misconfigurations, and breaches of containerized applications. diff --git a/stories/acidpour.yml b/stories/acidpour.yml index 20b851e1fc..e93759b339 100644 --- a/stories/acidpour.yml +++ b/stories/acidpour.yml @@ -3,6 +3,7 @@ id: 5992d9b3-f83c-48e8-8164-6cf8f19cfb42 version: 1 date: '2024-04-01' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to AcidPour Wiper malware. AcidPour is a destructive variant designed to irreversibly delete data from targeted systems, rendering them inoperable. Unlike ransomware, AcidPour focuses on data destruction, targeting critical storage sectors and overwriting files to make recovery impossible. diff --git a/stories/acidrain.yml b/stories/acidrain.yml index c63f91d3ff..f2cfd73737 100644 --- a/stories/acidrain.yml +++ b/stories/acidrain.yml @@ -3,6 +3,7 @@ id: c68717c6-4938-434b-987c-e1ce9d516124 version: 1 date: '2022-04-12' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the acidrain malware including deleting of files and etc. AcidRain is an ELF MIPS malware specifically designed to wipe modems and routers. diff --git a/stories/active_directory_discovery.yml b/stories/active_directory_discovery.yml index 23067fde96..85afaed8cb 100644 --- a/stories/active_directory_discovery.yml +++ b/stories/active_directory_discovery.yml @@ -3,6 +3,7 @@ id: 8460679c-2b21-463e-b381-b813417c32f2 version: 1 date: '2021-08-20' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Discovery and Reconnaissance within with Active Directory environments. narrative: 'Discovery consists of techniques an adversay uses to gain knowledge about diff --git a/stories/active_directory_kerberos_attacks.yml b/stories/active_directory_kerberos_attacks.yml index ed03bd160f..224548cb64 100644 --- a/stories/active_directory_kerberos_attacks.yml +++ b/stories/active_directory_kerberos_attacks.yml @@ -3,6 +3,7 @@ id: 38b8cf16-8461-11ec-ade1-acde48001122 version: 1 date: '2022-02-02' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Kerberos based attacks within with Active Directory environments. narrative: Kerberos, initially named after Cerberus, the three-headed dog in Greek mythology, is a network authentication protocol that allows computers and users to prove their identity through a trusted third-party. This trusted third-party issues Kerberos tickets using symmetric encryption to allow users access diff --git a/stories/active_directory_lateral_movement.yml b/stories/active_directory_lateral_movement.yml index 9c31419c16..9b7139c117 100644 --- a/stories/active_directory_lateral_movement.yml +++ b/stories/active_directory_lateral_movement.yml @@ -3,6 +3,7 @@ id: 399d65dc-1f08-499b-a259-aad9051f38ad version: 3 date: '2021-12-09' author: David Dorsey, Mauricio Velazco Splunk +status: production description: Detect and investigate tactics, techniques, and procedures around how attackers move laterally within an Active Directory environment. Since lateral movement is often a necessary step in a breach, it is important for cyber defenders to deploy diff --git a/stories/active_directory_password_spraying.yml b/stories/active_directory_password_spraying.yml index 673f255263..a2c49e1736 100644 --- a/stories/active_directory_password_spraying.yml +++ b/stories/active_directory_password_spraying.yml @@ -3,6 +3,7 @@ id: 3de109da-97d2-11eb-8b6a-acde48001122 version: 2 date: '2021-04-07' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments. narrative: 'In a password spraying attack, adversaries leverage one or a small list diff --git a/stories/active_directory_privilege_escalation.yml b/stories/active_directory_privilege_escalation.yml index dc396f9dfb..4b7671cb52 100644 --- a/stories/active_directory_privilege_escalation.yml +++ b/stories/active_directory_privilege_escalation.yml @@ -3,6 +3,7 @@ id: fa34a5d8-df0a-404c-8237-11f99cba1d5f version: 1 date: '2023-03-20' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Privilege Escalation attacks within Active Directory environments. narrative: Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. diff --git a/stories/adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml b/stories/adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml index e38731c89a..c359973e9b 100644 --- a/stories/adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml +++ b/stories/adobe_coldfusion_arbitrary_code_execution_cve_2023_29298_cve_2023_26360.yml @@ -3,6 +3,7 @@ id: e33e2e38-f9c2-432d-8be6-bc67b92aa82e version: 1 date: '2023-08-23' author: Michael Haag, Splunk +status: production description: In July 2023, a significant vulnerability, CVE-2023-29298, affecting Adobe ColdFusion was uncovered by Rapid7, shedding light on an access control bypass mechanism. This vulnerability allows attackers to access sensitive ColdFusion Administrator endpoints by exploiting a flaw in the URL path validation. Disturbingly, this flaw can be chained with another critical vulnerability, CVE-2023-26360, which has been actively exploited. The latter enables unauthorized arbitrary code execution and file reading. Adobe has promptly addressed these vulnerabilities, but the intricacies and potential ramifications of their combination underscore the importance of immediate action by organizations. With active exploitation in the wild and the ability to bypass established security measures, the situation is alarming. Organizations are urged to apply the updates provided by Adobe immediately, considering the active threat landscape and the severe implications of these chained vulnerabilities. narrative: Adobe ColdFusion, a prominent application server, has been thrust into the cybersecurity spotlight due to two intertwined vulnerabilities. The first, CVE-2023-29298, identified by Rapid7 in July 2023, pertains to an access control bypass in ColdFusion's security mechanisms. This flaw allows attackers to access protected ColdFusion Administrator endpoints simply by manipulating the URL path, specifically by inserting an additional forward slash. Compounding the threat is the revelation that CVE-2023-29298 can be chained with CVE-2023-26360, another severe ColdFusion vulnerability. This latter vulnerability, which has seen active exploitation, permits unauthorized attackers to execute arbitrary code or read arbitrary files on the affected system. In practice, an attacker could exploit the access control bypass to access sensitive ColdFusion endpoints and subsequently exploit the arbitrary code execution vulnerability, broadening their control and access over the targeted system. diff --git a/stories/agenttesla.yml b/stories/agenttesla.yml index 6145f9da10..aff5c845de 100644 --- a/stories/agenttesla.yml +++ b/stories/agenttesla.yml @@ -3,6 +3,7 @@ id: 9bb6077a-843e-418b-b134-c57ef997103c version: 1 date: '2022-04-12' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the AgentTesla malware including .chm application child process, ftp/smtp connection, persistence and many more. AgentTesla is one of the advanced remote access trojans (RAT) that are capable of stealing sensitive information from the infected or targeted host machine. diff --git a/stories/amadey.yml b/stories/amadey.yml index 91f19a726e..8bcbf47ade 100644 --- a/stories/amadey.yml +++ b/stories/amadey.yml @@ -3,6 +3,7 @@ id: a919a01b-3ea5-4ed4-9cbe-11cd8b64c36c version: 1 date: '2023-06-16' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains searches that aims to detect activities related to Amadey, a type of malware that primarily operates as a banking Trojan. It is designed to steal sensitive information such as login credentials, credit card details, and other financial data from infected systems. The malware typically targets Windows-based computers. narrative: Amadey is one of the active trojans that are capable of stealing sensitive information via its from the infected or targeted host machine. It can collect various types of data, including browser profile information, clipboard data, capture screenshots and system information. Adversaries or threat actors may use this malware to maximize the impact of infection on the target organization in operations where data collection and exfiltration is the goal. The primary function is to steal information and further distribute malware. It aims to extract a variety of information from infected devices and attempts to evade the detection of security measures by reducing the volume of data exfiltration compared to that seen in other malicious instances. references: diff --git a/stories/apache_struts_vulnerability.yml b/stories/apache_struts_vulnerability.yml index 083cca22b5..46fb9a302b 100644 --- a/stories/apache_struts_vulnerability.yml +++ b/stories/apache_struts_vulnerability.yml @@ -3,6 +3,7 @@ id: 2dcfd6a2-e7d2-4873-b6ba-adaf819d2a1e version: 1 date: '2018-12-06' author: Rico Valdez, Splunk +status: production description: Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. diff --git a/stories/apt29_diplomatic_deceptions_with_wineloader.yml b/stories/apt29_diplomatic_deceptions_with_wineloader.yml index 43f164b3aa..28acf92824 100644 --- a/stories/apt29_diplomatic_deceptions_with_wineloader.yml +++ b/stories/apt29_diplomatic_deceptions_with_wineloader.yml @@ -3,6 +3,7 @@ id: 7cb5fdb5-4c36-4721-8b0a-4cc5e78afadd version: 1 date: '2024-03-26' author: Michael Haag, splunk +status: production description: APT29, a sophisticated threat actor linked to the Russian SVR, has expanded its cyber espionage activities to target European diplomats and German political parties. Utilizing a novel backdoor variant, WINELOADER, these campaigns leverage diplomatic-themed lures to initiate infection chains, demonstrating APT29's evolving tactics and interest in geopolitical intelligence. The operations, marked by their low volume and high precision, underscore the broad threat APT29 poses to Western political and diplomatic entities. narrative: APT29, also known as Cozy Bear, has historically focused on espionage activities aligned with Russian intelligence interests. In recent campaigns, APT29 has notably shifted its operational focus, targeting not only its traditional diplomatic missions but also expanding into the political domain, specifically German political parties. These campaigns have been characterized by the deployment of WINELOADER, a sophisticated backdoor that facilitates the exfiltration of sensitive information. The use of themed lures, such as invitations from the Ambassador of India and CDU-themed documents, highlights APT29's strategic use of social engineering to compromise targets. The operations against European diplomats and German political entities reveal APT29's adaptive tactics and its persistent effort to gather intelligence that could influence Russia's geopolitical strategy. The precision of these attacks, coupled with the use of compromised websites for command and control, underscores the evolving threat landscape and the need for heightened cybersecurity vigilance among potential targets. references: diff --git a/stories/asset_tracking.yml b/stories/asset_tracking.yml index cd2afdb44d..1c343caf6e 100644 --- a/stories/asset_tracking.yml +++ b/stories/asset_tracking.yml @@ -3,6 +3,7 @@ id: 91c676cf-0b23-438d-abee-f6335e1fce77 version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk +status: production description: Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. diff --git a/stories/asyncrat.yml b/stories/asyncrat.yml index fbac0d1313..0b3b0efd4b 100644 --- a/stories/asyncrat.yml +++ b/stories/asyncrat.yml @@ -3,6 +3,7 @@ id: d7053072-7dd2-4874-8314-bfcbc99978a4 version: 1 date: '2023-01-24' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the AsyncRAT malware including mshta application child process, bat loader execution, persistence and many more. AsyncRAT is an open source remote administration tool released last 2019. It's designed to remotely control computers via an encrypted diff --git a/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml b/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml index e73cbfbb06..8f99a94428 100644 --- a/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml +++ b/stories/atlassian_confluence_server_and_data_center_cve_2022_26134.yml @@ -3,6 +3,7 @@ id: 91623a50-41fa-4c4e-8637-c239b80ff439 version: 1 date: '2022-06-03' author: Michael Haag, Splunk +status: production description: On June 2, security researchers at Volexity published a blog outlining the discovery of an unauthenticated remote code execution zero day vulnerability (CVE-2022-26134) being actively exploited in Atlassian Confluence Server and Data Center instances in the wild. Atlassian released a fix within 24 hours of the blog''s release. narrative: Atlassian describes the vulnerability as an Object-Graph Navigation Language (OGNL) injection allowing an unauthenticated user to execute arbitrary code on a Confluence Server or Data Server instance. Volexity did not release proof-of-concept (POC) exploit code, but researchers there have observed coordinated, widespread exploitation. Volexity first discovered the vulnerability over the weekend on two Internet-facing web servers running Confluence Server software. The investigation was due to suspicious activity on the hosts, including JSP webshells that were written to disk. diff --git a/stories/awfulshred.yml b/stories/awfulshred.yml index e9f962a6c9..697fa00da4 100644 --- a/stories/awfulshred.yml +++ b/stories/awfulshred.yml @@ -3,6 +3,7 @@ id: e36935ce-f48c-4fb2-8109-7e80c1cdc9e2 version: 1 date: '2023-01-24' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the AwfulShred malware including wiping files, process kill, system reboot via system request, shred, and service stops. narrative: AwfulShred is a malicious linux shell script designed to corrupt or wipe the linux targeted system. diff --git a/stories/aws_cross_account_activity.yml b/stories/aws_cross_account_activity.yml index 1f8e8e899c..0198363273 100644 --- a/stories/aws_cross_account_activity.yml +++ b/stories/aws_cross_account_activity.yml @@ -3,6 +3,7 @@ id: 2f2f610a-d64d-48c2-b57c-967a2b49ab5a version: 1 date: '2018-06-04' author: David Dorsey, Splunk +status: production description: Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. diff --git a/stories/aws_defense_evasion.yml b/stories/aws_defense_evasion.yml index fdf8802ed2..0bb3ca6bb9 100644 --- a/stories/aws_defense_evasion.yml +++ b/stories/aws_defense_evasion.yml @@ -3,6 +3,7 @@ id: 4e00b690-293f-434d-a9d8-bcfb2ea5fff9 version: 1 date: '2022-07-15' author: Gowthamaraj Rajendran, Splunk +status: production description: Identify activity and techniques associated with the Evasion of Defenses within AWS, such as Disabling CloudTrail, Deleting CloudTrail and many others. narrative: Adversaries employ a variety of techniques in order to avoid detection and operate diff --git a/stories/aws_iam_privilege_escalation.yml b/stories/aws_iam_privilege_escalation.yml index 6d08eaa713..cd93765bff 100644 --- a/stories/aws_iam_privilege_escalation.yml +++ b/stories/aws_iam_privilege_escalation.yml @@ -3,6 +3,7 @@ id: ced74200-8465-4bc3-bd2c-22782eec6750 version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk +status: production description: This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation. narrative: 'Amazon Web Services provides a neat feature called Identity and Access diff --git a/stories/aws_identity_and_access_management_account_takeover.yml b/stories/aws_identity_and_access_management_account_takeover.yml index 350970df73..83d01652aa 100644 --- a/stories/aws_identity_and_access_management_account_takeover.yml +++ b/stories/aws_identity_and_access_management_account_takeover.yml @@ -3,6 +3,7 @@ id: 4210b690-293f-411d-a9d8-bcfb2ea5fff9 version: 2 date: '2022-08-19' author: Gowthamaraj Rajendran, Bhavin Patel, Splunk +status: production description: Identify activity and techniques associated with accessing credential files from AWS resources, monitor unusual authentication related activities to the AWS Console and other services such as RDS. narrative: Amazon Web Services provides a web service known as Identity and Access Management(IAM) for controlling and securly managing various AWS resources. This is basically the foundation of how users in AWS interact with various resources/services in cloud and vice versa. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. Adversaries employ a variety of techniques to steal AWS Cloud credentials like account names, passwords and keys and takeover legitmate user accounts. Usage of legitimate keys will assist the attackers to gain access to other sensitive system and they can also mimic legitimate behaviour making them harder to be detected. Such activity may involve multiple failed login to the console, new console logins and password reset activities. diff --git a/stories/aws_network_acl_activity.yml b/stories/aws_network_acl_activity.yml index 7def55a8b2..9f4e6c038e 100644 --- a/stories/aws_network_acl_activity.yml +++ b/stories/aws_network_acl_activity.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50ff268af4 version: 2 date: '2018-05-21' author: Bhavin Patel, Splunk +status: production description: Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative: AWS CloudTrail is an AWS service that helps you enable governance, compliance, diff --git a/stories/aws_security_hub_alerts.yml b/stories/aws_security_hub_alerts.yml index c0745fdcef..6b5b2f5799 100644 --- a/stories/aws_security_hub_alerts.yml +++ b/stories/aws_security_hub_alerts.yml @@ -3,6 +3,7 @@ id: 2f2f610a-d64d-48c2-b57c-96722b49ab5a version: 1 date: '2020-08-04' author: Bhavin Patel, Splunk +status: production description: This story is focused around detecting Security Hub alerts generated from AWS narrative: AWS Security Hub collects and consolidates findings from AWS security services diff --git a/stories/aws_user_monitoring.yml b/stories/aws_user_monitoring.yml index a4b80bd9a9..111d64b824 100644 --- a/stories/aws_user_monitoring.yml +++ b/stories/aws_user_monitoring.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50f1269af3 version: 1 date: '2018-03-12' author: Bhavin Patel, Splunk +status: production description: Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. diff --git a/stories/azorult.yml b/stories/azorult.yml index 6f6c5e5315..13dc30714f 100644 --- a/stories/azorult.yml +++ b/stories/azorult.yml @@ -3,6 +3,7 @@ id: efed5343-4ac2-42b1-a16d-da2428d0ce94 version: 1 date: '2022-06-09' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Azorult malware including firewall modification, icacl execution, spawning more process, botnet c2 communication, defense evasion and etc. The AZORULT malware was first discovered in 2016 to be an information stealer that steals browsing history, cookies, ID/passwords, cryptocurrency information and more. diff --git a/stories/azure_active_directory_account_takeover.yml b/stories/azure_active_directory_account_takeover.yml index 709898c01e..9a145d303e 100644 --- a/stories/azure_active_directory_account_takeover.yml +++ b/stories/azure_active_directory_account_takeover.yml @@ -3,6 +3,7 @@ id: 41514c46-7118-4eab-a9bb-f3bfa4e3bea9 version: 2 date: '2022-07-14' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Account Takeover attacks against Azure Active Directory tenants. narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure services like Office 365. It can sync with on-premise Active Directory environments and provide authentication to other cloud-based systems via the OAuth protocol. According to Microsoft, Azure AD manages more than 1.2 billion identities and processes over 8 billion authentications per day. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential compromise of Azure Active Directory accounts.' diff --git a/stories/azure_active_directory_persistence.yml b/stories/azure_active_directory_persistence.yml index 6f6bc34c18..101da0107f 100644 --- a/stories/azure_active_directory_persistence.yml +++ b/stories/azure_active_directory_persistence.yml @@ -3,6 +3,7 @@ id: dca983db-6334-4a0d-be32-80611ca1396c version: 2 date: '2024-09-24' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with the execution of Persistence techniques against Azure Active Directory tenants. narrative: 'Azure Active Directory (Azure AD) is Microsofts enterprise cloud-based identity and access management (IAM) service. Azure AD is the backbone of most of Azure diff --git a/stories/azure_active_directory_privilege_escalation.yml b/stories/azure_active_directory_privilege_escalation.yml index b379373393..ea48106a1d 100644 --- a/stories/azure_active_directory_privilege_escalation.yml +++ b/stories/azure_active_directory_privilege_escalation.yml @@ -3,6 +3,7 @@ id: ec78e872-b79c-417d-b256-8fde902522fb version: 1 date: '2023-04-24' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Privilege Escalation attacks within Azure Active Directory tenants. narrative: Privilege Escalation consists of techniques that adversaries use to gain higher-level permissions on a system or network. diff --git a/stories/baron_samedit_cve_2021_3156.yml b/stories/baron_samedit_cve_2021_3156.yml index 2253b438a9..3030bc82b8 100644 --- a/stories/baron_samedit_cve_2021_3156.yml +++ b/stories/baron_samedit_cve_2021_3156.yml @@ -3,6 +3,7 @@ id: 817b0dfc-23ba-4bcc-96cc-2cb77e428fbe version: 1 date: '2021-01-27' author: Shannon Davis, Splunk +status: production description: Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and diff --git a/stories/bishopfox_sliver_adversary_emulation_framework.yml b/stories/bishopfox_sliver_adversary_emulation_framework.yml index 555690d779..80229fc439 100644 --- a/stories/bishopfox_sliver_adversary_emulation_framework.yml +++ b/stories/bishopfox_sliver_adversary_emulation_framework.yml @@ -3,6 +3,7 @@ id: 8c2e2cba-3fd8-424f-a890-5080bdaf3f31 version: 1 date: '2023-01-24' author: Michael Haag, Splunk +status: production description: The following analytic story providers visibility into the latest adversary TTPs in regard to the use of Sliver. Sliver has gained more traction with adversaries as it is often seen as an alternative to Cobalt Strike. It is designed to be scalable and can be used by organizations of all sizes to perform security testing. Sliver is highly modular and contains an Extension package manager (armory) allowing easy install (automatic compilation) of various 3rd party tools such as BOFs and .NET tooling like Ghostpack (Rubeus, Seatbelt, SharpUp, Certify, and so forth) (CyberReason,2023). narrative: Sliver is an open source cross-platform adversary emulation/red team framework produced by BishopFox. references: diff --git a/stories/bits_jobs.yml b/stories/bits_jobs.yml index c37db375b3..ccd05ebe37 100644 --- a/stories/bits_jobs.yml +++ b/stories/bits_jobs.yml @@ -3,6 +3,7 @@ id: dbc7edce-8e4c-11eb-9f31-acde48001122 version: 1 date: '2021-03-26' author: Michael Haag, Splunk +status: production description: Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. narrative: Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, diff --git a/stories/blackbyte_ransomware.yml b/stories/blackbyte_ransomware.yml index d9b5bab660..f74d3ff9c9 100644 --- a/stories/blackbyte_ransomware.yml +++ b/stories/blackbyte_ransomware.yml @@ -3,6 +3,7 @@ id: b18259ac-0746-45d7-bd1f-81d65274a80b version: 1 date: '2023-07-10' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the BlackByte ransomware, including looking for file writes associated with BlackByte, persistence, initial access, account registry diff --git a/stories/blacklotus_campaign.yml b/stories/blacklotus_campaign.yml index e111004c34..c1e9c19a7a 100644 --- a/stories/blacklotus_campaign.yml +++ b/stories/blacklotus_campaign.yml @@ -3,6 +3,7 @@ id: 8eb0e418-a2b6-4327-a387-85c976662c8f version: 1 date: '2023-04-14' author: Michael Haag, Splunk +status: production description: The first in-the-wild UEFI bootkit bypassing UEFI Secure Boot on fully updated UEFI systems is now a reality narrative: "The number of UEFI vulnerabilities discovered in recent years and the failures in patching them or revoking vulnerable binaries within a reasonable time window hasn't gone unnoticed by threat actors. As a result, the first publicly known UEFI bootkit bypassing the essential platform security feature UEFI Secure Boot is now a reality. present the first public analysis of this UEFI bootkit, which is capable of running on even fully-up-to-date Windows 11 systems with UEFI Secure Boot enabled. Functionality of the bootkit and its individual features leads us to believe that we are dealing with a bootkit known as BlackLotus, the UEFI bootkit being sold on hacking forums for $5,000 since at least October 2022. (ESET, 2023) The following content aims to aid defenders in detecting suspicious bootloaders and understanding the diverse techniques employed in this campaign." diff --git a/stories/blackmatter_ransomware.yml b/stories/blackmatter_ransomware.yml index 3d24e928bb..8be2860351 100644 --- a/stories/blackmatter_ransomware.yml +++ b/stories/blackmatter_ransomware.yml @@ -3,6 +3,7 @@ id: 0da348a3-78a0-412e-ab27-2de9dd7f9fee version: 1 date: '2021-09-06' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the BlackMatter ransomware, including looking for file writes associated with BlackMatter, force safe mode boot, autadminlogon account registry diff --git a/stories/blacksuit_ransomware.yml b/stories/blacksuit_ransomware.yml index 836f605316..3f262c2c5e 100644 --- a/stories/blacksuit_ransomware.yml +++ b/stories/blacksuit_ransomware.yml @@ -3,6 +3,7 @@ id: 4c7bef12-679f-433c-92dd-d9feccc1432b version: 1 date: '2024-08-26' author: Michael Haag, Splunk +status: production description: This analytic story covers the tactics, techniques, and procedures (TTPs) associated with BlackSuit ransomware, as observed in a December 2023 intrusion. The story encompasses the full attack lifecycle, from initial access via Cobalt Strike beacons to lateral movement, credential access, and ultimately the deployment of BlackSuit ransomware. It aims to help security teams detect and respond to similar attacks by focusing on key behaviors such as Cobalt Strike activity, use of tools like ADFind and Sharphound, and the final ransomware deployment phase. narrative: In December 2023, a sophisticated intrusion culminating in the deployment of BlackSuit ransomware was observed. The attack began with the execution of a Cobalt Strike beacon, which initially communicated through CloudFlare to conceal the true C2 server. The threat actors leveraged various tools throughout the intrusion, including Sharphound, Rubeus, SystemBC, and ADFind, alongside built-in Windows utilities. diff --git a/stories/brand_monitoring.yml b/stories/brand_monitoring.yml index 221c2686c3..a6689bb9c8 100644 --- a/stories/brand_monitoring.yml +++ b/stories/brand_monitoring.yml @@ -3,6 +3,7 @@ id: 91c676cf-0b23-438d-abee-f6335e1fce78 version: 1 date: '2017-12-19' author: David Dorsey, Splunk +status: production description: Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. diff --git a/stories/braodo_stealer.yml b/stories/braodo_stealer.yml index e87f78166e..49ad3f50c9 100644 --- a/stories/braodo_stealer.yml +++ b/stories/braodo_stealer.yml @@ -3,6 +3,7 @@ id: ec5c8721-3c13-45ac-90e8-64c63a8fdc24 version: 1 date: '2024-10-24' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that may be related to the Braodo Stealer malware, a malicious software designed to steal sensitive information from infected systems. This malware typically targets login credentials, browser history, cookies, and stored passwords. Braodo Stealer often infiltrates through phishing campaigns or malicious downloads, enabling attackers to gain unauthorized access to personal and financial data. By monitoring unusual system behaviors, such as unauthorized network connections or data exfiltration, you can help prevent data breaches and mitigate the impact of this threat. narrative: Braodo Stealer is a stealthy and dangerous piece of malware specifically engineered to siphon sensitive information from compromised systems. Often spread through phishing emails or disguised as legitimate downloads, it silently infiltrates a victim’s device. Once inside, it scours through browser histories, steals login credentials, captures cookies, and even extracts saved passwords from various applications. With this stolen data, cybercriminals can gain access to banking accounts, social media profiles, or business platforms. What makes Braodo Stealer particularly threatening is its ability to remain undetected, allowing attackers to exploit compromised systems for extended periods before the user becomes aware. references: diff --git a/stories/brute_ratel_c4.yml b/stories/brute_ratel_c4.yml index 53e0e14fec..02eaee9672 100644 --- a/stories/brute_ratel_c4.yml +++ b/stories/brute_ratel_c4.yml @@ -3,6 +3,7 @@ id: 0ec9dbfe-f64e-46bb-8eb8-04e92326f513 version: 1 date: '2022-08-23' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that may be related to Brute Ratel Red Teaming tool. This includes creation, modification and deletion of services, collection or data, ping IP, DNS cache, process injection, debug privileges adjustment, winlogon process duplicate token, diff --git a/stories/caddy_wiper.yml b/stories/caddy_wiper.yml index 5606c2b246..cd9472011a 100644 --- a/stories/caddy_wiper.yml +++ b/stories/caddy_wiper.yml @@ -3,6 +3,7 @@ id: 435a156a-8ef1-4184-bd52-22328fb65d3a version: 1 date: '2022-03-25' author: Teoderick Contreras, Rod Soto, Splunk +status: production description: Caddy Wiper is a destructive payload that detects if its running on a Domain Controller and executes killswitch if detected. If not in a DC it destroys Users and subsequent mapped drives. This wiper also destroys drive partitions inculding boot partitions. narrative: Caddy Wiper is destructive malware operation found by ESET multiple organizations in Ukraine. This malicious payload destroys user files, avoids executing on Dnomain Controllers and destroys boot and drive partitions. references: diff --git a/stories/chaos_ransomware.yml b/stories/chaos_ransomware.yml index 5107153c54..651fc9d296 100644 --- a/stories/chaos_ransomware.yml +++ b/stories/chaos_ransomware.yml @@ -3,6 +3,7 @@ id: 153d7b8f-27f2-4e4d-bae8-dfafd93a22a8 version: 1 date: '2023-01-11' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Chaos ransomware, including looking for file writes (file encryption and ransomware notes), deleting shadow volume storage, registry key modification, dropping of files in startup folder, and more. diff --git a/stories/cisa_aa22_257a.yml b/stories/cisa_aa22_257a.yml index 4a73333fa0..0433f4fc47 100644 --- a/stories/cisa_aa22_257a.yml +++ b/stories/cisa_aa22_257a.yml @@ -3,6 +3,7 @@ id: e1aec96e-bc7d-4edf-8ff7-3da9b7b29147 version: 1 date: '2022-09-15' author: Michael Haag, Splunk +status: production description: The Iranian government-sponsored APT actors are actively targeting a broad range of victims across multiple U.S. critical infrastructure sectors, including the Transportation Sector and the Healthcare and Public Health Sector, as well as Australian organizations. narrative: This advisory updates joint CSA Iranian Government-Sponsored APT Cyber Actors Exploiting Microsoft Exchange and Fortinet Vulnerabilities in Furtherance of Malicious Activities, which provides information on these Iranian government-sponsored APT actors exploiting known Fortinet and Microsoft Exchange vulnerabilities to gain initial access to a broad range of targeted entities in furtherance of malicious activities, including ransom operations. The authoring agencies now judge these actors are an APT group affiliated with the IRGC. Since the initial reporting of this activity in the FBI Liaison Alert System (FLASH) report APT Actors Exploiting Fortinet Vulnerabilities to Gain Access for Malicious Activity from May 2021, the authoring agencies have continued to observe these IRGC-affiliated actors exploiting known vulnerabilities for initial access. In addition to exploiting Fortinet and Microsoft Exchange vulnerabilities, the authoring agencies have observed these APT actors exploiting VMware Horizon Log4j vulnerabilities for initial access. The IRGC-affiliated actors have used this access for follow-on activity, including disk encryption and data extortion, to support ransom operations. diff --git a/stories/cisa_aa22_264a.yml b/stories/cisa_aa22_264a.yml index 26000c1c0b..fd98ccbb63 100644 --- a/stories/cisa_aa22_264a.yml +++ b/stories/cisa_aa22_264a.yml @@ -3,6 +3,7 @@ id: bc7056a5-c3b0-4b83-93ce-5f31739305c8 version: 1 date: '2022-09-22' author: Michael Haag, Splunk +status: production description: Iranian State Actors Conduct Cyber Operations Against the Government of Albania. narrative: The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) are releasing this joint Cybersecurity Advisory to provide information on recent cyber operations against the Government of Albania in July and September. This advisory provides a timeline of activity observed, from initial access to execution of encryption and wiper attacks. Additional information concerning files used by the actors during their exploitation of and cyber attack against the victim organization is provided in Appendices A and B. In September 2022, Iranian cyber actors launched another wave of cyber attacks against the Government of Albania, using similar TTPs and malware as the cyber attacks in July. These were likely done in retaliation for public attribution of the cyber attacks in July and severed diplomatic ties between Albania and Iran. diff --git a/stories/cisa_aa22_277a.yml b/stories/cisa_aa22_277a.yml index 8e1a97b986..a1fcb81711 100644 --- a/stories/cisa_aa22_277a.yml +++ b/stories/cisa_aa22_277a.yml @@ -3,6 +3,7 @@ id: db408f93-e915-4215-9962-5fada348bdd7 version: 1 date: '2022-10-05' author: Michael Haag, Splunk +status: production description: From November 2021 through January 2022, the Cybersecurity and Infrastructure Security Agency (CISA) responded to advanced persistent threat (APT) activity on a Defense Industrial Base (DIB) Sector organization's enterprise network. During incident response activities, multiple utilities were utilized. narrative: CISA uncovered that likely multiple APT groups compromised the organization's network, and some APT actors had long-term access to the environment. APT actors used an open-source toolkit called Impacket to gain their foothold within the environment and further compromise the network, and also used a custom data exfiltration tool, CovalentStealer, to steal the victim's sensitive data. references: diff --git a/stories/cisa_aa22_320a.yml b/stories/cisa_aa22_320a.yml index c8b9b560f2..c20685b733 100644 --- a/stories/cisa_aa22_320a.yml +++ b/stories/cisa_aa22_320a.yml @@ -3,6 +3,7 @@ id: c1fca73d-3a8d-49a6-b9c0-1d5d155f7dd4 version: 1 date: '2022-11-16' author: Michael Haag, Splunk +status: production description: CISA and the FBI have identified an APT activity where the adversary gained initial access via Log4Shell via a unpatched VMware Horizon server. From there the adversary moved laterally and continued to its objective. narrative: From mid-June through mid-July 2022, CISA conducted an incident response engagement at a Federal Civilian Executive Branch (FCEB) organization where CISA observed suspected advanced persistent threat (APT) activity. In the course of incident response activities, CISA determined that cyber threat actors exploited the Log4Shell vulnerability in an unpatched VMware Horizon server, installed XMRig crypto mining software, moved laterally to the domain controller (DC), compromised credentials, and then implanted Ngrok reverse proxies on several hosts to maintain persistence. CISA and the Federal Bureau of Investigation (FBI) assess that the FCEB network was compromised by Iranian government-sponsored APT actors. references: diff --git a/stories/cisa_aa23_347a.yml b/stories/cisa_aa23_347a.yml index b792b6a09a..f685852f97 100644 --- a/stories/cisa_aa23_347a.yml +++ b/stories/cisa_aa23_347a.yml @@ -3,6 +3,7 @@ id: 257a2f28-fcbe-4226-8d1f-957880098331 version: 3 date: '2024-12-09' author: Teoderick Contreras, Rod Soto, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might be related to the SVR cyber activity tactics and techniques. While SVR followed a similar playbook in each compromise, they also adjusted to each operating environment and not all presented steps or actions below were executed on every host. diff --git a/stories/cisa_aa24_241a.yml b/stories/cisa_aa24_241a.yml index 1a7eba2bdf..3c36288c56 100644 --- a/stories/cisa_aa24_241a.yml +++ b/stories/cisa_aa24_241a.yml @@ -3,6 +3,7 @@ id: f075adb6-76a6-4476-b24a-ce9d471a1bdc version: 2 date: '2024-10-07' author: Michael Haag, Splunk +status: production description: This story covers the tactics of Iran-based cyber actors exploiting U.S. and foreign organizations across multiple sectors, as detailed in CISA Alert AA24-241A. It focuses on their methods of gaining initial access, establishing persistence, and enabling ransomware attacks through vulnerabilities in public-facing networking devices. narrative: As of August 2024, Iran-based cyber actors continue to exploit organizations across several U.S. sectors and other countries. The FBI assesses that a significant percentage of these operations aim to obtain network access for collaboration with ransomware affiliates. The actors typically use Shodan to identify vulnerable devices, then exploit public-facing networking equipment such as Citrix Netscaler, F5 BIG-IP, and various VPNs. They deploy webshells, create local accounts, and manipulate existing ones to maintain access. Post-exploitation, they repurpose credentials, disable security software, and use remote access tools. The group collaborates with ransomware affiliates like NoEscape, Ransomhouse, and ALPHV, actively participating in network lockdowns and extortion strategies. Defenders should prioritize patching public-facing devices, monitoring for unauthorized accounts and suspicious PowerShell activity, implementing strong access controls, and regularly reviewing logs for signs of compromise. references: diff --git a/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml index 2590025e80..a2aa3217ce 100644 --- a/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml +++ b/stories/cisco_ios_xe_software_web_management_user_interface_vulnerability.yml @@ -3,6 +3,7 @@ id: b5394b6a-b774-4bb6-a2bc-98f98cf7be88 version: 1 date: '2023-10-17' author: Michael Haag, Splunk +status: production description: Cisco has identified active exploitation of a previously unknown vulnerability in the Web User Interface (Web UI) feature of Cisco IOS XE software (CVE-2023-20198) when exposed to the internet or untrusted networks. Successful exploitation of this vulnerability allows an attacker to create an account on the affected device with privilege level 15 access, effectively granting them full control of the compromised device and allowing possible subsequent unauthorized activity. narrative: Cisco discovered early evidence of potentially malicious activity on September 28, 2023, when a case was opened with Cisco's Technical Assistance Center (TAC) that identified unusual behavior on a customer device. Upon further investigation, they observed what they have determined to be related activity as early as September 18. The activity included an authorized user creating a local user account under the username cisco_tac_admin from a suspicious IP address. On October 12, Cisco Talos Incident Response (Talos IR) and TAC detected what they later determined to be an additional cluster of related activity that began on that same day. In this cluster, an unauthorized user was observed creating a local user account under the name cisco_support from a second suspicious IP address. Unlike the September case, this October activity included several subsequent actions, including the deployment of an implant consisting of a configuration file (cisco_service.conf). The configuration file defines the new web server endpoint (URI path) used to interact with the implant. That endpoint receives certain parameters, described in more detail below, that allows the actor to execute arbitrary commands at the system level or IOS level. For the implant to become active, the web server must be restarted; in at least one observed case the server was not restarted so the implant never became active despite being installed. references: diff --git a/stories/citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml b/stories/citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml index 1f8b980b90..54310ad57b 100644 --- a/stories/citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml +++ b/stories/citrix_netscaler_adc_and_netscaler_gateway_cve_2023_4966.yml @@ -3,6 +3,7 @@ id: b194d644-4095-431a-bee0-a8e6ec067414 version: 1 date: '2023-10-24' author: Michael Haag, Splunk +status: production description: A critical security update, CVE-2023-4966, has been released for NetScaler ADC and NetScaler Gateway. This vulnerability, discovered by our internal team, can result in unauthorized data disclosure if exploited. Reports of incidents consistent with session hijacking have been received. The Cybersecurity and Infrastructure Security Agency (CISA) has added an entry for CVE-2023-4966 to its Known Exploited and Vulnerabilities Catalog. No workarounds are available for this vulnerability, and immediate installation of the recommended builds is strongly advised. narrative: On October 10, 2023, Cloud Software Group released builds to fix CVE-2023-4966, a vulnerability affecting NetScaler ADC and NetScaler Gateway. This vulnerability, if exploited, can lead to unauthorized data disclosure and possibly session hijacking. Although there were no known exploits at the time of disclosure, we have since received credible reports of targeted attacks exploiting this vulnerability. The Cybersecurity and Infrastructure Security Agency (CISA) has added an entry for CVE-2023-4966 to its Known Exploited and Vulnerabilities Catalog, which contains detection and mitigation guidance for observed exploitations of CVE-2023-4966 by threat actors against NetScaler ADC and NetScaler Gateway. We strongly recommend that users of affected builds immediately install the recommended builds, as this vulnerability has been identified as critical. No workarounds are available for this vulnerability. references: diff --git a/stories/citrix_netscaler_adc_cve_2023_3519.yml b/stories/citrix_netscaler_adc_cve_2023_3519.yml index 67f648a756..40bcb23015 100644 --- a/stories/citrix_netscaler_adc_cve_2023_3519.yml +++ b/stories/citrix_netscaler_adc_cve_2023_3519.yml @@ -3,6 +3,7 @@ id: 094df1fe-4345-4c01-8a0f-c65cf7b758bd version: 1 date: '2023-07-20' author: Michael Haag, Splunk +status: production description: The CVE-2023-3519 vulnerability in NetScaler (formerly Citrix) Application Delivery Controller (ADC) and NetScaler Gateway has been exploited by threat actors, as detailed in a recent advisory. The unauthenticated remote code execution vulnerability was utilized as a zero-day to establish a webshell on a non-production environment NetScaler ADC appliance within a critical infrastructure organization. This facilitated the execution of discovery on the victim's active directory and the collection and exfiltration of data. The advisory offers a comprehensive examination of the threat actors' tactics, techniques, and procedures (TTPs), alongside recommended detection methods and incident response guidelines. Immediate patch application from Citrix and the use of the detection guidance in the advisory is strongly recommended for critical infrastructure organizations to mitigate system compromises. narrative: Recent advisories have highlighted the exploitation of CVE-2023-3519, a critical vulnerability in Citrix's NetScaler Application Delivery Controller (ADC) and NetScaler Gateway. In June 2023, threat actors utilized this vulnerability to implant a webshell on a NetScaler ADC appliance within a critical infrastructure organization's non-production environment. This action granted them the ability to perform active directory discovery, data collection, and exfiltration. Notably, attempts for lateral movement to a domain controller were obstructed by network-segmentation controls. diff --git a/stories/citrix_sharefile_rce_cve_2023_24489.yml b/stories/citrix_sharefile_rce_cve_2023_24489.yml index 7ae133eb88..b6e0aace42 100644 --- a/stories/citrix_sharefile_rce_cve_2023_24489.yml +++ b/stories/citrix_sharefile_rce_cve_2023_24489.yml @@ -3,6 +3,7 @@ id: 10c7e01a-5743-4995-99df-a66f6b5db653 version: 1 date: '2023-07-26' author: Michael Haag, Splunk +status: production description: A critical vulnerability has been discovered in ShareFile's Storage Zones Controller software (CVE-2023-24489), used by numerous organizations for file sharing and storage. The vulnerability allows unauthenticated arbitrary file upload and remote code execution due to a cryptographic bug in the software's encryption but lack of authentication system. The risk comes from a failing encryption check, allowing potential cybercriminals to upload malicious files to the server. The bug was found in the Documentum Connector's .aspx files. The security risk has a potentially large impact due to the software's wide use and the sensitivity of the stored data. Citrix has released a security update to address this issue. narrative: The ShareFile Storage Zones Controller is a .NET web application running under IIS, which manages the storage of files in ShareFile's system. It was discovered that this software has a critical vulnerability (CVE-2023-24489) in the file upload functionality provided by the Documentum Connector's .aspx files. Specifically, the security flaw lies in the encryption check in the file upload process which could be bypassed, allowing for unauthenticated arbitrary file uploads and remote code execution. diff --git a/stories/cleo_file_transfer_software.yml b/stories/cleo_file_transfer_software.yml index 1a107919a1..56646f3b12 100644 --- a/stories/cleo_file_transfer_software.yml +++ b/stories/cleo_file_transfer_software.yml @@ -3,6 +3,7 @@ id: 058be65c-f007-4a3a-90f6-d2604f98a18b version: 1 date: '2024-12-11' author: Michael Haag, Splunk +status: production description: This analytic story addresses the exploitation of Cleo file transfer software products (LexiCom, VLTrader, and Harmony) through CVE-2024-50623. This vulnerability allows unauthenticated attackers to execute arbitrary system commands through the web interface, potentially leading to remote code execution and system compromise. narrative: In December 2024, threat actors began actively exploiting a critical vulnerability (CVE-2024-50623) in Cleo's file transfer software suite. The vulnerability affects multiple Cleo products including LexiCom, VLTrader, and Harmony. Attackers can exploit this flaw to execute system commands without authentication through the web interface, typically leveraging PowerShell commands for payload delivery and execution. The exploitation often involves accessing the software's autorun functionality and web interface to deploy malicious commands, potentially leading to data theft, ransomware deployment, or establishment of persistent access. Common installation paths include C:\LexiCom, C:\VLTrader, and C:\Harmony, with critical activity logged in their respective XML log files. references: diff --git a/stories/clop_ransomware.yml b/stories/clop_ransomware.yml index f743272a76..aecaa0c4b8 100644 --- a/stories/clop_ransomware.yml +++ b/stories/clop_ransomware.yml @@ -3,6 +3,7 @@ id: 5a6f6849-1a26-4fae-aa05-fa730556eeb6 version: 1 date: '2021-03-17' author: Rod Soto, Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, diff --git a/stories/cloud_cryptomining.yml b/stories/cloud_cryptomining.yml index 201f5dbeb1..bce58d3fc1 100644 --- a/stories/cloud_cryptomining.yml +++ b/stories/cloud_cryptomining.yml @@ -3,6 +3,7 @@ id: 3b96d13c-fdc7-45dd-b3ad-c132b31cdd2a version: 1 date: '2019-10-02' author: David Dorsey, Splunk +status: production description: Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users diff --git a/stories/cloud_federated_credential_abuse.yml b/stories/cloud_federated_credential_abuse.yml index 2ecc0ac7a7..46d6fd6d48 100644 --- a/stories/cloud_federated_credential_abuse.yml +++ b/stories/cloud_federated_credential_abuse.yml @@ -3,6 +3,7 @@ id: cecdc1e7-0af2-4a55-8967-b9ea62c0317d version: 1 date: '2021-01-26' author: Rod Soto, Splunk +status: production description: This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active diff --git a/stories/cobalt_strike.yml b/stories/cobalt_strike.yml index b890d5f045..41beae52bc 100644 --- a/stories/cobalt_strike.yml +++ b/stories/cobalt_strike.yml @@ -3,6 +3,7 @@ id: bcfd17e8-5461-400a-80a2-3b7d1459220c version: 1 date: '2021-02-16' author: Michael Haag, Splunk +status: production description: Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat diff --git a/stories/coldroot_macos_rat.yml b/stories/coldroot_macos_rat.yml index 22c8722f66..cbda3ac38f 100644 --- a/stories/coldroot_macos_rat.yml +++ b/stories/coldroot_macos_rat.yml @@ -3,6 +3,7 @@ id: bd91a2bc-d20b-4f44-a982-1bea98e86390 version: 1 date: '2019-01-09' author: Jose Hernandez, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, diff --git a/stories/collection_and_staging.yml b/stories/collection_and_staging.yml index 484b6aad63..309340254f 100644 --- a/stories/collection_and_staging.yml +++ b/stories/collection_and_staging.yml @@ -3,6 +3,7 @@ id: 8e03c61e-13c4-4dcd-bfbe-5ce5a8dc031a version: 2 date: '2024-09-24' author: Rico Valdez, Splunk +status: production description: 'Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating diff --git a/stories/command_and_control.yml b/stories/command_and_control.yml index 4009173f30..c599c62581 100644 --- a/stories/command_and_control.yml +++ b/stories/command_and_control.yml @@ -3,6 +3,7 @@ id: 943773c6-c4de-4f38-89a8-0b92f98804d8 version: 1 date: '2018-06-01' author: Rico Valdez, Splunk +status: production description: Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate Command And Control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions diff --git a/stories/compromised_linux_host.yml b/stories/compromised_linux_host.yml index 7e2902252e..50f6105e26 100644 --- a/stories/compromised_linux_host.yml +++ b/stories/compromised_linux_host.yml @@ -3,6 +3,7 @@ id: d7ea2fc0-3710-4257-b64f-f3c2a6abebd3 version: 1 date: '2024-06-25' author: Teoderick Contreras, Splunk +status: production description: Monitor for activities and techniques associated with Compromised Linux Host attacks. These include unauthorized access attempts, unusual network traffic patterns, and the presence of unknown or suspicious processes. Look for unexpected changes in system files, modifications to configuration files, diff --git a/stories/compromised_user_account.yml b/stories/compromised_user_account.yml index 76cb25069f..92ed1d5d65 100644 --- a/stories/compromised_user_account.yml +++ b/stories/compromised_user_account.yml @@ -3,6 +3,7 @@ id: 19669154-e9d1-4a01-b144-e6592a078092 version: 1 date: '2023-01-19' author: Mauricio Velazco, Bhavin Patel, Splunk +status: production description: Monitor for activities and techniques associated with Compromised User Account attacks. narrative: Compromised User Account occurs when cybercriminals gain unauthorized access to accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic story groups detections that can help security operations teams identify the potential signs of Compromised User Accounts. references: diff --git a/stories/compromised_windows_host.yml b/stories/compromised_windows_host.yml index a4c8902e42..c8c8989695 100644 --- a/stories/compromised_windows_host.yml +++ b/stories/compromised_windows_host.yml @@ -3,6 +3,7 @@ id: 95c15513-180b-4534-9e34-a085a26ce481 version: 1 date: '2024-04-18' author: Teoderick Contreras, Splunk +status: production description: Monitor for activities and techniques associated with Compromised Windows Host attacks. A compromised Windows host refers to a computer system running the Windows operating system that has been infiltrated or attacked by unauthorized parties. Such compromises often result in security breaches, diff --git a/stories/confluence_data_center_and_confluence_server_vulnerabilities.yml b/stories/confluence_data_center_and_confluence_server_vulnerabilities.yml index b5e9404d20..77f25b44d7 100644 --- a/stories/confluence_data_center_and_confluence_server_vulnerabilities.yml +++ b/stories/confluence_data_center_and_confluence_server_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 509387a5-ab53-4656-8bb5-4bc8c2c074d9 version: 1 date: '2024-01-22' author: Michael Haag, Splunk +status: production description: The following analytic story covers use cases for detecting and investigating potential attacks against Confluence Data Center and Confluence Server. narrative: The analytic story of Confluence Data Center and Confluence Server encompasses a comprehensive approach to safeguarding these platforms from a variety of threats. By leveraging the analytics created in the project, security teams are equipped to detect, investigate, and respond to potential attacks that target Confluence environments. references: diff --git a/stories/connectwise_screenconnect_vulnerabilities.yml b/stories/connectwise_screenconnect_vulnerabilities.yml index 624f135c0e..8fcb3d9dbb 100644 --- a/stories/connectwise_screenconnect_vulnerabilities.yml +++ b/stories/connectwise_screenconnect_vulnerabilities.yml @@ -3,6 +3,7 @@ id: fbee3185-748c-40d8-a60c-c2e2c9eb738b version: 1 date: '2024-02-21' author: Michael Haag, Splunk +status: production description: This analytic story provides a comprehensive overview of the ConnectWise ScreenConnect vulnerabilities. narrative: The following analytic story includes content for recently disclosed CWE-288 Authentication Bypass and CWE-22 Path Traversal. The vulnerabilities, identified as critical with CVSS scores of 10 and 9.8, respectively, enable unauthorized users to bypass authentication and perform path traversal attacks on affected ScreenConnect instances. The analytic story includes detection analytics for both vulnerabilities, which are crucial for identifying and responding to active exploitation in environments running affected versions of ScreenConnect (23.9.7 and prior). It is recommended to update to version 23.9.8 or above immediately to remediate the issues, as detailed in the ConnectWise security advisory and further analyzed by Huntress researchers. The analytic story also includes guidance on how to implement the detection analytics, known false positives, and references to additional resources for further analysis and remediation. references: diff --git a/stories/credential_dumping.yml b/stories/credential_dumping.yml index 729ac02a98..8778378f00 100644 --- a/stories/credential_dumping.yml +++ b/stories/credential_dumping.yml @@ -3,6 +3,7 @@ id: 854d78bf-d0e2-4f4e-b05c-640905f86d7a version: 3 date: '2020-02-04' author: Rico Valdez, Splunk +status: production description: Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and diff --git a/stories/critical_alerts.yml b/stories/critical_alerts.yml index cbb7bc2d47..ac2c88d6aa 100644 --- a/stories/critical_alerts.yml +++ b/stories/critical_alerts.yml @@ -3,6 +3,7 @@ id: bc7056a5-c2b0-4b83-93ce-5f31739305c8 version: 1 date: '2024-06-21' author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk +status: production description: This analytic story contains detections that monitor critical alerts data from security tools ingested into Splunk. By correlating these alerts and enriching them with MITRE ATT&CK annotations and other risk events, it offers a nuanced perspective on potential threats and security posture of your organization. narrative: Monitoring alerts from security tools is crucial because they act as an early warning system for potential threats. High and critical alerts signal serious issues that could compromise your systems if not addressed promptly. By keeping an eye on these alerts, you can quickly identify and respond to threats, minimizing damage and protecting sensitive data. This proactive approach not only strengthens your security posture but also ensures you're ready to tackle any compliance requirements by maintaining a detailed record of significant security events. This story has rules that integrates and assesses critical alerts from Endpoint, DLP, and firewall sources in Splunk. By correlating alerts and adding MITRE annotations, it provides a comprehensive view of customer risk. It triggers an alert when critical alerts are detected, preserving the source and assigning risk scores. This helps security analysts understand threats and respond effectively. references: diff --git a/stories/crushftp_vulnerabilities.yml b/stories/crushftp_vulnerabilities.yml index 45231703cc..a72cb1f9d8 100644 --- a/stories/crushftp_vulnerabilities.yml +++ b/stories/crushftp_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 933df821-3b75-4669-a58a-e85d2cd7b9b0 version: 1 date: '2024-05-16' author: Michael Haag, Splunk +status: production description: CVE-2024-4040 identifies a critical server-side template injection vulnerability in all versions of CrushFTP prior to 10.7.1 and 11.1.0, allowing unauthenticated remote attackers to execute arbitrary code, bypass authentication, and access files outside of the VFS Sandbox. narrative: CVE-2024-4040 exposes a severe server-side template injection vulnerability in all versions of CrushFTP prior to 10.7.1 and 11.1.0. This critical flaw allows unauthenticated remote attackers to execute arbitrary code, bypass authentication mechanisms, and access files outside of the VFS Sandbox. The vulnerability was urgently addressed by CrushFTP with a patch after it was actively exploited in the wild, highlighting the necessity for immediate updates to secure server environments. Users operating behind a DMZ are reported to have an additional layer of protection against this exploit. The discovery and subsequent reporting of this vulnerability by Simon Garrelou of Airbus CERT prompted a swift response from CrushFTP, underscoring the critical nature of the flaw and the potential risks associated with delayed patching. This incident serves as a stark reminder of the importance of maintaining up-to-date software to defend against evolving cybersecurity threats. references: diff --git a/stories/crypto_stealer.yml b/stories/crypto_stealer.yml index 4179a96824..4558db0b3e 100644 --- a/stories/crypto_stealer.yml +++ b/stories/crypto_stealer.yml @@ -3,6 +3,7 @@ id: 71efef85-aec7-46c7-bdaa-693b9d2bef4b version: 1 date: '2024-12-17' author: Teoderick Contreras, Splunk +status: production description: Crypto Stealer is a malware strain designed to exfiltrate cryptocurrency-related data from compromised systems. It scans the infected machine for wallet files, clipboard activity, and other cryptocurrency artifacts, focusing on intercepting sensitive information like private keys or transaction details. The malware communicates with a command-and-control (C2) server to transmit the harvested data and can dynamically adapt its behavior based on instructions received. Detection indicators include unusual network activity to suspicious IP addresses, unauthorized file access targeting cryptocurrency wallet directories, and anomalous clipboard usage associated with cryptocurrency strings (e.g., wallet addresses). Security solutions should monitor for these behaviors and implement heuristic analysis to identify deviations from normal system operations. Users are encouraged to maintain updated endpoint protection and avoid downloading files from untrusted sources to mitigate the risk posed by Crypto Stealer. narrative: In the ever-evolving landscape of cybercrime, Crypto Stealer emerges as a sophisticated malware targeting the lucrative world of cryptocurrency. By exploiting system vulnerabilities, the malware actively scans for wallet files, clipboard data, and other digital assets, focusing on intercepting sensitive information like private keys and transaction details. Once deployed, Crypto Stealer communicates with a command-and-control (C2) server to exfiltrate stolen data and receive updated instructions for further exploitation. Notably, it often works in tandem with other malicious components, such as XMRig, a widely abused cryptocurrency miner that hijacks system resources for illicit mining operations, and ClipBanker, which manipulates clipboard activity to replace wallet addresses in transactions with those controlled by attackers. These combined tactics maximize the attack's profitability while minimizing the victim's ability to detect the theft. Indicators of compromise include unauthorized access to cryptocurrency wallet files, suspicious clipboard behavior, and outbound connections to known malicious IP addresses. By understanding and recognizing these patterns, defenders can develop effective strategies to detect and mitigate threats like Crypto Stealer before significant damage occurs. diff --git a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml index 158f7e59c6..e9ab1a2528 100644 --- a/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml +++ b/stories/cve_2022_40684_fortinet_appliance_auth_bypass.yml @@ -3,6 +3,7 @@ id: 55721831-577e-41be-beef-bdc03c81486a version: 1 date: '2022-10-14' author: Michael Haag, Splunk +status: production description: Fortinet recently patched a critical authentication bypass vulnerability in their FortiOS, FortiProxy, and FortiSwitchManager projects CVE-2022-40684. narrative: FortiOS exposes a management web portal that allows a user configure the system. Additionally, a user can SSH into the system which exposes a locked down CLI interface. Any HTTP requests to the management interface of the system that match the conditions above should be cause for concern. An attacker can use this vulnerability to do just about anything they want to the vulnerable system. This includes changing network configurations, adding new users, and initiating packet captures. Note that this is not the only way to exploit this vulnerability and there may be other sets of conditions that work. For instance, a modified version of this exploit uses the User-Agent Node.js. This exploit seems to follow a trend among recently discovered enterprise software vulnerabilities where HTTP headers are improperly validated or overly trusted. (ref Horizon3.ai) references: diff --git a/stories/cve_2023_21716_word_rtf_heap_corruption.yml b/stories/cve_2023_21716_word_rtf_heap_corruption.yml index ba28e62bab..03398785ef 100644 --- a/stories/cve_2023_21716_word_rtf_heap_corruption.yml +++ b/stories/cve_2023_21716_word_rtf_heap_corruption.yml @@ -3,6 +3,7 @@ id: b1aeaf2c-8496-42e7-b2f7-15c328bc75d9 version: 1 date: '2023-03-10' author: Michael Haag, Splunk +status: production description: A proof-of-concept for CVE-2023-21716, a critical vulnerability in Microsoft Word that allows remote code execution utilizing a heap corruption in rich text files. narrative: This analytic story covers content that will assist organizations in identifying potential RTF RCE abuse on endpoints. The vulnerability was assigned a 9.8 out of 10 severity score, with Microsoft addressing it in the February Patch Tuesday security updates along with a couple of workarounds. diff --git a/stories/cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml b/stories/cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml index d26d93f9c5..9b6c3a8db2 100644 --- a/stories/cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml +++ b/stories/cve_2023_22515_privilege_escalation_vulnerability_confluence_data_center_and_server.yml @@ -4,6 +4,7 @@ id: ead8eb10-9e7c-4a07-a44c-c6e73997a1a3 version: 1 date: '2023-10-04' author: Michael Haag, Splunk +status: production description: On October 4, 2023, Atlassian disclosed a critical privilege escalation vulnerability, CVE-2023-22515, affecting on-premises instances of Confluence Server and Confluence Data Center. This flaw might allow external attackers to exploit accessible Confluence instances, creating unauthorized Confluence administrator accounts. Indicators suggest the vulnerability is remotely exploitable. The affected versions range from 8.0.0 to 8.5.1, but versions prior to 8.0.0 and Atlassian Cloud sites are unaffected. Atlassian advises customers to update to a fixed version or implement mitigation strategies. Indicators of compromise (IoCs) and mitigation steps, such as blocking access to /setup/* endpoints, are provided. narrative: Upon Atlassian's disclosure of CVE-2023-22515, there's an immediate need to assess the threat landscape of on-premises Confluence installations. As the vulnerability affects privilege escalation and may be exploited remotely, SIEM solutions should be poised to detect potential threats. diff --git a/stories/cve_2023_23397_outlook_elevation_of_privilege.yml b/stories/cve_2023_23397_outlook_elevation_of_privilege.yml index ff7b827a72..f6b6dd9616 100644 --- a/stories/cve_2023_23397_outlook_elevation_of_privilege.yml +++ b/stories/cve_2023_23397_outlook_elevation_of_privilege.yml @@ -3,6 +3,7 @@ id: b459911b-551f-480f-a402-18cf89ca1e9c version: 1 date: '2023-03-15' author: Michael Haag, Splunk +status: production description: Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. narrative: Microsoft Threat Intelligence discovered limited, targeted abuse of a vulnerability in Microsoft Outlook for Windows that allows for new technology LAN manager (NTLM) credential theft. Microsoft has released CVE-2023-23397 to address the critical elevation of privilege (EoP) vulnerability affecting Microsoft Outlook for Windows. We strongly recommend all customers update Microsoft Outlook for Windows to remain secure. CVE-2023-23397 is a critical EoP vulnerability in Microsoft Outlook that is triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server. No user interaction is required. diff --git a/stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml b/stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml index c8d55e764e..fb78e6bd4c 100644 --- a/stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml +++ b/stories/cve_2023_36884_office_and_windows_html_rce_vulnerability.yml @@ -3,6 +3,7 @@ id: dd7fb691-63d6-47ad-9a7f-1b9005cefad2 version: 1 date: '2023-07-11' author: Michael Haag, Splunk +status: production description: CVE-2023-36884 is an unpatched zero-day vulnerability affecting Windows and Microsoft Office products. The vulnerability allows for remote code execution through specially crafted Microsoft Office documents, enabling an attacker to operate in the context of the victim. As of now, there are no security updates available. However, users of Microsoft Defender for Office and the "Block all Office applications from creating child processes" Attack Surface Reduction Rule are safeguarded against this exploit. For other users, temporary mitigation can be achieved by adding specific application names to a designated registry key. narrative: CVE-2023-36884 is a serious security vulnerability that affects a range of Microsoft Office products and Windows systems. It is a zero-day flaw, meaning it was already being exploited before Microsoft became aware of it or had a chance to develop a patch. diff --git a/stories/cyclops_blink.yml b/stories/cyclops_blink.yml index 1572718ccf..f7a0ef5782 100644 --- a/stories/cyclops_blink.yml +++ b/stories/cyclops_blink.yml @@ -3,6 +3,7 @@ id: 7c75b1c8-dfff-46f1-8250-e58df91b6fd9 version: 2 date: '2024-03-14' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the cyclopsblink malware including firewall modification, spawning more process, botnet c2 communication, defense evasion and etc. Cyclops Blink is a Linux ELF executable compiled for 32-bit x86 and PowerPC architecture that has targeted several network devices. diff --git a/stories/darkcrystal_rat.yml b/stories/darkcrystal_rat.yml index fdb6d3bbbb..f2e12cceac 100644 --- a/stories/darkcrystal_rat.yml +++ b/stories/darkcrystal_rat.yml @@ -3,6 +3,7 @@ id: 639e6006-0885-4847-9394-ddc2902629bf version: 1 date: '2022-07-26' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the DcRat malware including ddos, spawning more process, botnet c2 communication, defense evasion and etc. The DcRat malware is known commercial backdoor that was first released in 2018. This tool was sold in underground forum and known to be one of the cheapest diff --git a/stories/darkgate_malware.yml b/stories/darkgate_malware.yml index c5c3119073..b30c1a1d2a 100644 --- a/stories/darkgate_malware.yml +++ b/stories/darkgate_malware.yml @@ -3,6 +3,7 @@ id: a4727b27-9e68-48f0-94a2-253cfb30c15d version: 1 date: '2023-10-31' author: Michael Haag, Splunk +status: production description: Telekom Security CTI has uncovered a new phishing-driven malware campaign distributing DarkGate malware. This campaign utilizes stolen email threads to trick users into downloading malicious payloads via hyperlinks. An initial false link to Emotet stirred the security community, but deeper analysis confirmed its true identity as DarkGate, with characteristics like AutoIt scripts and a known command-and-control protocol. This report by Fabian Marquardt details the intricate infection mechanisms, including MSI and VBS file deliveries, sophisticated evasion techniques, and a robust configuration extraction method surpassing current standards. The single developer behind DarkGate, active on cybercrime forums, has shifted the malware's use from private to a rent-out model, implying an expected rise in its deployment. Researchers have also developed a decryption technique for the DarkGate malware, which aids in static analysis and detection, though it requires careful validation to avoid false positives. narrative: Telekom Security CTi has recently put a spotlight on the proliferation of DarkGate malware via a sophisticated malspam campaign, initially mistaken for the notorious Emotet malware. The campaign smartly manipulates stolen email conversations, embedding hyperlinks that, once clicked, activate a malware download. Fabian Marquardt's analysis traces the infection's footprint, revealing a dual delivery mechanism through MSI and VBS files. These files, cloaked in legitimate wrappers or obscured with junk code, ultimately download the malware via embedded scripts. diff --git a/stories/darkside_ransomware.yml b/stories/darkside_ransomware.yml index 03c56d3d58..98f2265e2e 100644 --- a/stories/darkside_ransomware.yml +++ b/stories/darkside_ransomware.yml @@ -3,6 +3,7 @@ id: 507edc74-13d5-4339-878e-b9114ded1f35 version: 1 date: '2021-05-12' author: Bhavin Patel, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware narrative: This story addresses Darkside ransomware. This ransomware payload has many diff --git a/stories/data_destruction.yml b/stories/data_destruction.yml index 40155991ec..961e2eb739 100644 --- a/stories/data_destruction.yml +++ b/stories/data_destruction.yml @@ -3,6 +3,7 @@ id: 4ae5c0d1-cebd-47d1-bfce-71bf096e38aa version: 1 date: '2023-04-06' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the data destruction, including deleting files, overwriting files, wiping disk and unrecoverable file encryption. This analytic story may cover several known activities related to malware implants used in geo-political war to wipe disks or files to interrupt the network-wide operation diff --git a/stories/data_exfiltration.yml b/stories/data_exfiltration.yml index 75a4bfe197..b1381ee263 100644 --- a/stories/data_exfiltration.yml +++ b/stories/data_exfiltration.yml @@ -3,6 +3,7 @@ id: 66b0fe0c-1351-11eb-adc1-0242ac120002 version: 2 date: '2023-05-17' author: Bhavin Patel, Shannon Davis, Splunk +status: production description: Data exfiltration refers to the unauthorized transfer or extraction of sensitive or valuable data from a compromised system or network during a cyber attack. It is a critical phase in many targeted attacks, where adversaries aim to steal confidential information, such as intellectual property, financial records, personal data, or trade secrets. narrative: This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) leveraged by adversaries to exfiltrate data from your environments. Exfiltration comes in many flavors and its done differently on every environment. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command And Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. diff --git a/stories/data_protection.yml b/stories/data_protection.yml index 1e9d60b76c..c15ea6c7dc 100644 --- a/stories/data_protection.yml +++ b/stories/data_protection.yml @@ -3,6 +3,7 @@ id: 91c676cf-0b23-438d-abee-f6335e1fce33 version: 1 date: '2017-09-14' author: Bhavin Patel, Splunk +status: production description: Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. diff --git a/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml b/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml index 10ab15d858..296d43b462 100644 --- a/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml +++ b/stories/defense_evasion_or_unauthorized_access_via_sddl_tampering.yml @@ -3,6 +3,7 @@ id: 8ccdd852-3878-4871-ae37-e5af5c67baf3 version: 1 date: '2024-12-06' author: Nasreddine Bencherchali, Michael Haag, Splunk +status: production description: This analytic story focuses on detecting potential defense evasion or unauthorized access attempts through tampering with Security Descriptor Definition Language (SDDL) settings. Attackers may modify SDDL configurations to alter permissions on critical system components, such as event logs and services, to obscure their activities or gain unauthorized access. This story includes detections for changes to 'ChannelAccess' and 'CustomSD' registry values, as well as the use of tools like 'sc.exe sdset', 'icacls' and 'subinacl' to modify securable objects (files, registry, services, etc) permissions. narrative: Adversaries may attempt to evade detection or gain unauthorized access by modifying ACLs or Security Descriptors of different securable objects on the Windows operating system. By altering these settings, attackers can grant themselves elevated privileges or suppress logging mechanisms, thereby hindering detection and response efforts. Monitoring changes to critical registry values and the execution of specific tools used for SDDL modifications can help identify such malicious activities. references: diff --git a/stories/deobfuscate_decode_files_or_information.yml b/stories/deobfuscate_decode_files_or_information.yml index 50940436d9..2e93f5198f 100644 --- a/stories/deobfuscate_decode_files_or_information.yml +++ b/stories/deobfuscate_decode_files_or_information.yml @@ -3,6 +3,7 @@ id: 0bd01a54-8cbe-11eb-abcd-acde48001122 version: 1 date: '2021-03-24' author: Michael Haag, Splunk +status: production description: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. narrative: An example of obfuscated files is `Certutil.exe` usage to encode a portable diff --git a/stories/deprecated/aws_cryptomining.yml b/stories/deprecated/aws_cryptomining.yml index 00e67e2d10..abd30eff4d 100644 --- a/stories/deprecated/aws_cryptomining.yml +++ b/stories/deprecated/aws_cryptomining.yml @@ -3,6 +3,7 @@ id: ced74200-8465-4bc3-bd2c-9a782eec6750 version: 1 date: '2018-03-08' author: David Dorsey, Splunk +status: deprecated description: Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are diff --git a/stories/deprecated/aws_suspicious_provisioning_activities.yml b/stories/deprecated/aws_suspicious_provisioning_activities.yml index c71b2a26a5..c5403b49fa 100644 --- a/stories/deprecated/aws_suspicious_provisioning_activities.yml +++ b/stories/deprecated/aws_suspicious_provisioning_activities.yml @@ -3,6 +3,7 @@ id: 3338b567-3804-4261-9889-cf0ca4753c7f version: 1 date: '2018-03-16' author: David Dorsey, Splunk +status: deprecated description: Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. diff --git a/stories/deprecated/common_phishing_frameworks.yml b/stories/deprecated/common_phishing_frameworks.yml index 3e28ef83fb..055ff6b43a 100644 --- a/stories/deprecated/common_phishing_frameworks.yml +++ b/stories/deprecated/common_phishing_frameworks.yml @@ -3,6 +3,7 @@ id: 9a64ab44-9214-4639-8163-7eaa2621bd61 version: 2 date: '2024-09-24' author: Splunk Research Team, Splunk +status: deprecated description: 'Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email.' diff --git a/stories/deprecated/container_implantation_monitoring_and_investigation.yml b/stories/deprecated/container_implantation_monitoring_and_investigation.yml index 46ec10568e..53ee1b98a8 100644 --- a/stories/deprecated/container_implantation_monitoring_and_investigation.yml +++ b/stories/deprecated/container_implantation_monitoring_and_investigation.yml @@ -3,6 +3,7 @@ id: aa0e28b1-0521-4b6f-9d2a-7b87e34af246 version: 1 date: '2020-02-20' author: Rod Soto, Rico Valdez, Splunk +status: deprecated description: Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container diff --git a/stories/deprecated/host_redirection.yml b/stories/deprecated/host_redirection.yml index d9a497d2a3..90953fb738 100644 --- a/stories/deprecated/host_redirection.yml +++ b/stories/deprecated/host_redirection.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50fe268af4 version: 1 date: '2017-09-14' author: Rico Valdez, Splunk +status: deprecated description: Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches diff --git a/stories/deprecated/kubernetes_sensitive_role_activity.yml b/stories/deprecated/kubernetes_sensitive_role_activity.yml index 48c1c453f5..735eb620fa 100644 --- a/stories/deprecated/kubernetes_sensitive_role_activity.yml +++ b/stories/deprecated/kubernetes_sensitive_role_activity.yml @@ -3,6 +3,7 @@ id: 8b3984d2-17b6-47e9-ba43-a3376e70fdcc version: 1 date: '2020-05-20' author: Rod Soto, Splunk +status: deprecated description: This story addresses detection and response around Sensitive Role usage within a Kubernetes clusters against cluster resources and namespaces. narrative: Kubernetes is the most used container orchestration platform, this orchestration diff --git a/stories/deprecated/lateral_movement.yml b/stories/deprecated/lateral_movement.yml index f68f02b8b6..20c7ee6a69 100644 --- a/stories/deprecated/lateral_movement.yml +++ b/stories/deprecated/lateral_movement.yml @@ -3,6 +3,7 @@ id: 399d65dc-1f08-499b-a259-abd9051f38ad version: 3 date: '2024-09-24' author: David Dorsey, Splunk +status: deprecated description: "DEPRECATED IN FAVOR OF ACTIVE DIRECTORY LATERAL MOVEMENT. Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts." narrative: "Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation. Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or \"crown jewels\" to a persistent threat actor. An adversary can use lateral movement for multiple purposes, including remote execution of tools, pivoting to additional systems, obtaining access to specific information or files, access to additional credentials, exfiltrating data, or delivering a secondary effect. Adversaries may use legitimate credentials alongside inherent network and operating-system functionality to remotely connect to other systems and remain under the radar of network defenders. If there is evidence of lateral movement, it is imperative for analysts to collect evidence of the associated offending hosts. For example, an attacker might leverage host A to gain access to host B. From there, the attacker may try to move laterally to host C. In this example, the analyst should gather as much information as possible from all three hosts. It is also important to collect authentication logs for each host, to ensure that the offending accounts are well-documented. Analysts should account for all processes to ensure that the attackers did not install unauthorized software." references: diff --git a/stories/deprecated/monitor_backup_solution.yml b/stories/deprecated/monitor_backup_solution.yml index 8a7d64c2e3..c3f2dc7a32 100644 --- a/stories/deprecated/monitor_backup_solution.yml +++ b/stories/deprecated/monitor_backup_solution.yml @@ -3,6 +3,7 @@ id: abe807c7-1eb6-4304-ac32-6e7aacdb891d version: 1 date: '2017-09-12' author: David Dorsey, Splunk +status: deprecated description: Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints. diff --git a/stories/deprecated/monitor_for_unauthorized_software.yml b/stories/deprecated/monitor_for_unauthorized_software.yml index 046c60f015..a9e7d9688d 100644 --- a/stories/deprecated/monitor_for_unauthorized_software.yml +++ b/stories/deprecated/monitor_for_unauthorized_software.yml @@ -3,6 +3,7 @@ id: 8892a655-6205-43f7-abba-06460e38c8ae version: 2 date: '2024-09-24' author: David Dorsey, Splunk +status: deprecated description: 'Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment.' narrative: 'It is critical to identify unauthorized software and processes running diff --git a/stories/deprecated/office_365_detections.yml b/stories/deprecated/office_365_detections.yml index 139c6cd309..d2fb3d09b7 100644 --- a/stories/deprecated/office_365_detections.yml +++ b/stories/deprecated/office_365_detections.yml @@ -3,6 +3,7 @@ id: 1a51dd71-effc-48b2-abc4-3e9cdb61e5b9 version: 2 date: '2020-12-16' author: Patrick Bareiss, Mauricio Velazco, Splunk +status: deprecated description: Monitor for activities and anomalies indicative of potential threats within Office 365 environments. narrative: Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. Given the centralized storage of sensitive organizational data within O365 and its widespread adoption, it has become a focal point for cybersecurity efforts. The platform's complexity, combined with its ubiquity, makes it both a valuable asset and a prime target for potential threats. As O365's importance grows, it increasingly becomes a target for attackers seeking to exploit organizational data and systems. Security teams should prioritize monitoring O365 not just because of the sensitive data it often holds, but also due to the myriad ways the platform can be exploited. Understanding and monitoring O365's security landscape is crucial for organizations to detect, respond to, and mitigate potential threats in a timely manner. references: diff --git a/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml b/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml index 47b8207275..3b0bbf9c8d 100644 --- a/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml +++ b/stories/deprecated/spectre_and_meltdown_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 6d3306f6-bb2b-4219-8609-8efad64032f2 version: 1 date: '2018-01-08' author: David Dorsey, Splunk +status: deprecated description: Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story. narrative: Meltdown and Spectre exploit critical vulnerabilities in modern CPUs that diff --git a/stories/deprecated/suspicious_aws_ec2_activities.yml b/stories/deprecated/suspicious_aws_ec2_activities.yml index ee51137331..89b5348253 100644 --- a/stories/deprecated/suspicious_aws_ec2_activities.yml +++ b/stories/deprecated/suspicious_aws_ec2_activities.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50f1268af3 version: 1 date: '2018-02-09' author: Bhavin Patel, Splunk +status: deprecated description: Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users diff --git a/stories/deprecated/unusual_aws_ec2_modifications.yml b/stories/deprecated/unusual_aws_ec2_modifications.yml index 9c4e22c9d9..f0f1fc4b54 100644 --- a/stories/deprecated/unusual_aws_ec2_modifications.yml +++ b/stories/deprecated/unusual_aws_ec2_modifications.yml @@ -3,6 +3,7 @@ id: 73de57ef-0dfc-411f-b1e7-fa24428aeae0 version: 1 date: '2018-04-09' author: David Dorsey, Splunk +status: deprecated description: Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. diff --git a/stories/deprecated/web_fraud_detection.yml b/stories/deprecated/web_fraud_detection.yml index 7aae434b6f..81d8ee3448 100644 --- a/stories/deprecated/web_fraud_detection.yml +++ b/stories/deprecated/web_fraud_detection.yml @@ -3,6 +3,7 @@ id: 18bb45b9-7684-45c6-9e97-1fdd0d98c0a7 version: 1 date: '2018-10-08' author: Jim Apger, Splunk +status: deprecated description: Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative: 'The Federal Bureau of Investigations (FBI) defines Internet fraud as the diff --git a/stories/detect_zerologon_attack.yml b/stories/detect_zerologon_attack.yml index 892b2ac0c3..8046a670bc 100644 --- a/stories/detect_zerologon_attack.yml +++ b/stories/detect_zerologon_attack.yml @@ -3,6 +3,7 @@ id: 5d14a962-569e-4578-939f-f386feb63ce4 version: 1 date: '2020-09-18' author: Rod Soto, Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk +status: production description: Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now diff --git a/stories/dev_sec_ops.yml b/stories/dev_sec_ops.yml index 6f3ed76978..901e811304 100644 --- a/stories/dev_sec_ops.yml +++ b/stories/dev_sec_ops.yml @@ -3,6 +3,7 @@ id: 0ca8c38e-631e-4b81-940c-f9c5450ce41e version: 1 date: '2021-08-18' author: Patrick Bareiss, Splunk +status: production description: This story is focused around detecting attacks on a DevSecOps lifeccycle which consists of the phases plan, code, build, test, release, deploy, operate and monitor. diff --git a/stories/dhs_report_ta18_074a.yml b/stories/dhs_report_ta18_074a.yml index 2201c5b835..262be24ba6 100644 --- a/stories/dhs_report_ta18_074a.yml +++ b/stories/dhs_report_ta18_074a.yml @@ -3,6 +3,7 @@ id: 0c016e5c-88be-4e2c-8c6c-c2b55b4fb4ef version: 2 date: '2020-01-22' author: Rico Valdez, Splunk +status: production description: Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. diff --git a/stories/disabling_security_tools.yml b/stories/disabling_security_tools.yml index 53b7e4d996..ae54416e48 100644 --- a/stories/disabling_security_tools.yml +++ b/stories/disabling_security_tools.yml @@ -3,6 +3,7 @@ id: fcc27099-46a0-46b0-a271-5c7dab56b6f1 version: 2 date: '2020-02-04' author: Rico Valdez, Splunk +status: production description: Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. diff --git a/stories/dns_amplification_attacks.yml b/stories/dns_amplification_attacks.yml index f30a899be4..5b0a291c06 100644 --- a/stories/dns_amplification_attacks.yml +++ b/stories/dns_amplification_attacks.yml @@ -3,6 +3,7 @@ id: a563972b-d2e2-4978-b6ca-6e83e24af4d3 version: 1 date: '2016-09-13' author: Bhavin Patel, Splunk +status: production description: DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, diff --git a/stories/dns_hijacking.yml b/stories/dns_hijacking.yml index 618219af3b..2190d33fc1 100644 --- a/stories/dns_hijacking.yml +++ b/stories/dns_hijacking.yml @@ -3,6 +3,7 @@ id: 8169f17b-ef68-4b59-aa28-586907301221 version: 1 date: '2020-02-04' author: Bhavin Patel, Splunk +status: production description: Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative: 'Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), diff --git a/stories/domain_trust_discovery.yml b/stories/domain_trust_discovery.yml index 8bf8f639df..212d1df5ec 100644 --- a/stories/domain_trust_discovery.yml +++ b/stories/domain_trust_discovery.yml @@ -3,6 +3,7 @@ id: e6f30f14-8daf-11eb-a017-acde48001122 version: 1 date: '2021-03-25' author: Michael Haag, Splunk +status: production description: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. diff --git a/stories/double_zero_destructor.yml b/stories/double_zero_destructor.yml index a0d30d0bb3..39a8569f0d 100644 --- a/stories/double_zero_destructor.yml +++ b/stories/double_zero_destructor.yml @@ -3,6 +3,7 @@ id: f56e8c00-3224-4955-9a6e-924ec7da1df7 version: 1 date: '2022-03-25' author: Teoderick Contreras, Rod Soto, Splunk +status: production description: Double Zero Destructor is a destructive payload that enumerates Domain Controllers and executes killswitch if detected. Overwrites files with Zero blocks or using MS Windows API calls such as NtFileOpen, NtFSControlFile. This payload also deletes registry hives HKCU,HKLM, HKU, HKLM BCD. narrative: Double zero destructor enumerates domain controllers, delete registry hives and overwrites files using zero blocks and API calls. references: diff --git a/stories/dynamic_dns.yml b/stories/dynamic_dns.yml index 313c503b7b..526b9f03ce 100644 --- a/stories/dynamic_dns.yml +++ b/stories/dynamic_dns.yml @@ -3,6 +3,7 @@ id: 8169f17b-ef68-4b59-aae8-586907301221 version: 2 date: '2018-09-06' author: Bhavin Patel, Splunk +status: production description: Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. diff --git a/stories/emotet_malware_dhs_report_ta18_201a.yml b/stories/emotet_malware_dhs_report_ta18_201a.yml index b651506c10..d148f02169 100644 --- a/stories/emotet_malware_dhs_report_ta18_201a.yml +++ b/stories/emotet_malware_dhs_report_ta18_201a.yml @@ -3,6 +3,7 @@ id: bb9f5ed2-916e-4364-bb6d-91c310efcf52 version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk +status: production description: Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has diff --git a/stories/f5_authentication_bypass_with_tmui.yml b/stories/f5_authentication_bypass_with_tmui.yml index 4aee82e248..37de0dd946 100644 --- a/stories/f5_authentication_bypass_with_tmui.yml +++ b/stories/f5_authentication_bypass_with_tmui.yml @@ -3,6 +3,7 @@ id: e4acbea6-75bb-4873-8c22-bc2da9525e89 version: 1 date: '2023-10-30' author: Michael Haag, Splunk +status: production description: "Research into leading software revealed vulnerabilities in both Apache Tomcat and the F5 BIG-IP suite. Apache's AJP protocol vulnerability, designated CVE-2022-26377, relates to AJP request smuggling. Successful exploitation enables unauthorized system activities. F5 BIG-IP Virtual Edition exhibited a distinct vulnerability, an authentication bypass in the Traffic Management User Interface (TMUI), resulting in system compromise. Assigned CVE-2023-46747, this vulnerability also arose from request smuggling, bearing similarity to CVE-2022-26377. Given the wide adoption of both Apache Tomcat and F5 products, these vulnerabilities present grave risks to organizations. Remediation and vulnerability detection mechanisms are essential to address these threats effectively." narrative: Both Apache Tomcat's AJP protocol and F5's BIG-IP Virtual Edition have been exposed to critical vulnerabilities. Apache's CVE-2022-26377 pertains to request smuggling by manipulating the "Transfer-Encoding" header. If successfully exploited, this allows attackers to bypass security controls and undertake unauthorized actions. diff --git a/stories/f5_big_ip_vulnerability_cve_2022_1388.yml b/stories/f5_big_ip_vulnerability_cve_2022_1388.yml index f53cabb2b5..02c49083a8 100644 --- a/stories/f5_big_ip_vulnerability_cve_2022_1388.yml +++ b/stories/f5_big_ip_vulnerability_cve_2022_1388.yml @@ -3,6 +3,7 @@ id: 0367b177-f8d6-4c4b-a62d-86f52a590bff version: 1 date: '2022-05-10' author: Michael Haag, Splunk +status: production description: CVE-2022-1388 is a unauthenticated remote code execution vulnerablity against BIG-IP iControl REST API. narrative: CVE-2022-1388 is a critical vulnerability (CVSS 9.8) in the management interface of F5 Networks'' BIG-IP solution that enables an unauthenticated attacker to gain remote code execution on the system through bypassing F5''s iControl REST authentication. The vulnerability was first discovered by F5''s internal product security team and disclosed publicly on May 4, 2022, per Randori. This vulnerability,CVE-2022-1388, may allow an unauthenticated attacker with network access to the BIG-IP system through the management port and/or self IP addresses to execute arbitrary system commands, create or delete files, or disable services. There is no data plane exposure; this is a control plane issue only per F5 article K23605346. diff --git a/stories/f5_tmui_rce_cve_2020_5902.yml b/stories/f5_tmui_rce_cve_2020_5902.yml index 6e5a2148cd..f50a00638b 100644 --- a/stories/f5_tmui_rce_cve_2020_5902.yml +++ b/stories/f5_tmui_rce_cve_2020_5902.yml @@ -3,6 +3,7 @@ id: 7678c968-d46e-11ea-87d0-0242ac130003 version: 1 date: '2020-08-02' author: Shannon Davis, Splunk +status: production description: Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows diff --git a/stories/fin7.yml b/stories/fin7.yml index b79eb8d73c..04e667e2b5 100644 --- a/stories/fin7.yml +++ b/stories/fin7.yml @@ -3,6 +3,7 @@ id: df2b00d3-06ba-49f1-b253-b19cef19b569 version: 1 date: '2021-09-14' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the FIN7 JS Implant and JSSLoader, including looking for Image Loading of ldap and wmi modules, associated with its payload, data collection and diff --git a/stories/flax_typhoon.yml b/stories/flax_typhoon.yml index 49c8455b05..b55d5f0aee 100644 --- a/stories/flax_typhoon.yml +++ b/stories/flax_typhoon.yml @@ -3,6 +3,7 @@ id: 78fadce9-a07f-4508-8d14-9b20052a62cc version: 1 date: '2023-08-25' author: Michael Haag, Splunk +status: production description: Microsoft has identified a nation-state activity group, Flax Typhoon, based in China, targeting Taiwanese organizations for espionage. The group maintains long-term access to networks with minimal use of malware, relying on built-in OS tools and benign software. The group's activities are primarily focused on Taiwan, but the techniques used could be easily reused in other operations outside the region. Microsoft has not observed Flax Typhoon using this access to conduct additional actions. narrative: Flax Typhoon has been active since mid-2021, targeting government agencies, education, critical manufacturing, and IT organizations in Taiwan. The group uses the China Chopper web shell, Metasploit, Juicy Potato privilege escalation tool, Mimikatz, and SoftEther VPN client. However, they primarily rely on living-off-the-land techniques and hands-on-keyboard activity. Initial access is achieved by exploiting known vulnerabilities in public-facing servers and deploying web shells. Following initial access, Flax Typhoon uses command-line tools to establish persistent access over the remote desktop protocol, deploy a VPN connection to actor-controlled network infrastructure, and collect credentials from compromised systems. The group also uses this VPN access to scan for vulnerabilities on targeted systems and organizations from the compromised systems. references: diff --git a/stories/forest_blizzard.yml b/stories/forest_blizzard.yml index 11eface337..5fdf57613c 100644 --- a/stories/forest_blizzard.yml +++ b/stories/forest_blizzard.yml @@ -3,6 +3,7 @@ id: 2c1aceda-f0a5-4c83-8543-e23ec1466958 version: 1 date: '2023-09-11' author: Michael Haag, Splunk +status: production description: CERT-UA has unveiled a cyberattack on Ukraine's energy infrastructure, orchestrated via deceptive emails. These emails, once accessed, lead to a multi-stage cyber operation downloading and executing malicious payloads. Concurrently, Zscaler's "Steal-It" campaign detection revealed striking similarities, hinting at a shared origin - APT28 or Fancy Bear. This notorious group, linked to Russia's GRU, utilizes legitimate platforms like Mockbin, making detection challenging. Their operations underline the evolving cyber threat landscape and stress the importance of advanced defenses. narrative: APT28, also known as Fancy Bear, blends stealth and expertise in its cyber operations. Affiliated with Russia's GRU, their signature move involves spear-phishing emails, leading to multi-tiered cyberattacks. In Ukraine's recent breach, a ZIP archive's execution triggered a series of actions, culminating in information flow redirection via the TOR network. Simultaneously, Zscaler's "Steal-It" campaign pinpointed similar tactics, specifically targeting NTLMv2 hashes. This campaign used ZIP archives containing LNK files to exfiltrate data via Mockbin. APT28's hallmark is their "Living Off The Land" strategy, manipulating legitimate tools and services to blend in, evading detection. Their innovative tactics, coupled with a geofencing focus on specific regions, make them a formidable cyber threat, highlighting the urgent need for advanced defense strategies. references: diff --git a/stories/fortinet_fortinac_cve_2022_39952.yml b/stories/fortinet_fortinac_cve_2022_39952.yml index 708838a003..f972d5030f 100644 --- a/stories/fortinet_fortinac_cve_2022_39952.yml +++ b/stories/fortinet_fortinac_cve_2022_39952.yml @@ -3,6 +3,7 @@ id: 2833a527-3b7f-41af-a950-39f7bbaff819 version: 1 date: '2023-02-21' author: Michael Haag, Splunk +status: production description: On Thursday, 16 February 2023, Fortinet released a PSIRT that details CVE-2022-39952, a critical vulnerability affecting its FortiNAC product (Horizon3.ai). narrative: This vulnerability, discovered by Gwendal Guegniaud of Fortinet, allows an unauthenticated attacker to write arbitrary files on the system and as a result obtain remote code execution in the context of the root user (Horizon3.ai). Impacting FortiNAC, is tracked as CVE-2022-39952 and has a CVSS v3 score of 9.8 (critical). diff --git a/stories/gcp_account_takeover.yml b/stories/gcp_account_takeover.yml index fdf6641eb2..232540adff 100644 --- a/stories/gcp_account_takeover.yml +++ b/stories/gcp_account_takeover.yml @@ -3,6 +3,7 @@ id: 8601caff-414f-4c6d-9a04-75b66778869d version: 1 date: '2022-10-12' author: Mauricio Velazco, Bhavin Patel, Splunk +status: production description: Monitor for activities and techniques associated with Account Takeover attacks against Google Cloud Platform tenants. narrative: 'Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, diff --git a/stories/gcp_cross_account_activity.yml b/stories/gcp_cross_account_activity.yml index ed222ab4f3..f7c24e533c 100644 --- a/stories/gcp_cross_account_activity.yml +++ b/stories/gcp_cross_account_activity.yml @@ -3,6 +3,7 @@ id: 0432039c-ef41-4b03-b157-450c25dad1e6 version: 1 date: '2020-09-01' author: Rod Soto, Splunk +status: production description: Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. diff --git a/stories/gomir.yml b/stories/gomir.yml index 515bb091e7..4a5c4c74a5 100644 --- a/stories/gomir.yml +++ b/stories/gomir.yml @@ -3,6 +3,7 @@ id: 02dbfda2-45fe-4731-a659-91fa871019ba version: 1 date: '2024-05-29' author: Teoderick Contreras, Splunk +status: production description: This analytic story includes detections that help security analysts identify and investigate unusual activities associated with the Gomir backdoor malware. Gomir is a sophisticated cyber threat that gains unauthorized access to systems. It communicates with a remote command-and-control (C2) server to execute malicious commands, steal diff --git a/stories/gozi_malware.yml b/stories/gozi_malware.yml index 5f54cdc3f4..06bb863062 100644 --- a/stories/gozi_malware.yml +++ b/stories/gozi_malware.yml @@ -3,6 +3,7 @@ id: a7332538-bb18-421e-874e-a20c9fcc34e7 version: 1 date: '2024-07-24' author: Michael Haag, Splunk +status: production description: This analytic story covers the detection and analysis of Gozi malware, also known as Ursnif or ISFB. Gozi is one of the oldest and most persistent banking trojans, with a history dating back to 2000. It has undergone numerous evolutions and code forks, resulting in several active variants in recent years. narrative: 'Gozi malware, first observed in 2006, has a complex lineage tracing back to the Ursnif/Snifula spyware from 2000. Over the years, it has evolved from a simple spyware to a sophisticated banking trojan, offered as Crimeware-as-a-Service (CaaS). Recent variants like Dreambot, IAP, RM2, RM3, and LDR4 demonstrate its ongoing development and threat. diff --git a/stories/graceful_wipe_out_attack.yml b/stories/graceful_wipe_out_attack.yml index c6aa134e1c..874e709974 100644 --- a/stories/graceful_wipe_out_attack.yml +++ b/stories/graceful_wipe_out_attack.yml @@ -3,6 +3,7 @@ id: 83b15b3c-6bda-45aa-a3b6-b05c52443f44 version: 1 date: '2023-06-15' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive attack or campaign found by "THE DFIR Report" that uses Truebot, FlawedGrace and MBR killer malware. This analytic story looks for suspicious dropped files, cobalt strike execution, im-packet execution, registry modification, scripts, diff --git a/stories/hafnium_group.yml b/stories/hafnium_group.yml index 3df3f902fe..b2de32324d 100644 --- a/stories/hafnium_group.yml +++ b/stories/hafnium_group.yml @@ -3,6 +3,7 @@ id: beae2ab0-7c3f-11eb-8b63-acde48001122 version: 1 date: '2021-03-03' author: Michael Haag, Splunk +status: production description: HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. narrative: 'On Tuesday, March 2, 2021, Microsoft released a set of security patches diff --git a/stories/handala_wiper.yml b/stories/handala_wiper.yml index 5ae6560592..ee16a43719 100644 --- a/stories/handala_wiper.yml +++ b/stories/handala_wiper.yml @@ -3,6 +3,7 @@ id: 1590c46a-e976-4b4b-a166-d9be06ab0056 version: 1 date: '2024-07-31' author: Teoderick Contreras, Splunk +status: production description: Handala Destructive Wiper detection involves monitoring for suspicious activities such as unexpected `regasm` processes, unauthorized AutoIt script executions, and the dropping of malicious drivers. Indicators such as abrupt system slowdowns, and the creation of unknown files or processes. Early detection of these signs is crucial for mitigating the severe impact of this destructive malware. narrative: Handala Destructive Wiper is a potent malware strain known for its destructive capabilities. It targets and irreversibly wipes data from infected systems, rendering them inoperable. This malware is often used in cyber-attacks against critical infrastructure and organizations, causing significant disruption and data loss. This Wiper employs techniques to evade detection and spread rapidly across networks. Its deployment can lead to extensive downtime, financial loss, and compromised sensitive information, making it a severe threat in the cybersecurity landscape. references: diff --git a/stories/hermetic_wiper.yml b/stories/hermetic_wiper.yml index 5435256809..f3334cd04a 100644 --- a/stories/hermetic_wiper.yml +++ b/stories/hermetic_wiper.yml @@ -3,6 +3,7 @@ id: b7511c2e-9a10-11ec-99e3-acde48001122 version: 1 date: '2022-03-02' author: Teoderick Contreras, Rod Soto, Michael Haag, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "Hermetic Wiper". This analytic story looks for abuse of Regsvr32, executables written in administrative SMB Share, suspicious processes, disabling of memory crash dump and more. narrative: Hermetic Wiper is destructive malware operation found by Sentinel One targeting diff --git a/stories/hidden_cobra_malware.yml b/stories/hidden_cobra_malware.yml index 6a0dabf857..614cfa6d09 100644 --- a/stories/hidden_cobra_malware.yml +++ b/stories/hidden_cobra_malware.yml @@ -3,6 +3,7 @@ id: baf7580b-d4b4-4774-8173-7d198e9da335 version: 2 date: '2020-01-22' author: Rico Valdez, Splunk +status: production description: Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported diff --git a/stories/icedid.yml b/stories/icedid.yml index 9641e450ef..3344917afb 100644 --- a/stories/icedid.yml +++ b/stories/icedid.yml @@ -3,6 +3,7 @@ id: 1d2cc747-63d7-49a9-abb8-93aa36305603 version: 1 date: '2021-07-29' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the IcedID banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection. diff --git a/stories/iis_components.yml b/stories/iis_components.yml index 42fea6e5a3..0c5917fbb0 100644 --- a/stories/iis_components.yml +++ b/stories/iis_components.yml @@ -3,6 +3,7 @@ id: 0fbde550-8252-43ab-a26a-03976f55b58b version: 1 date: '2022-12-19' author: Michael Haag, Splunk +status: production description: Adversaries may install malicious components that run on Internet Information Services (IIS) web servers to establish persistence. narrative: IIS provides several mechanisms to extend the functionality of the web servers. For example, Internet Server Application Programming Interface (ISAPI) extensions and filters can be installed to examine and/or modify incoming and outgoing IIS web requests. Extensions and filters are deployed as DLL files that export three functions - Get{Extension/Filter}Version, Http{Extension/Filter}Proc, and (optionally) Terminate{Extension/Filter}. IIS modules may also be installed to extend IIS web servers. diff --git a/stories/industroyer2.yml b/stories/industroyer2.yml index 5cf0dfd0af..dd9e65c6d6 100644 --- a/stories/industroyer2.yml +++ b/stories/industroyer2.yml @@ -3,6 +3,7 @@ id: 7ff7db2b-b001-498e-8fe8-caf2dbc3428a version: 1 date: '2022-04-21' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Industroyer2 attack, including file writes associated with its payload, lateral movement, persistence, privilege escalation and data destruction. diff --git a/stories/information_sabotage.yml b/stories/information_sabotage.yml index 6ee67f3f8f..c00eec7908 100644 --- a/stories/information_sabotage.yml +++ b/stories/information_sabotage.yml @@ -3,6 +3,7 @@ id: b71ba595-ef80-4e39-8b66-887578a7a71b version: 1 date: '2021-11-17' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might correlate to insider threat specially in terms of information sabotage. narrative: Information sabotage is the type of crime many people associate with insider diff --git a/stories/ingress_tool_transfer.yml b/stories/ingress_tool_transfer.yml index 4cbcfb5a76..0bb0b12885 100644 --- a/stories/ingress_tool_transfer.yml +++ b/stories/ingress_tool_transfer.yml @@ -3,6 +3,7 @@ id: b3782036-8cbd-11eb-9d8e-acde48001122 version: 1 date: '2021-03-24' author: Michael Haag, Splunk +status: production description: Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the Command And Control channel to bring tools into the victim network diff --git a/stories/insider_threat.yml b/stories/insider_threat.yml index f8f425f404..623835b89a 100644 --- a/stories/insider_threat.yml +++ b/stories/insider_threat.yml @@ -3,6 +3,7 @@ id: c633df29-a950-4c4c-a0f8-02be6730797c version: 1 date: '2022-05-19' author: Jose Hernandez, Splunk +status: production description: Monitor for activities and techniques associated with insider threats and specifically focusing on malicious insiders operating with in a corporate environment. narrative: "Insider Threats are best defined by CISA: \"Insider threat incidents are possible in any sector or organization. An insider threat is typically a current or former employee, third-party contractor, or business partner. In their present or former role, the person has or had access to an organization's network systems, data, or premises, and uses their access (sometimes unwittingly). To combat the insider threat, organizations can implement a proactive, prevention-focused mitigation program to detect and identify threats, assess risk, and manage that risk - before an incident occurs.\" An insider is any person who has or had authorized access to or knowledge of an organization's resources, including personnel, facilities, information, equipment, networks, and systems. These are the common insiders that create insider threats: Departing Employees, Security Evaders, Malicious Insiders, and Negligent Employees. This story aims at detecting the malicious insider." references: diff --git a/stories/ivanti_connect_secure_vpn_vulnerabilities.yml b/stories/ivanti_connect_secure_vpn_vulnerabilities.yml index e14d1b41d7..e2a272010e 100644 --- a/stories/ivanti_connect_secure_vpn_vulnerabilities.yml +++ b/stories/ivanti_connect_secure_vpn_vulnerabilities.yml @@ -3,6 +3,7 @@ id: e3b5c3b8-082b-4b4e-b2c9-47ed79e2a5ab version: 1 date: '2024-01-16' author: Michael Haag, Splunk +status: production description: The following analytic story addresses critical vulnerabilities CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure and Ivanti Policy Secure Gateways. CVE-2023-46805 is an authentication bypass vulnerability, while CVE-2024-21887 is a command injection flaw, both presenting significant risks in versions 9.x and 22.x. Combined, these vulnerabilities enable unauthenticated threat actors to execute arbitrary commands, compromising system integrity. Immediate mitigation is imperative, with patches scheduled for staggered release. Ivanti has provided interim mitigation steps, and it's crucial for customers to apply these measures to protect their systems against potential exploits. narrative: Ivanti Connect Secure and Ivanti Policy Secure gateways face a severe security challenge with the discovery of CVE-2023-46805 and CVE-2024-21887. CVE-2023-46805 allows attackers to bypass authentication in critical web components of versions 9.x and 22.x. More alarmingly, when paired with CVE-2024-21887, a command injection vulnerability, it enables remote attackers to execute arbitrary commands without authentication. This combination poses a heightened threat, undermining the security of enterprise networks. Ivanti has mobilized resources to address these vulnerabilities, offering immediate mitigation advice and scheduling patch releases. Customers are urged to apply these mitigations without delay to safeguard their networks. references: diff --git a/stories/ivanti_epm_vulnerabilities.yml b/stories/ivanti_epm_vulnerabilities.yml index aa170bc81e..2475583cc2 100644 --- a/stories/ivanti_epm_vulnerabilities.yml +++ b/stories/ivanti_epm_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 4dcadae4-df82-42f3-9e77-4d852d20ac78 version: 2 date: '2024-09-24' author: Michael Haag, Splunk +status: production description: |- This analytic story covers various vulnerabilities identified in Ivanti Endpoint Manager (EPM), including but not limited to SQL injection, remote code execution, and privilege escalation. These vulnerabilities can potentially be exploited by adversaries to gain unauthorized access, execute arbitrary code, and compromise the security of managed endpoints. narrative: |- diff --git a/stories/ivanti_epmm_remote_unauthenticated_access.yml b/stories/ivanti_epmm_remote_unauthenticated_access.yml index 8bbf25da4b..aadaf420e3 100644 --- a/stories/ivanti_epmm_remote_unauthenticated_access.yml +++ b/stories/ivanti_epmm_remote_unauthenticated_access.yml @@ -3,6 +3,7 @@ id: 7e36ca54-c096-4a39-b724-6fc935164f0c version: 2 date: '2023-08-08' author: Michael Haag, Splunk +status: production description: Ivanti, a leading technology company, has disclosed two critical zero-day vulnerabilities in its Endpoint Manager Mobile (EPMM) product, CVE-2023-35078 and CVE-2023-35081. A recent update concerning CVE-2023-35082, closely related to CVE-2023-35078, reveals its impact on more versions of Ivanti's software than initially believed. The former allows unauthenticated attackers to obtain sensitive data, modify servers, and access the API, potentially leading to data breaches or malicious system modifications. Meanwhile, CVE-2023-35081 lets authenticated administrators remotely write arbitrary files to the server. Both vulnerabilities have been exploited in targeted attacks against government ministries and could be used in conjunction. With the presence of PoC code for CVE-2023-35078, the risk of broader exploitation has increased. While initially leveraged in limited attacks, the exploitation is expected to rise, possibly involving state-sponsored actors. Organizations are urged to apply immediate patches and conduct regular system assessments to ensure security. narrative: Ivantis Endpoint Manager Mobile (EPMM) product, formerly known as MobileIron Core and extensively utilized by IT teams to manage mobile devices, applications, and content, has been found to harbor several critical vulnerabilities. Specifically, CVE-2023-35078 allows remote unauthenticated attackers to access sensitive data and make changes to servers. This flaw has been leveraged in targeted attacks against Norwegian government ministries. In addition, CVE-2023-35081 permits an authenticated attacker with administrative privileges to remotely write arbitrary files to the server. diff --git a/stories/ivanti_sentry_authentication_bypass_cve_2023_38035.yml b/stories/ivanti_sentry_authentication_bypass_cve_2023_38035.yml index 36c87ad257..04d54b663c 100644 --- a/stories/ivanti_sentry_authentication_bypass_cve_2023_38035.yml +++ b/stories/ivanti_sentry_authentication_bypass_cve_2023_38035.yml @@ -3,6 +3,7 @@ id: da229be2-4637-47a5-b551-1d4b64f411c6 version: 1 date: '2023-08-24' author: Michael Haag, Splunk +status: production description: A critical vulnerability, designated as CVE-2023-38035, has been identified in Ivanti Sentry (formerly MobileIron Sentry). It affects all supported versions, including 9.18, 9.17, and 9.16, as well as older versions. The vulnerability allows an unauthenticated attacker to access the System Manager Portal (typically hosted on port 8443) and make configuration changes, potentially executing OS commands as root. However, the risk is low for users who haven't exposed port 8443 online. This flaw is distinct from other Ivanti products. It's imperative for organizations to check for unrecognized HTTP requests to /services/* as a potential indicator of compromise. narrative: CVE-2023-38035 presents a significant security risk in the Ivanti Sentry administration interface. The vulnerability was identified shortly after another notable vulnerability in Ivanti EPMM (CVE-2023-35078) was discovered being exploited in the wild. The current vulnerability allows a malicious actor, without requiring authentication, to access the System Manager Portal, typically hosted on port 8443. Upon successful exploitation, the attacker can make configuration alterations to both the Sentry system and its underlying OS. The potential damage is significant, enabling the attacker to execute commands on the system with root privileges. diff --git a/stories/ivanti_virtual_traffic_manager_cve_2024_7593.yml b/stories/ivanti_virtual_traffic_manager_cve_2024_7593.yml index d9c54b17e0..1832c940aa 100644 --- a/stories/ivanti_virtual_traffic_manager_cve_2024_7593.yml +++ b/stories/ivanti_virtual_traffic_manager_cve_2024_7593.yml @@ -3,6 +3,7 @@ id: 28e88e97-3494-45a6-87d5-76065cccf8d2 version: 1 date: '2024-08-19' author: Michael Haag, Splunk +status: production description: This analytic story addresses the critical authentication bypass vulnerability (CVE-2024-7593) in Ivanti Virtual Traffic Manager (vTM). Disclosed in August 2024, this flaw affects vTM versions prior to 22.2R1 and 22.7R2, allowing unauthenticated remote attackers to access the admin panel and create new administrator accounts. Such access could potentially lead to full system compromise. The story provides detections for potential exploitation attempts, focusing on unauthorized account creation and suspicious administrative activities. It aims to help organizations identify and respond to possible attacks leveraging this vulnerability, emphasizing the importance of timely patching and thorough investigation of any suspicious events. narrative: In August 2024, a critical vulnerability (CVE-2024-7593) was disclosed in Ivanti Virtual Traffic Manager (vTM) versions prior to 22.2R1 and 22.7R2. This authentication bypass flaw allows unauthenticated remote attackers to access the admin panel and create new administrator accounts, potentially leading to full system compromise. Exploitation of this vulnerability typically involves an attacker accessing the vTM management interface, bypassing authentication using the vulnerability, creating a new administrator account without proper authorization, and potentially using the new account for further malicious activities. This analytic story includes detections to identify suspicious account creation events and other indicators of exploitation. It is crucial for organizations using affected Ivanti vTM versions to update to a patched version immediately and investigate any potential compromise. By leveraging these detections, security teams can enhance their ability to detect and respond to potential attacks exploiting this critical vulnerability in their Ivanti vTM deployments. references: diff --git a/stories/jboss_vulnerability.yml b/stories/jboss_vulnerability.yml index c138e1c36a..beb3d4f053 100644 --- a/stories/jboss_vulnerability.yml +++ b/stories/jboss_vulnerability.yml @@ -3,6 +3,7 @@ id: 1f5294cb-b85f-4c2d-9c58-ffcf248f52bd version: 1 date: '2017-09-14' author: Bhavin Patel, Splunk +status: production description: In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources diff --git a/stories/jenkins_server_vulnerabilities.yml b/stories/jenkins_server_vulnerabilities.yml index 0f1a4727c3..20db656ed4 100644 --- a/stories/jenkins_server_vulnerabilities.yml +++ b/stories/jenkins_server_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 789e76e6-4b5e-4af3-ab8c-46578d84ccff version: 1 date: '2024-01-29' author: Michael Haag, Splunk +status: production description: This analytic story provides a comprehensive view of Jenkins server vulnerabilities and associated detection analytics. narrative: The following analytic story provides a comprehensive view of Jenkins server vulnerabilities and associated detection analytics. Jenkins is a popular open-source automation server that is used to automate tasks associated with building, testing, and deploying software. Jenkins is often used in DevOps environments and is a critical component of the software development lifecycle. As a result, Jenkins servers are often targeted by adversaries to gain access to sensitive information, credentials, and other critical assets. This analytic story provides a comprehensive view of Jenkins server vulnerabilities and associated detection analytics. references: diff --git a/stories/jetbrains_teamcity_unauthenticated_rce.yml b/stories/jetbrains_teamcity_unauthenticated_rce.yml index 7845795041..51b746ebc5 100644 --- a/stories/jetbrains_teamcity_unauthenticated_rce.yml +++ b/stories/jetbrains_teamcity_unauthenticated_rce.yml @@ -3,6 +3,7 @@ id: 7ef2d230-9dbb-4d13-9263-a7d8c3aad9bf version: 1 date: '2023-10-01' author: Michael Haag, Splunk +status: production description: A critical security vulnerability, CVE-2023-42793, has been discovered affecting all versions of TeamCity On-Premises up to 2023.05.3. This vulnerability allows unauthenticated attackers to execute remote code and gain administrative control of the TeamCity server, posing a significant risk for supply chain attacks. Although the issue has been fixed in version 2023.05.4, servers running older versions remain at risk. A security patch plugin has been released for immediate mitigation, applicable to TeamCity versions 8.0 and above. Organizations are strongly advised to update to the fixed version or apply the security patch, especially if their TeamCity server is publicly accessible. No impact has been reported on TeamCity Cloud as it has been upgraded to the secure version. narrative: The CVE-2023-42793 vulnerability in TeamCity On-Premises allows an unauthenticated attacker to bypass authentication and gain administrative access through Remote Code Execution (RCE). Specifically, the attacker can send a malicious POST request to /app/rest/users/id:1/tokens/RPC2 to create an administrative token. Once the token is obtained, the attacker has the ability to perform various unauthorized activities, including creating new admin users and executing arbitrary shell commands on the server. For Splunk Security Content, the focus should be on identifying suspicious POST requests to /app/rest/users/id:1/tokens/RPC2 and other affected API endpoints, as this is the initial point of exploitation. Monitoring logs for changes to the internal.properties file or the creation of new admin users could also provide crucial indicators of compromise. Furthermore, Splunk can be configured to alert on multiple failed login attempts followed by a successful login from the same IP, which could indicate exploitation attempts. diff --git a/stories/jetbrains_teamcity_vulnerabilities.yml b/stories/jetbrains_teamcity_vulnerabilities.yml index 99603ed663..80046e8aca 100644 --- a/stories/jetbrains_teamcity_vulnerabilities.yml +++ b/stories/jetbrains_teamcity_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 3cd841e8-2f64-45e8-b148-7767255db111 version: 1 date: '2024-03-04' author: Michael Haag, Splunk +status: production description: This story provides a high-level overview of JetBrains TeamCity vulnerabilities and how to detect and respond to them using Splunk. narrative: JetBrains TeamCity is a continuous integration and deployment server that allows developers to automate the process of building, testing, and deploying code. It is a popular tool used by many organizations to streamline their development and deployment processes. However, like any software, JetBrains TeamCity is not immune to vulnerabilities. references: diff --git a/stories/juniper_junos_remote_code_execution.yml b/stories/juniper_junos_remote_code_execution.yml index 5f4e0be4cc..28138bd251 100644 --- a/stories/juniper_junos_remote_code_execution.yml +++ b/stories/juniper_junos_remote_code_execution.yml @@ -3,6 +3,7 @@ id: 3fcef843-c97e-4cf3-a72f-749be480cee3 version: 1 date: '2023-08-29' author: Michael Haag, Splunk +status: production description: Juniper Networks has resolved multiple critical vulnerabilities in the J-Web component of Junos OS on SRX and EX Series devices. These vulnerabilities, when chained together, could allow an unauthenticated, network-based attacker to remotely execute code on the devices. The vulnerabilities affect all versions of Junos OS on SRX and EX Series, but specific fixes have been released to address each vulnerability. Juniper Networks recommends applying the necessary fixes to mitigate potential remote code execution threats. As a workaround, users can disable J-Web or limit access to only trusted hosts. Proof-of-concept (PoC) exploit code has been released, demonstrating the severity of these flaws and the urgency to apply the fixes. narrative: Juniper Networks, a networking hardware company, has released an "out-of-cycle" security update to address multiple flaws in the J-Web component of Junos OS that could be combined to achieve remote code execution on susceptible installations. The flaws have a cumulative CVSS rating of 9.8, making them critical in severity. They affect all versions of Junos OS on SRX and EX Series. The J-Web interface allows users to configure, manage, and monitor Junos OS devices. The vulnerabilities include two PHP external variable modification vulnerabilities (CVE-2023-36844 and CVE-2023-36845) and two missing authentications for critical function vulnerabilities (CVE-2023-36846 and CVE-2023-36847). These vulnerabilities could allow an unauthenticated, network-based attacker to control certain important environment variables, cause limited impact to the file system integrity, or upload arbitrary files via J-Web without any authentication. diff --git a/stories/kubernetes_scanning_activity.yml b/stories/kubernetes_scanning_activity.yml index 513e47012d..7c58c7452a 100644 --- a/stories/kubernetes_scanning_activity.yml +++ b/stories/kubernetes_scanning_activity.yml @@ -3,6 +3,7 @@ id: a9ef59cf-e981-4e66-9eef-bb049f695c09 version: 1 date: '2020-04-15' author: Rod Soto, Splunk +status: production description: This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. diff --git a/stories/kubernetes_security.yml b/stories/kubernetes_security.yml index 06cf7ad5da..d22d14e2dc 100644 --- a/stories/kubernetes_security.yml +++ b/stories/kubernetes_security.yml @@ -3,6 +3,7 @@ id: 77006b3a-306c-4e32-afd5-30b6e40c1c41 version: 1 date: '2023-12-06' author: 'Patrick Bareiss' +status: production description: Kubernetes, as a container orchestration platform, faces unique security challenges. This story explores various tactics and techniques adversaries use to exploit Kubernetes environments, including attacking the control plane, exploiting misconfigurations, and compromising containerized applications. narrative: diff --git a/stories/kubernetes_sensitive_object_access_activity.yml b/stories/kubernetes_sensitive_object_access_activity.yml index 25f8925529..156b0a374a 100644 --- a/stories/kubernetes_sensitive_object_access_activity.yml +++ b/stories/kubernetes_sensitive_object_access_activity.yml @@ -3,6 +3,7 @@ id: c7d4dbf0-a171-4eaf-8444-4f40392e4f92 version: 1 date: '2020-05-20' author: Rod Soto, Splunk +status: production description: This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. diff --git a/stories/linux_living_off_the_land.yml b/stories/linux_living_off_the_land.yml index 168a050fe4..acecbea633 100644 --- a/stories/linux_living_off_the_land.yml +++ b/stories/linux_living_off_the_land.yml @@ -3,6 +3,7 @@ id: e405a2d7-dc8e-4227-8e9d-f60267b8c0cd version: 1 date: '2022-07-27' author: Michael Haag, Splunk +status: production description: Linux Living Off The Land consists of binaries that may be used to bypass local security restrictions within misconfigured systems. narrative: Similar to Windows LOLBAS project, the GTFOBins project focuses solely on Unix binaries that may be abused in multiple categories including Reverse Shell, File Upload, File Download and much more. These binaries are native to the operating system and the functionality is typically native. The behaviors are typically not malicious by default or vulnerable, but these are built in functionality of the applications. diff --git a/stories/linux_persistence_techniques.yml b/stories/linux_persistence_techniques.yml index 689adb4398..51db20dc85 100644 --- a/stories/linux_persistence_techniques.yml +++ b/stories/linux_persistence_techniques.yml @@ -3,6 +3,7 @@ id: e40d13e5-d38b-457e-af2a-e8e6a2f2b516 version: 1 date: '2021-12-17' author: Teoderick Contreras, Splunk +status: production description: Monitor for activities and techniques associated with maintaining persistence on a Linux system--a sign that an adversary may have compromised your environment. narrative: Maintaining persistence is one of the first steps taken by attackers after diff --git a/stories/linux_post_exploitation.yml b/stories/linux_post_exploitation.yml index 8282d7c9aa..9054a00230 100644 --- a/stories/linux_post_exploitation.yml +++ b/stories/linux_post_exploitation.yml @@ -3,6 +3,7 @@ id: d310ccfe-5477-11ec-ad05-acde48001122 version: 1 date: '2021-12-03' author: Rod Soto +status: production description: This analytic story identifies popular Linux post exploitation tools such as autoSUID, LinEnum, LinPEAS, Linux Exploit Suggesters, MimiPenguin. narrative: These tools allow operators find possible exploits or paths for privilege escalation based on SUID binaries, user permissions, kernel version and distro version. references: diff --git a/stories/linux_privilege_escalation.yml b/stories/linux_privilege_escalation.yml index 6f05f0104b..a8303efda3 100644 --- a/stories/linux_privilege_escalation.yml +++ b/stories/linux_privilege_escalation.yml @@ -3,6 +3,7 @@ id: b9879c24-670a-44c0-895e-98cdb7d0e848 version: 1 date: '2021-12-17' author: Teoderick Contreras, Splunk +status: production description: Monitor for and investigate activities that may be associated with a Linux privilege-escalation attack, including unusual processes running on endpoints, schedule task, services, setuid, root execution and more. diff --git a/stories/linux_rootkit.yml b/stories/linux_rootkit.yml index fba28ae4af..5f54a85eef 100644 --- a/stories/linux_rootkit.yml +++ b/stories/linux_rootkit.yml @@ -3,6 +3,7 @@ id: e30f4054-ac08-4999-b8bc-5cc46886c18d version: 1 date: '2022-07-27' author: Michael Haag, Splunk +status: production description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. Rootkits are programs that hide the existence of malware by intercepting/hooking and modifying operating system API calls that supply system information. narrative: Rootkits or rootkit enabling functionality may reside at the user or kernel level in the operating system or lower, to include a hypervisor, Master Boot Record, or System Firmware. Rootkits have been seen for Windows, Linux, and Mac OS X systems. Linux rootkits may not standout as much as a Windows rootkit, therefore understanding what kernel modules are installed today and monitoring for new is important. As with any rootkit, it may blend in using a common kernel name or variation of legitimate names. diff --git a/stories/living_off_the_land.yml b/stories/living_off_the_land.yml index 01672b577a..9661923ab3 100644 --- a/stories/living_off_the_land.yml +++ b/stories/living_off_the_land.yml @@ -3,6 +3,7 @@ id: 6f7982e2-900b-11ec-a54a-acde48001122 version: 2 date: '2022-03-16' author: Lou Stella, Splunk +status: production description: Leverage analytics that allow you to identify the presence of an adversary leveraging native applications within your environment. narrative: Living Off The Land refers to an adversary methodology of using native applications already installed on the target operating system to achieve their objective. Native utilities provide the adversary with reduced chances of detection by antivirus software or EDR tools. This allows the adversary to blend in with native process behavior. references: diff --git a/stories/local_privilege_escalation_with_krbrelayup.yml b/stories/local_privilege_escalation_with_krbrelayup.yml index 668be242c0..0ff950dde9 100644 --- a/stories/local_privilege_escalation_with_krbrelayup.yml +++ b/stories/local_privilege_escalation_with_krbrelayup.yml @@ -3,6 +3,7 @@ id: 765790f0-2f8f-4048-8321-fd1928ec2546 version: 1 date: '2022-04-28' author: Michael Haag, Mauricio Velazco, Splunk +status: production description: KrbRelayUp is a tool that allows local privilege escalation from low-priviliged domain user to local system on domain-joined computers. narrative: In October 2021, James Forshaw from Googles Project Zero released a research blog post titled `Using Kerberos for Authentication Relay Attacks`. This research introduced, for the first time, ways to make Windows authenticate to a different Service Principal Name (SPN) than what would normally be derived from the hostname the client is connecting to. diff --git a/stories/lockbit_ransomware.yml b/stories/lockbit_ransomware.yml index 72821f3cde..cef23f6903 100644 --- a/stories/lockbit_ransomware.yml +++ b/stories/lockbit_ransomware.yml @@ -3,6 +3,7 @@ id: 67e5b98d-16d6-46a6-8d00-070a3d1a5cfc version: 1 date: '2023-01-16' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the LockBit ransomware, including looking for file writes (file encryption and ransomware notes), deleting services, terminating processes, registry key modification and more. diff --git a/stories/log4shell_cve_2021_44228.yml b/stories/log4shell_cve_2021_44228.yml index 60b52778d9..eed0cdb2fa 100644 --- a/stories/log4shell_cve_2021_44228.yml +++ b/stories/log4shell_cve_2021_44228.yml @@ -3,6 +3,7 @@ id: b4453928-5a98-11ec-afcd-8de10b48fc52 version: 1 date: '2021-12-11' author: Jose Hernandez +status: production description: Log4Shell or CVE-2021-44228 is a Remote Code Execution (RCE) vulnerability in the Apache Log4j library, a widely used and ubiquitous logging framework for Java. The vulnerability allows an attacker who can control log messages to execute diff --git a/stories/lumma_stealer.yml b/stories/lumma_stealer.yml index eb0a23e343..09dfbad898 100644 --- a/stories/lumma_stealer.yml +++ b/stories/lumma_stealer.yml @@ -3,6 +3,7 @@ id: 6c8f76f6-1272-4c0e-afbd-5a9f58947fa5 version: 1 date: '2024-11-13' author: Michael Haag, Nasreddine Bencherchali, Splunk +status: production description: Lumma Stealer is a sophisticated information-stealing malware that has been operating as a Malware-as-a-Service (MaaS) platform since 2022. Recent campaigns in 2024 have shown increased sophistication in distribution methods, particularly through fake CAPTCHA verification pages, cracked game downloads, and phishing emails targeting GitHub users. The malware is designed to steal sensitive information including browser credentials, cryptocurrency wallet data, and password manager archives. narrative: As of late 2024, Lumma Stealer has emerged as one of the most prominent information stealers in the threat landscape, employing increasingly sophisticated distribution techniques. The malware's primary infection vector involves a deceptive CAPTCHA campaign where attackers create convincing phishing sites featuring fake Google CAPTCHA verification pages. When users interact with these pages by clicking "I'm not a robot," malicious code is automatically copied to their clipboard. Users are then socially engineered to paste this code into the Windows Run dialog (Win+R), triggering PowerShell commands that download and execute the Lumma Stealer payload. / diff --git a/stories/malicious_powershell.yml b/stories/malicious_powershell.yml index 402f1ceb0e..54fa231415 100644 --- a/stories/malicious_powershell.yml +++ b/stories/malicious_powershell.yml @@ -3,6 +3,7 @@ id: 2c8ff66e-0b57-42af-8ad7-912438a403fc version: 5 date: '2017-08-23' author: David Dorsey, Splunk +status: production description: Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate diff --git a/stories/masquerading___rename_system_utilities.yml b/stories/masquerading___rename_system_utilities.yml index 53dfe57ce1..245b7f5747 100644 --- a/stories/masquerading___rename_system_utilities.yml +++ b/stories/masquerading___rename_system_utilities.yml @@ -3,6 +3,7 @@ id: f0258af4-a6ae-11eb-b3c2-acde48001122 version: 1 date: '2021-04-26' author: Michael Haag, Splunk +status: production description: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. narrative: 'Security monitoring and control mechanisms may be in place for system diff --git a/stories/meduza_stealer.yml b/stories/meduza_stealer.yml index b634ad526b..1def57797a 100644 --- a/stories/meduza_stealer.yml +++ b/stories/meduza_stealer.yml @@ -3,6 +3,7 @@ id: c3328a8a-565b-435e-b9cc-5410e34b821b version: 1 date: '2024-11-28' author: Teoderick Contreras, Splunk +status: production description: Meduza Stealer is a sophisticated and rapidly evolving malware designed to extract sensitive data from compromised systems. Detected primarily through anomalous network activities, its behavior often involves outbound connections to command-and-control (C2) servers, encrypting and exfiltrating stolen credentials, financial data, and other personal information. Analysts have identified Meduza Stealer leveraging advanced evasion techniques, including dynamic obfuscation, anti-analysis methods, and the use of polymorphic code to bypass detection by traditional antivirus systems. Once deployed, it scans for browser-stored passwords, cryptocurrency wallets, and keylogging opportunities, potentially exploiting unpatched software vulnerabilities. Security tools flag it through heuristic detections, anomalous process executions, or unusual registry modifications. Meduza Stealer's malicious payloads are often distributed via phishing emails, malicious attachments, or trojanized software downloads. Effective defense requires a multi-layered security approach, regular software updates, and employee training to minimize risks posed by this potent cyber threat. narrative: Meduza Stealer is a relatively new entrant in the cybercrime landscape, first identified in early 2023. It quickly gained notoriety among threat actors for its effectiveness and adaptability. Designed as a data-stealing malware, it targets sensitive information such as login credentials, financial details, and cryptocurrency wallets. Its developers market it on underground forums, often touting its advanced features like dynamic obfuscation and anti-analysis mechanisms, making it difficult for traditional antivirus solutions to detect. Meduza Stealer typically spreads through phishing campaigns, malicious email attachments, and trojanized software downloads. Once executed, it infiltrates systems silently, harvesting data from web browsers, password managers, and clipboard activities. It then transmits the stolen information to its command-and-control (C2) servers using encrypted communication channels, further complicating detection and analysis. Security researchers have noted its use of polymorphic code, enabling it to modify its structure with each infection to evade heuristic and signature-based detection methods.Meduza Stealer highlights a growing trend in sophisticated, modular malware that appeals to cybercriminals due to its efficiency and ease of deployment. Effective mitigation strategies include adopting behavioral analysis tools, implementing robust endpoint security solutions, and maintaining user awareness through regular cybersecurity training. Proactive measures are essential to combat the escalating threat posed by this advanced malware. references: diff --git a/stories/metasploit.yml b/stories/metasploit.yml index 4d5ccde433..ce914f9248 100644 --- a/stories/metasploit.yml +++ b/stories/metasploit.yml @@ -3,6 +3,7 @@ id: c149b694-bd08-4535-88d3-1f288a66313f version: 1 date: '2022-11-21' author: Michael Haag, Splunk +status: production description: The following analytic story highlights content related directly to MetaSploit, which may be default configurations attributed to MetaSploit or behaviors of known knowns that are related. narrative: 'The Metasploit framework is a very powerful tool which can be used by cybercriminals as well as ethical hackers to probe systematic vulnerabilities on networks and servers. Because it is an open-source framework, it can be easily customized and used with most operating systems. diff --git a/stories/meterpreter.yml b/stories/meterpreter.yml index c25790918e..b1fffe827c 100644 --- a/stories/meterpreter.yml +++ b/stories/meterpreter.yml @@ -3,6 +3,7 @@ id: d5f8e298-c85a-11eb-9fea-acde48001122 version: 1 date: '2021-06-08' author: Michael Hart +status: production description: Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions. diff --git a/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml b/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml index 1aa4aa9703..fdf5a657dc 100644 --- a/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml +++ b/stories/microsoft_mshtml_remote_code_execution_cve_2021_40444.yml @@ -3,6 +3,7 @@ id: 4ad4253e-10ca-11ec-8235-acde48001122 version: 1 date: '2021-09-08' author: Michael Haag, Splunk +status: production description: CVE-2021-40444 is a remote code execution vulnerability in MSHTML, recently used to delivery targeted spearphishing documents. narrative: "Microsoft is aware of targeted attacks that attempt to exploit this vulnerability, diff --git a/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml b/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml index 7e0a978864..47ca482750 100644 --- a/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml +++ b/stories/microsoft_sharepoint_server_elevation_of_privilege_cve_2023_29357.yml @@ -3,6 +3,7 @@ id: 95ae800d-485e-47f7-866e-8be281aa497d version: 1 date: '2023-09-27' author: Michael Haag, Gowthamaraj Rajendran, Splunk +status: production description: This analytic story focuses on the Microsoft SharePoint Server vulnerability CVE-2023-29357, which allows for an elevation of privilege due to improper handling of authentication tokens. Exploitation of this vulnerability could lead to a serious security breach where an attacker might gain privileged access to the SharePoint environment, potentially leading to data theft or other malicious activities. This story is associated with the detection `Microsoft SharePoint Server Elevation of Privilege` which identifies attempts to exploit this vulnerability. narrative: Microsoft SharePoint Server is a widely used web-based collaborative platform. The vulnerability CVE-2023-29357 exposes a flaw in the handling of authentication tokens, allowing an attacker to escalate privileges and gain unauthorized access to the SharePoint environment. This could potentially lead to data theft, unauthorized system modifications, or other malicious activities. Organizations are urged to apply immediate patches and conduct regular system assessments to ensure security. references: diff --git a/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml b/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml index cff32f2ea0..e158f7399c 100644 --- a/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml +++ b/stories/microsoft_support_diagnostic_tool_vulnerability_cve_2022_30190.yml @@ -3,6 +3,7 @@ id: 2a60a99e-c93a-4036-af70-768fac838019 version: 1 date: '2022-05-31' author: 'Michael Haag, Teoderick Contreras, Splunk' +status: production description: On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability. narrative: A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user''s rights. diff --git a/stories/monitor_for_updates.yml b/stories/monitor_for_updates.yml index 7dbddf4806..4192362390 100644 --- a/stories/monitor_for_updates.yml +++ b/stories/monitor_for_updates.yml @@ -3,6 +3,7 @@ id: 9ef8d677-7b52-4213-a038-99cfc7acc2d8 version: 1 date: '2017-09-15' author: Rico Valdez, Splunk +status: production description: Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches. diff --git a/stories/moonpeak.yml b/stories/moonpeak.yml index 01e6ffb4b2..dc35f041f2 100644 --- a/stories/moonpeak.yml +++ b/stories/moonpeak.yml @@ -3,6 +3,7 @@ id: b32c2bb4-ddb0-402f-a05d-9eae0ef4007a version: 1 date: '2024-08-21' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities linked to the MoonPeak malware, particularly focusing on command-and-control (C2) communications, data collection, file execution, and persistence mechanisms. Monitor network traffic for connections to known malicious IP addresses or domains associated with North Korean APT groups. Additionally, identify unexpected registry modifications and the presence of unauthorized binaries to uncover potential MoonPeak infections. narrative: The MoonPeak malware is a sophisticated cyber threat attributed to North Korean advanced persistent threat (APT) groups. This malware is designed to infiltrate targeted systems, establish persistence, and communicate with command-and-control (C2) servers, enabling remote attackers to execute malicious activities. MoonPeak often evades detection by leveraging encryption and obfuscation techniques, making it challenging for traditional security measures to identify its presence. It primarily targets government entities, critical infrastructure, and organizations of strategic interest, with the ultimate goal of espionage, data exfiltration, and disruption of operations. Its evolving tactics highlight the growing complexity of nation-state cyber operations. references: diff --git a/stories/moveit_transfer_authentication_bypass.yml b/stories/moveit_transfer_authentication_bypass.yml index d2dcbbd367..0e250786c9 100644 --- a/stories/moveit_transfer_authentication_bypass.yml +++ b/stories/moveit_transfer_authentication_bypass.yml @@ -3,6 +3,7 @@ id: b4c0b91f-eee5-47fd-ab02-11f68a9c0858 version: 1 date: '2024-06-28' author: Michael Haag, Splunk +status: production description: 'This analytic story addresses the critical authentication bypass vulnerability (CVE-2024-5806) in Progress MOVEit Transfer. The vulnerability allows attackers to impersonate any valid user on the system without proper credentials, potentially leading to unauthorized access, data theft, and system compromise. This story includes detections for key indicators of exploitation attempts, helping security teams identify and respond to potential attacks leveraging this vulnerability.' narrative: 'In June 2024, a severe authentication bypass vulnerability (CVE-2024-5806) was discovered in Progress MOVEit Transfer, a widely used file transfer solution. This vulnerability allows attackers to bypass authentication and impersonate any valid user on the system, even without prior access or the ability to upload files. diff --git a/stories/moveit_transfer_critical_vulnerability.yml b/stories/moveit_transfer_critical_vulnerability.yml index ba280b2fc9..a75ac0abb8 100644 --- a/stories/moveit_transfer_critical_vulnerability.yml +++ b/stories/moveit_transfer_critical_vulnerability.yml @@ -3,6 +3,7 @@ id: e8c05f9b-6ad4-45ac-8f5d-ff044da417c9 version: 1 date: '2023-06-01' author: Michael Haag, Splunk +status: production description: A critical zero-day vulnerability has been discovered in the MOVEit Transfer file transfer software, widely used by businesses and developers worldwide. The vulnerability has been exploited by unknown threat actors to perform mass data theft from organizations. Progress Software Corporation, the developer of MOVEit, has issued a security advisory urging customers to take immediate action to protect their environments. They recommend blocking external traffic to ports 80 and 445 on the MOVEit server, and to check the c:\MOVEitTransfer\wwwroot\ folder for unusual files. A patch is currently released. narrative: 'Hackers have been actively exploiting a zero-day vulnerability found in the MOVEit Transfer software. This software, developed by Progress Software Corporation, a US-based company and its subsidiary Ipswitch, is a managed file transfer solution. It is used by thousands of organizations worldwide, including Chase, Disney, GEICO, and MLB, and by 3.5 million developers. The software allows for secure file transfers between business partners and customers using SFTP, SCP, and HTTP-based uploads. diff --git a/stories/netsh_abuse.yml b/stories/netsh_abuse.yml index a0b592b345..128d4a00f0 100644 --- a/stories/netsh_abuse.yml +++ b/stories/netsh_abuse.yml @@ -3,6 +3,7 @@ id: 2b1800dd-92f9-47ec-a981-fdf1351e5f65 version: 1 date: '2017-01-05' author: Bhavin Patel, Splunk +status: production description: Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. diff --git a/stories/network_discovery.yml b/stories/network_discovery.yml index 72008e8b8b..7d260e5bd3 100644 --- a/stories/network_discovery.yml +++ b/stories/network_discovery.yml @@ -3,6 +3,7 @@ id: af228995-f182-49d7-90b3-2a732944f00f version: 1 date: '2022-02-14' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the network discovery, including looking for network configuration, settings such as IP, MAC address, firewall settings and many more. diff --git a/stories/njrat.yml b/stories/njrat.yml index 325156be0d..2f52c8e678 100644 --- a/stories/njrat.yml +++ b/stories/njrat.yml @@ -3,6 +3,7 @@ id: f6d52454-6cf3-4759-9627-5868a3e2b2b1 version: 2 date: '2023-09-07' author: Teoderick Contreras, Splunk +status: production description: NjRat is a notorious remote access trojan (RAT) predominantly wielded by malicious operators to infiltrate and wield remote control over compromised systems. This analytical story harnesses targeted search methodologies to uncover and investigate activities that could be indicative of NjRAT's presence. These activities include tracking file write operations for dropped files, scrutinizing registry modifications aimed at establishing persistence mechanisms, diff --git a/stories/nobelium_group.yml b/stories/nobelium_group.yml index 383a4590e8..f064d0c4f3 100644 --- a/stories/nobelium_group.yml +++ b/stories/nobelium_group.yml @@ -3,6 +3,7 @@ id: 758196b5-2e21-424f-a50c-6e421ce926c2 version: 3 date: '2020-12-14' author: Patrick Bareiss, Michael Haag, Mauricio Velazco, Splunk +status: production description: NOBELIUM, also known as APT29, The Dukes, Cozy Bear, CozyDuke, Blue Kitsune, and Midnight Blizzard, is a sophisticated nation-state threat actor, reportedly associated with Russian intelligence. Active since at least 2008, this group primarily targets government networks in Europe and NATO member countries, along with research institutes and think tanks. Their operations typically involve advanced persistent threats (APT), leveraging techniques like spear-phishing, malware deployment, and long-term network compromise to achieve information theft and espionage. Notably, APT29 has been implicated in significant cyber espionage incidents, including the 2015 breach of the Pentagon's Joint Staff email system and attacks on the Democratic National Committee in 2016. Their advanced tactics and persistent approach underscore the serious nature of threats posed by this group to global cybersecurity. narrative: This Analytic Story groups detections designed to trigger on a comprehensive range of Tactics, Techniques, and Procedures (TTPs) leveraged by the NOBELIUM Group, with a focus on their methods as observed in well-known public breaches. references: diff --git a/stories/office_365_account_takeover.yml b/stories/office_365_account_takeover.yml index c48d646683..5c7c84160a 100644 --- a/stories/office_365_account_takeover.yml +++ b/stories/office_365_account_takeover.yml @@ -3,6 +3,7 @@ id: 7dcea963-af44-4db7-a5b9-fd2b543d9bc9 version: 1 date: '2023-10-17' author: Mauricio Velazco, Patrick Bareiss, Splunk +status: production description: Monitor for activities and anomalies indicative of initial access techniques within Office 365 environments. narrative: Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. O365's centralized storage of sensitive data and widespread adoption make it a key asset, yet also a prime target for security threats. The "Office 365 Account Takeover" analytic story focuses on the initial techniques attackers employ to breach or compromise these identities. Initial access, in this context, consists of techniques that use various entry vectors to gain their initial foothold . Identifying these early indicators is crucial for establishing the first line of defense against unauthorized access and potential security incidents within O365 environments. references: diff --git a/stories/office_365_collection_techniques.yml b/stories/office_365_collection_techniques.yml index a3a1141b14..b9fae2a9a4 100644 --- a/stories/office_365_collection_techniques.yml +++ b/stories/office_365_collection_techniques.yml @@ -3,6 +3,7 @@ id: d90f2b80-f675-4717-90af-12fc8c438ae8 version: 1 date: '2024-02-12' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and anomalies indicative of potential collection techniques within Office 365 environments. narrative: Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. O365's centralized storage of sensitive data and widespread adoption make it a key asset, yet also a prime target for security threats. The 'Office 365 Collection Techniques' analytic story focuses on the strategies and methodologies that attackers might use to gather critical information within the O365 ecosystem. 'Collection' in this context refers to the various techniques adversaries deploy to accumulate data that are essential for advancing their malicious objectives. This could include tactics such as intercepting communications, accessing sensitive documents, or extracting data from collaboration tools and email platforms. By identifying and monitoring these collection activities, organizations can more effectively spot and counteract attempts to illicitly gather information references: [] diff --git a/stories/office_365_persistence_mechanisms.yml b/stories/office_365_persistence_mechanisms.yml index 7d0d386339..e49db88ddb 100644 --- a/stories/office_365_persistence_mechanisms.yml +++ b/stories/office_365_persistence_mechanisms.yml @@ -3,6 +3,7 @@ id: d230a106-0475-4605-a8d8-abaf4c31ced7 version: 1 date: '2023-10-17' author: Mauricio Velazco, Patrick Bareiss, Splunk +status: production description: Monitor for activities and anomalies indicative of potential persistence techniques within Office 365 environments. narrative: Office 365 (O365) is Microsoft's cloud-based suite of productivity tools, encompassing email, collaboration platforms, and office applications, all integrated with Azure Active Directory for identity and access management. O365's centralized storage of sensitive data and widespread adoption make it a key asset, yet also a prime target for security threats. The "Office 365 Persistence Mechanisms" analytic story delves into the tactics and techniques attackers employ to maintain prolonged unauthorized access within the O365 environment. Persistence in this context refers to methods used by adversaries to keep their foothold after an initial compromise. This can involve actions like modifying mailbox rules, establishing covert forwarding rules, manipulating application permissions. By monitoring signs of persistence, organizations can effectively detect and respond to stealthy threats, thereby protecting their O365 assets and data. references: diff --git a/stories/okta_account_takeover.yml b/stories/okta_account_takeover.yml index 2447c01a8e..62bcd47abb 100644 --- a/stories/okta_account_takeover.yml +++ b/stories/okta_account_takeover.yml @@ -3,6 +3,7 @@ id: 83a48657-8153-4580-adba-eb0b3a83244e version: 1 date: '2024-03-06' author: Michael Haag, Mauricio Velazco, Bhavin Patel, Splunk +status: production description: The Okta Account Takeover analytic story encompasses a comprehensive suite of detections aimed at identifying unauthorized access and potential takeover attempts of Okta accounts. This collection leverages diverse data points and behavioral analytics to safeguard user identities and access within cloud environments. Monitor for activities and techniques associated with Account Takeover attacks against Okta tenants. narrative: Okta is a cloud-based identity management service that provides organizations with a secure way to manage user access to various applications and services. It enables single sign-on (SSO), multi-factor authentication (MFA), lifecycle management, and more, helping organizations streamline the user authentication process. Account Takeover (ATO) is an attack whereby cybercriminals gain unauthorized access to online accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, access sensitive applications, or use any stolen information to access further accounts within the organization. This analytic story groups detections that can help security operations teams identify the potential compromise of Okta accounts. references: diff --git a/stories/okta_mfa_exhaustion.yml b/stories/okta_mfa_exhaustion.yml index ef6de41294..4bef5350dd 100644 --- a/stories/okta_mfa_exhaustion.yml +++ b/stories/okta_mfa_exhaustion.yml @@ -3,6 +3,7 @@ id: 7c6e508d-4b4d-42c8-82de-5ff4ea3b0cb3 version: 1 date: '2022-09-27' author: Michael Haag, Splunk +status: production description: A social engineering technique called 'MFA Fatigue', aka 'MFA push spam' or 'MFA Exhaustion', is growing more popular with threat actors as it does not require malware or phishing infrastructure and has proven to be successful in attacks. narrative: An MFA Fatigue attack is when a threat actor runs a script that attempts to log in with stolen credentials over and over, causing what feels like an endless stream of MFA push requests to be sent to the account's owner's mobile device. The goal is to keep this up, day and night, to break down the target's cybersecurity posture and inflict a sense of "fatigue" regarding these MFA prompts. diff --git a/stories/openssl_cve_2022_3602.yml b/stories/openssl_cve_2022_3602.yml index 8098e9f587..a5bab157e7 100644 --- a/stories/openssl_cve_2022_3602.yml +++ b/stories/openssl_cve_2022_3602.yml @@ -3,6 +3,7 @@ id: 491e00c9-998b-4c64-91bb-d8f9c79c1f4c version: 1 date: '2022-11-02' author: Michael Haag, splunk +status: production description: OpenSSL recently disclosed two vulnerabilities CVE-2022-3602 and CVE-2022-3786. CVE-2022-3602 is a X.509 Email Address 4-byte Buffer Overflow where puny code is utilized. This only affects OpenSSL 3.0.0 - 3.0.6. narrative: A buffer overrun can be triggered in X.509 certificate verification, specifically in name constraint checking. Note that this occurs after diff --git a/stories/orangeworm_attack_group.yml b/stories/orangeworm_attack_group.yml index a8b1b54459..0e621be260 100644 --- a/stories/orangeworm_attack_group.yml +++ b/stories/orangeworm_attack_group.yml @@ -3,6 +3,7 @@ id: bb9f5ed2-916e-4364-bb6d-97c370efcf52 version: 2 date: '2020-01-22' author: David Dorsey, Splunk +status: production description: Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative: 'In May of 2018, the attack group Orangeworm was implicated for installing diff --git a/stories/outlook_rce_cve_2024_21378.yml b/stories/outlook_rce_cve_2024_21378.yml index 5313d30a96..7c44e285fc 100644 --- a/stories/outlook_rce_cve_2024_21378.yml +++ b/stories/outlook_rce_cve_2024_21378.yml @@ -3,6 +3,7 @@ id: d889fcf2-0265-4b44-b29f-4ec063c21880 version: 1 date: '2024-03-20' author: Michael Haag, Teoderick Contreras, Splunk +status: production description: CVE-2024-21378 exposes a critical vulnerability in Microsoft Outlook, allowing for authenticated remote code execution (RCE) through the manipulation of synced form objects. Discovered by NetSPI in 2023, this vulnerability capitalizes on the unchanged syncing capability of form objects, despite previous patches aimed at securing script code in custom forms. This technical blog delves into the discovery and weaponization of CVE-2024-21378, enhancing the Outlook penetration testing tool, Ruler, to exploit this flaw. A forthcoming pull request will provide a proof-of-concept code, aiding organizations in mitigating this security risk. narrative: CVE-2024-21378 is a weakness in Microsoft Outlook that lets hackers execute code remotely if they can authenticate themselves. Researchers at NetSPI found this issue in 2023. The problem started with a technique from 2017 by Etienne Stalmans at SensePost, who found a way to run code using VBScript in Outlook forms. Microsoft tried to fix it by only allowing approved script code in custom forms, but they didn't fix the main issue, which is how these forms sync. To exploit this vulnerability, you need to know how Outlook forms sync, using something called MAPI, and how they use certain properties and attachments when they're set up for the first time. Hackers can mess with these properties and attachments to run their own code. They do this by tricking the form's setup process, changing registry keys and files to get past Outlook's security. To show how this could be done, researchers modified Ruler, a tool for testing Outlook's security. They changed it so it could sync a harmful form with the right properties to run a specific type of file, a COM compliant native DLL. This not only showed that CVE-2024-21378 could be exploited but also that it could affect a lot of companies since so many use Microsoft Outlook. The discovery and the way it was exploited remind us that we always need to be on the lookout for security risks and work hard to protect against them. The cybersecurity world is always watching for the next big threat that could put our digital world at risk. As companies rush to fix this issue, it's a reminder of how important it is to stay ahead of these threats. references: diff --git a/stories/papercut_mf_ng_vulnerability.yml b/stories/papercut_mf_ng_vulnerability.yml index 5ff3d05d4d..5f2c746e72 100644 --- a/stories/papercut_mf_ng_vulnerability.yml +++ b/stories/papercut_mf_ng_vulnerability.yml @@ -3,6 +3,7 @@ id: 2493d270-5665-4fb4-99c7-8f886f260676 version: 1 date: '2023-05-15' author: Michael Haag, Splunk +status: production description: The FBI has issued a joint advisory concerning the exploitation of a PaperCut MF/NG vulnerability (CVE-2023-27350) by malicious actors, which began in mid-April 2023 and has been ongoing. In early May 2023, a group identifying themselves as the Bl00dy Ransomware Gang targeted vulnerable PaperCut servers within the Education Facilities Subsector. The advisory provides information on detecting exploitation attempts and shares known indicators of compromise (IOCs) associated with the group's activities. narrative: 'PaperCut MF/NG versions 19 and older have reached their end-of-life, as documented on the End of Life Policy page. Customers using these older versions are advised to purchase an updated license online for PaperCut NG or through their PaperCut Partner for PaperCut MF. For users with a currently supported version (version 20 or later), they can upgrade to any maintenance release version they are licensed for. If upgrading to a security patch is not possible, there are alternative options to enhance security. Users can lock down network access to their server(s) by blocking all inbound traffic from external IPs to the web management port (port 9191 and 9192 by default) and blocking all inbound traffic to the web management portal on the firewall to the server. Additionally, users can apply "Allow list" restrictions under Options > Advanced > Security > Allowed site server IP addresses, setting this to only allow the IP addresses of verified Site Servers on their network. diff --git a/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.yml b/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.yml index f8ac2cae36..1b8fe735fe 100644 --- a/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.yml +++ b/stories/petitpotam_ntlm_relay_on_active_directory_certificate_services.yml @@ -3,6 +3,7 @@ id: 97aecafc-0a68-11ec-962f-acde48001122 version: 1 date: '2021-08-31' author: Michael Haag, Mauricio Velazco, Splunk +status: production description: PetitPotam (CVE-2021-36942,) is a vulnerablity identified in Microsofts EFSRPC Protocol that can allow an unauthenticated account to escalate privileges to domain administrator given the right circumstances. diff --git a/stories/phemedrone_stealer.yml b/stories/phemedrone_stealer.yml index 495551ddc8..2ae36951b3 100644 --- a/stories/phemedrone_stealer.yml +++ b/stories/phemedrone_stealer.yml @@ -3,6 +3,7 @@ id: 386f64dd-657b-4dcf-8eb3-5e297d30924c version: 2 date: '2024-01-24' author: Teoderick Contreras, Splunk +status: production description: Phemedrone Stealer is a potent data-stealing malware designed to infiltrate systems discreetly, primarily targeting sensitive user information. Operating with a stealthy modus operandi, it covertly collects and exfiltrates critical data such as login credentials, personal details, and financial information. diff --git a/stories/plugx.yml b/stories/plugx.yml index f46c0ea342..fa2824c6ad 100644 --- a/stories/plugx.yml +++ b/stories/plugx.yml @@ -3,6 +3,7 @@ id: a2c94c99-b93b-4bc7-a749-e2198743d0d6 version: 2 date: '2023-10-12' author: Teoderick Contreras, Splunk +status: production description: PlugX, also referred to as "PlugX RAT" or "Kaba," is a highly sophisticated remote access Trojan (RAT) discovered in 2012. This malware is notorious for its involvement in targeted cyberattacks, primarily driven by cyber espionage objectives. PlugX provides attackers with comprehensive remote control capabilities over compromised systems, diff --git a/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml b/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml index e9564a1575..a64fe677f0 100644 --- a/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml +++ b/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml @@ -3,6 +3,7 @@ id: 988C59C5-0A1C-45B6-A555-0C62276E327E version: 1 date: '2020-01-22' author: iDefense Cyber Espionage Team, iDefense +status: production description: Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative: 'This story was created as a joint effort between iDefense and Splunk. diff --git a/stories/prestige_ransomware.yml b/stories/prestige_ransomware.yml index 3e3fe57945..bd2296488b 100644 --- a/stories/prestige_ransomware.yml +++ b/stories/prestige_ransomware.yml @@ -3,6 +3,7 @@ id: 8b8d8506-b931-450c-b794-f24184ca1deb version: 1 date: '2022-11-30' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Prestige Ransomware narrative: This story addresses Prestige ransomware. This ransomware payload seen by Microsoft diff --git a/stories/printnightmare_cve_2021_34527.yml b/stories/printnightmare_cve_2021_34527.yml index 56a6908367..65728a81c3 100644 --- a/stories/printnightmare_cve_2021_34527.yml +++ b/stories/printnightmare_cve_2021_34527.yml @@ -3,6 +3,7 @@ id: fd79470a-da88-11eb-b803-acde48001122 version: 1 date: '2021-07-01' author: Splunk Threat Research Team +status: production description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. diff --git a/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml b/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml index 28adf6d265..5587506c60 100644 --- a/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml +++ b/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml @@ -3,6 +3,7 @@ id: 6d13121c-90f3-446d-8ac3-27efbbc65218 version: 1 date: '2017-09-11' author: Rico Valdez, Splunk +status: production description: Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. diff --git a/stories/proxynotshell.yml b/stories/proxynotshell.yml index 2aac8530e9..ac8d66c666 100644 --- a/stories/proxynotshell.yml +++ b/stories/proxynotshell.yml @@ -3,6 +3,7 @@ id: 4e3f17e7-9ed7-425d-a05e-b65464945836 version: 1 date: '2022-09-30' author: Michael Haag, Splunk +status: production description: Two new zero day Microsoft Exchange vulnerabilities have been identified actively exploited in the wild - CVE-2022-41040 and CVE-2022-41082. narrative: Microsoft is investigating two reported zero-day vulnerabilities affecting Microsoft Exchange Server 2013, 2016, and 2019. The first vulnerability, identified as CVE-2022-41040, is a Server-Side Request Forgery (SSRF) vulnerability, while the second, identified as CVE-2022-41082, allows remote code execution (RCE) when PowerShell is accessible to the attacker. Originally identified by GTSC monitoring Exchange, some adversary post-exploitation activity was identified and is tagged to this story. references: diff --git a/stories/proxyshell.yml b/stories/proxyshell.yml index 953d003a84..98e629822d 100644 --- a/stories/proxyshell.yml +++ b/stories/proxyshell.yml @@ -3,6 +3,7 @@ id: 413bb68e-04e2-11ec-a835-acde48001122 version: 1 date: '2021-08-24' author: Michael Haag, Teoderick Contreras, Mauricio Velazco, Splunk +status: production description: ProxyShell is a chain of exploits targeting on-premise Microsoft Exchange Server - CVE-2021-34473, CVE-2021-34523, and CVE-2021-31207. narrative: "During Pwn2Own April 2021, a security researcher demonstrated an attack diff --git a/stories/pxa_stealer.yml b/stories/pxa_stealer.yml index 597e80e711..a44ad24c4f 100644 --- a/stories/pxa_stealer.yml +++ b/stories/pxa_stealer.yml @@ -3,6 +3,7 @@ id: 66f64651-e4e0-4d3b-8d7d-41d8e598e4e1 version: 1 date: '2024-11-18' author: Teoderick Contreras, Splunk +status: production description: This following analytic story contains detections related to the PXA Stealer, a malicious software tool designed to covertly extract sensitive information from infected systems. This data-stealing malware targets credentials, personal data, browsing information, and financial information by exploiting system vulnerabilities or tricking users into downloading it via phishing campaigns or malicious links. PXA Stealer often operates stealthily, bypassing security measures and transmitting stolen data to cybercriminals. Its capabilities make it a significant threat to individuals and organizations, emphasizing the need for robust cybersecurity defenses and awareness. narrative: The PXA Stealer initiates its attack in disguise, often concealed within phishing emails or dubious downloads. Once executed, it infiltrates the system undetected, harvesting credentials, financial information, and personal files. Its cunning lies in its ability to evade antivirus software and blend into normal processes. However, its subtle movements leave traces. Unusual system slowdowns, unauthorized login attempts, or increased network activity can indicate its presence. To detect and prevent it, maintain updated antivirus software, enable multi-factor authentication, and avoid clicking on suspicious links or attachments. Vigilance and proactive monitoring are key defenses against this silent intruder. references: diff --git a/stories/qakbot.yml b/stories/qakbot.yml index 48378bed4d..871ee43a36 100644 --- a/stories/qakbot.yml +++ b/stories/qakbot.yml @@ -3,6 +3,7 @@ id: 0c6169b1-f126-4d86-8e4f-f7891007ebc6 version: 2 date: '2022-11-14' author: Teoderick Contreras, Splunk +status: production description: QakBot is a modular banking trojan that has been used primarily by financially-motivated actors since at least 2007. QakBot is continuously maintained and developed and has evolved from an information stealer into a delivery agent for ransomware (ref. MITRE ATT&CK). narrative: QakBot notably has made its way on the CISA top malware list for 2021. QakBot for years has been under continious improvement when it comes to initial access, injection and post-exploitation. Multiple adversaries use QakBot to gain initial access and persist, most notably TA551. The actor(s) behind QakBot possess a modular framework consisting of maldoc builders, signed loaders, and DLLs that produce initially low detection rates at the beginning of the attack, which creates opportunities to deliver additional malware such as Egregor and Cobalt Strike. (ref. Cybersecurity ATT) diff --git a/stories/ransomware.yml b/stories/ransomware.yml index 9ea584be76..99abf2c501 100644 --- a/stories/ransomware.yml +++ b/stories/ransomware.yml @@ -3,6 +3,7 @@ id: cf309d0d-d4aa-4fbb-963d-1e79febd3756 version: 1 date: '2020-02-04' author: David Dorsey, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected diff --git a/stories/ransomware_cloud.yml b/stories/ransomware_cloud.yml index 21bc9adb1e..4f69a6c55e 100644 --- a/stories/ransomware_cloud.yml +++ b/stories/ransomware_cloud.yml @@ -3,6 +3,7 @@ id: f52f6c43-05f8-4b19-a9d3-5b8c56da91c2 version: 1 date: '2020-10-27' author: Rod Soto, David Dorsey, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. diff --git a/stories/redline_stealer.yml b/stories/redline_stealer.yml index 09bf787aca..aa49b2b562 100644 --- a/stories/redline_stealer.yml +++ b/stories/redline_stealer.yml @@ -3,6 +3,7 @@ id: 12e31e8b-671b-4d6e-b362-a682812a71eb version: 1 date: '2023-04-24' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Redline Stealer trojan, including looking for file writes associated with its payload, screencapture, registry modification, persistence diff --git a/stories/remcos.yml b/stories/remcos.yml index d9fcf5c0ba..4ae7d93336 100644 --- a/stories/remcos.yml +++ b/stories/remcos.yml @@ -3,6 +3,7 @@ id: 2bd4aa08-b9a5-40cf-bfe5-7d43f13d496c version: 1 date: '2021-09-23' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Remcos RAT trojan, including looking for file writes associated with its payload, screencapture, registry modification, UAC bypassed, persistence diff --git a/stories/reverse_network_proxy.yml b/stories/reverse_network_proxy.yml index 5790f6e39e..f5257404f6 100644 --- a/stories/reverse_network_proxy.yml +++ b/stories/reverse_network_proxy.yml @@ -3,6 +3,7 @@ id: 265e4127-21fd-43e4-adac-ec5d12274111 version: 1 date: '2022-11-16' author: Michael Haag, Splunk +status: production description: The following analytic story describes applications that may be abused to reverse proxy back into an organization, either for persistence or remote access. narrative: This analytic story covers tools like Ngrok which is a legitimate reverse proxy tool that can create a secure tunnel to servers located behind firewalls or on local machines that do not have a public IP. Ngrok in particular has been leveraged by threat actors in several campaigns including use for lateral movement and data exfiltration. There are many open source and closed/paid that fall into this reverse proxy category. The analytic story and complemented analytics will be released as more are identified. diff --git a/stories/revil_ransomware.yml b/stories/revil_ransomware.yml index d1f11f81e4..801129da7d 100644 --- a/stories/revil_ransomware.yml +++ b/stories/revil_ransomware.yml @@ -3,6 +3,7 @@ id: 817cae42-f54b-457a-8a36-fbf45521e29e version: 1 date: '2021-06-04' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry diff --git a/stories/rhysida_ransomware.yml b/stories/rhysida_ransomware.yml index 1270c11c2e..ab821951ad 100644 --- a/stories/rhysida_ransomware.yml +++ b/stories/rhysida_ransomware.yml @@ -3,6 +3,7 @@ id: 0925ee49-1185-4484-94ac-7867764a9183 version: 1 date: '2023-12-12' author: Teoderick Contreras, Splunk +status: production description: Utilize analytics designed to identify and delve into atypical behaviors, potentially associated with the Rhysida Ransomware. Employing these searches enables the detection of irregular patterns or actions within systems or networks, serving as proactive measures to spot potential diff --git a/stories/router_and_infrastructure_security.yml b/stories/router_and_infrastructure_security.yml index a042290e74..f24e6c02fa 100644 --- a/stories/router_and_infrastructure_security.yml +++ b/stories/router_and_infrastructure_security.yml @@ -3,6 +3,7 @@ id: 91c676cf-0b23-438d-abee-f6335e177e77 version: 1 date: '2017-09-12' author: Bhavin Patel, Splunk +status: production description: Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. diff --git a/stories/ryuk_ransomware.yml b/stories/ryuk_ransomware.yml index f3f58d9fbe..1b23726919 100644 --- a/stories/ryuk_ransomware.yml +++ b/stories/ryuk_ransomware.yml @@ -3,6 +3,7 @@ id: 507edc74-13d5-4339-878e-b9744ded1f35 version: 1 date: '2020-11-06' author: Jose Hernandez, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, diff --git a/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml b/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml index c51978b246..81353384c7 100644 --- a/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml +++ b/stories/samaccountname_spoofing_and_domain_controller_impersonation.yml @@ -3,6 +3,7 @@ id: 0244fdee-61be-11ec-900e-acde48001122 version: 1 date: '2021-12-20' author: Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with the exploitation of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) vulnerabilities. diff --git a/stories/samsam_ransomware.yml b/stories/samsam_ransomware.yml index 3f5b4a718c..cae7c5ecc3 100644 --- a/stories/samsam_ransomware.yml +++ b/stories/samsam_ransomware.yml @@ -3,6 +3,7 @@ id: c4b89506-fbcf-4cb7-bfd6-527e54789604 version: 1 date: '2018-12-13' author: Rico Valdez, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware diff --git a/stories/sandworm_tools.yml b/stories/sandworm_tools.yml index 1387a84de7..8cc6b5f357 100644 --- a/stories/sandworm_tools.yml +++ b/stories/sandworm_tools.yml @@ -3,6 +3,7 @@ id: 54146850-9d26-4877-a611-2db33231e63e version: 1 date: '2022-04-05' author: Teoderick Contreras, Splunk +status: production description: This analytic story features detections that enable security analysts to identify and investigate unusual activities potentially related to the destructive malware and tools employed by the "Sandworm" group. This analytic story focuses on monitoring suspicious process executions, command-line activities, Master Boot Record (MBR) wiping, data destruction, and other related indicators. narrative: The Sandworm group's tools are part of destructive malware operations designed to disrupt or attack Ukraine's National Information Agencies. This operation campaign consists of several malware components, including scripts, native Windows executables (LOLBINs), data wiper malware that overwrites or destroys the Master Boot Record (MBR), and file wiping using sdelete.exe on targeted hosts. references: diff --git a/stories/scheduled_tasks.yml b/stories/scheduled_tasks.yml index 7d038b6459..c55d37d90d 100644 --- a/stories/scheduled_tasks.yml +++ b/stories/scheduled_tasks.yml @@ -3,6 +3,7 @@ id: 94cff925-d05c-40cf-b925-d6c5702a2399 version: 1 date: '2023-06-12' author: Michael Haag, Splunk +status: production description: The MITRE ATT&CK technique T1053 refers to Scheduled Task/Job. Adversaries might use task scheduling utilities to execute programs or scripts at a predefined date and time. This method is often used for persistence but can also be used for privilege escalation or to execute tasks under certain conditions. Scheduling tasks can be beneficial for an attacker as it can allow them to execute actions at times when the system is less likely to be monitored actively. Different operating systems have different utilities for task scheduling, for example, Unix-like systems have Cron, while Windows has Scheduled Tasks and At Jobs. narrative: MITRE ATT&CK technique T1053, labeled "Scheduled Task/Job", is a categorization of methods that adversaries use to execute malicious code by scheduling tasks or jobs on a system. This technique is widely utilized for persistence, privilege escalation, and the remote execution of tasks. The technique is applicable across various environments and platforms, including Windows, Linux, and macOS. diff --git a/stories/shrinklocker.yml b/stories/shrinklocker.yml index f2e19acab4..dd7e9455b5 100644 --- a/stories/shrinklocker.yml +++ b/stories/shrinklocker.yml @@ -3,6 +3,7 @@ id: 11fb26d7-11d3-4839-9ee7-63c1329bff8c version: 1 date: '2024-06-17' author: Teoderick Contreras, Splunk +status: production description: ShrinkLocker is a new ransomware that uses Windows BitLocker to encrypt files by creating new boot partitions. It targets non-boot partitions, shrinks them, and creates new boot volumes. ShrinkLocker has attacked a government entity and companies in the vaccine and manufacturing sectors. The ransomware doesn't drop a ransom note but uses the boot partition label diff --git a/stories/signed_binary_proxy_execution_installutil.yml b/stories/signed_binary_proxy_execution_installutil.yml index ad01c1d41f..38575e2ad7 100644 --- a/stories/signed_binary_proxy_execution_installutil.yml +++ b/stories/signed_binary_proxy_execution_installutil.yml @@ -3,6 +3,7 @@ id: 9482a314-43dc-11ec-a3c9-acde48001122 version: 1 date: '2021-11-12' author: Michael Haag, Splunk +status: production description: Adversaries may use InstallUtil to proxy execution of code through a trusted Windows utility. narrative: 'InstallUtil is a command-line utility that allows for installation and diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml index e618ef203d..af931b88a5 100644 --- a/stories/silver_sparrow.yml +++ b/stories/silver_sparrow.yml @@ -3,6 +3,7 @@ id: cb4f48fe-7699-11eb-af77-acde48001122 version: 1 date: '2021-02-24' author: Michael Haag, Splunk +status: production description: Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence. diff --git a/stories/snake_keylogger.yml b/stories/snake_keylogger.yml index f737c4cf14..7e6bf544d5 100644 --- a/stories/snake_keylogger.yml +++ b/stories/snake_keylogger.yml @@ -3,6 +3,7 @@ id: 0374f962-c66a-4a67-9a30-24b0708ef802 version: 1 date: '2024-02-12' author: Teoderick Contreras, Splunk +status: production description: SnakeKeylogger is a stealthy malware designed to secretly record keystrokes on infected devices. It operates covertly in the background, capturing sensitive information such as passwords and credit card details. This keylogging threat poses a significant risk to user privacy and security. diff --git a/stories/snake_malware.yml b/stories/snake_malware.yml index 5b6a3512e3..82ab496cb9 100644 --- a/stories/snake_malware.yml +++ b/stories/snake_malware.yml @@ -3,6 +3,7 @@ id: 032bacbb-f90d-43aa-bbcc-d87f169a29c8 version: 1 date: '2023-05-10' author: Michael Haag, Splunk +status: production description: The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia's Federal Security Service (FSB) for long-term intelligence collection on sensitive targets. narrative: The Snake implant is considered the most sophisticated cyber espionage tool designed and used by Center 16 of Russia's Federal Security Service (FSB) for long-term intelligence collection on sensitive diff --git a/stories/sneaky_active_directory_persistence_tricks.yml b/stories/sneaky_active_directory_persistence_tricks.yml index b703db7c90..e89a019084 100644 --- a/stories/sneaky_active_directory_persistence_tricks.yml +++ b/stories/sneaky_active_directory_persistence_tricks.yml @@ -3,6 +3,7 @@ id: f676c4c1-c769-4ecb-9611-5fd85b497c56 version: 2 date: '2024-03-14' author: Dean Luxton, Mauricio Velazco, Splunk +status: production description: Monitor for activities and techniques associated with Windows Active Directory persistence techniques. narrative: Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Active Directory is a centralized and hierarchical database that stores information about users, computers, and other resources on a network. It provides secure and efficient management diff --git a/stories/spearphishing_attachments.yml b/stories/spearphishing_attachments.yml index 100efe95ec..6cf46e93a7 100644 --- a/stories/spearphishing_attachments.yml +++ b/stories/spearphishing_attachments.yml @@ -3,6 +3,7 @@ id: 57226b40-94f3-4ce5-b101-a75f67759c27 version: 1 date: '2019-04-29' author: Splunk Research Team, Splunk +status: production description: Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative: 'Despite its simplicity, phishing remains the most pervasive and dangerous diff --git a/stories/spring4shell_cve_2022_22965.yml b/stories/spring4shell_cve_2022_22965.yml index 08345cf642..a0e425a25e 100644 --- a/stories/spring4shell_cve_2022_22965.yml +++ b/stories/spring4shell_cve_2022_22965.yml @@ -3,6 +3,7 @@ id: dcc19913-6918-4ed2-bbba-a6b484c10ef4 version: 2 date: '2024-09-24' author: Michael Haag, Splunk +status: production description: Spring4Shell is the nickname given to a zero-day vulnerability in the Spring Core Framework, a programming and configuration model for Java-based enterprise applications. narrative: 'An attacker could exploit Spring4Shell by sending a specially crafted request to a vulnerable server. However, exploitation of Spring4Shell requires certain prerequisites, whereas the original Log4Shell vulnerability affected all versions of Log4j 2 using the default configuration. diff --git a/stories/sql_injection.yml b/stories/sql_injection.yml index 0838a17274..b8cbeb1283 100644 --- a/stories/sql_injection.yml +++ b/stories/sql_injection.yml @@ -3,6 +3,7 @@ id: 4f6632f5-449c-4686-80df-57625f59bab3 version: 1 date: '2017-09-19' author: Bhavin Patel, Splunk +status: production description: Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters. diff --git a/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml b/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml index d446c2f408..3d06aa2123 100644 --- a/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml +++ b/stories/subvert_trust_controls_sip_and_trust_provider_hijacking.yml @@ -3,6 +3,7 @@ id: 7faf91b6-532a-4f18-807c-b2761e90b6dc version: 1 date: '2023-10-10' author: Michael Haag, Splunk +status: production description: Adversaries may tamper with SIP and trust provider components to mislead the operating system and application control tools when conducting signature validation checks. This technique involves modifying the Dll and FuncName Registry values that point to the dynamic link library (DLL) providing a SIP's function, which retrieves an encoded digital certificate from a signed file. By pointing to a maliciously-crafted DLL with an exported function that always returns a known good signature value, an adversary can apply an acceptable signature value to all files using that SIP. This can also enable persistent code execution, since these malicious components may be invoked by any application that performs code signing or signature validation. narrative: In user mode, Windows Authenticode digital signatures are used to verify a file's origin and integrity, variables that may be used to establish trust in signed code. The signature validation process is handled via the WinVerifyTrust application programming interface (API) function, which accepts an inquiry and coordinates with the appropriate trust provider, which is responsible for validating parameters of a signature. Because of the varying executable file types and corresponding signature formats, Microsoft created software components called Subject Interface Packages (SIPs) to provide a layer of abstraction between API functions and files. SIPs are responsible for enabling API functions to create, retrieve, calculate, and verify signatures. Unique SIPs exist for most file formats and are identified by globally unique identifiers (GUIDs). Adversaries may hijack SIP and trust provider components to mislead operating system and application control tools to classify malicious (or any) code as signed. references: diff --git a/stories/suspicious_aws_login_activities.yml b/stories/suspicious_aws_login_activities.yml index 8ec3aab745..19956ad2c3 100644 --- a/stories/suspicious_aws_login_activities.yml +++ b/stories/suspicious_aws_login_activities.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c59f1268af3 version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk +status: production description: 'Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins.' diff --git a/stories/suspicious_aws_s3_activities.yml b/stories/suspicious_aws_s3_activities.yml index 4d480bbffa..e39ac23014 100644 --- a/stories/suspicious_aws_s3_activities.yml +++ b/stories/suspicious_aws_s3_activities.yml @@ -3,6 +3,7 @@ id: 66732346-8fb0-407b-9633-da16756567d6 version: 3 date: '2023-04-24' author: Bhavin Patel, Splunk +status: production description: Use the searches in this Analytic Story using Cloudtrail logs to to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP, permission and policy updates to the bucket, potential misuse of other services leading to data being leaked. diff --git a/stories/suspicious_aws_traffic.yml b/stories/suspicious_aws_traffic.yml index 833fb4f004..d8d36dab50 100644 --- a/stories/suspicious_aws_traffic.yml +++ b/stories/suspicious_aws_traffic.yml @@ -3,6 +3,7 @@ id: 2e8948a5-5239-406b-b56b-6c50f2168af3 version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk +status: production description: Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). diff --git a/stories/suspicious_cloud_authentication_activities.yml b/stories/suspicious_cloud_authentication_activities.yml index 44c0e56a6e..32c56b1591 100644 --- a/stories/suspicious_cloud_authentication_activities.yml +++ b/stories/suspicious_cloud_authentication_activities.yml @@ -3,6 +3,7 @@ id: 6380ebbb-55c5-4fce-b754-01fd565fb73c version: 2 date: '2024-09-24' author: Rico Valdez, Splunk +status: production description: 'Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity.' diff --git a/stories/suspicious_cloud_instance_activities.yml b/stories/suspicious_cloud_instance_activities.yml index a150ffaa21..524ea6028b 100644 --- a/stories/suspicious_cloud_instance_activities.yml +++ b/stories/suspicious_cloud_instance_activities.yml @@ -3,6 +3,7 @@ id: 8168ca88-392e-42f4-85a2-767579c660ce version: 1 date: '2020-08-25' author: David Dorsey, Splunk +status: production description: Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. diff --git a/stories/suspicious_cloud_provisioning_activities.yml b/stories/suspicious_cloud_provisioning_activities.yml index 72fdc5772d..1383242e55 100644 --- a/stories/suspicious_cloud_provisioning_activities.yml +++ b/stories/suspicious_cloud_provisioning_activities.yml @@ -3,6 +3,7 @@ id: 51045ded-1575-4ba6-aef7-af6c73cffd86 version: 1 date: '2018-08-20' author: David Dorsey, Splunk +status: production description: Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. diff --git a/stories/suspicious_cloud_user_activities.yml b/stories/suspicious_cloud_user_activities.yml index f7ddc5ac2e..65b679c4d8 100644 --- a/stories/suspicious_cloud_user_activities.yml +++ b/stories/suspicious_cloud_user_activities.yml @@ -3,6 +3,7 @@ id: 1ed5ce7d-5469-4232-92af-89d1a3595b39 version: 1 date: '2020-09-04' author: David Dorsey, Splunk +status: production description: Detect and investigate suspicious activities by users and roles in your cloud environments. narrative: 'It seems obvious that it is critical to monitor and control the users diff --git a/stories/suspicious_command_line_executions.yml b/stories/suspicious_command_line_executions.yml index 76a5d1f9fc..d4bef5eca9 100644 --- a/stories/suspicious_command_line_executions.yml +++ b/stories/suspicious_command_line_executions.yml @@ -3,6 +3,7 @@ id: f4368ddf-d59f-4192-84f6-778ac5a3ffc7 version: 2 date: '2020-02-03' author: Bhavin Patel, Splunk +status: production description: Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI diff --git a/stories/suspicious_compiled_html_activity.yml b/stories/suspicious_compiled_html_activity.yml index e542ca58b4..d6650332b8 100644 --- a/stories/suspicious_compiled_html_activity.yml +++ b/stories/suspicious_compiled_html_activity.yml @@ -1,5 +1,6 @@ author: Michael Haag, Splunk date: '2021-02-11' +status: production description: Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. id: a09db4d1-3827-4833-87b8-3a397e532119 diff --git a/stories/suspicious_dns_traffic.yml b/stories/suspicious_dns_traffic.yml index e2220a8d33..f940637476 100644 --- a/stories/suspicious_dns_traffic.yml +++ b/stories/suspicious_dns_traffic.yml @@ -3,6 +3,7 @@ id: 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56 version: 1 date: '2017-09-18' author: Rico Valdez, Splunk +status: production description: Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. diff --git a/stories/suspicious_emails.yml b/stories/suspicious_emails.yml index e8b9a0ef5a..fa00f0c715 100644 --- a/stories/suspicious_emails.yml +++ b/stories/suspicious_emails.yml @@ -3,6 +3,7 @@ id: 2b1800dd-92f9-47ec-a981-fdf1351e5d55 version: 1 date: '2020-01-27' author: Bhavin Patel, Splunk +status: production description: Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. diff --git a/stories/suspicious_gcp_storage_activities.yml b/stories/suspicious_gcp_storage_activities.yml index 9f26360fb0..626784cb6f 100644 --- a/stories/suspicious_gcp_storage_activities.yml +++ b/stories/suspicious_gcp_storage_activities.yml @@ -3,6 +3,7 @@ id: 4d656b2e-d6be-11ea-87d0-0242ac130003 version: 1 date: '2020-08-05' author: Shannon Davis, Splunk +status: production description: Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative diff --git a/stories/suspicious_mshta_activity.yml b/stories/suspicious_mshta_activity.yml index d39914c98d..3dcbf4634a 100644 --- a/stories/suspicious_mshta_activity.yml +++ b/stories/suspicious_mshta_activity.yml @@ -3,6 +3,7 @@ id: 1e5a5a53-540b-462a-8fb7-f44a4292f5dc version: 2 date: '2021-01-20' author: Bhavin Patel, Michael Haag, Splunk +status: production description: Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative: 'One common adversary tactic is to bypass application control solutions diff --git a/stories/suspicious_okta_activity.yml b/stories/suspicious_okta_activity.yml index 219a348ed0..59410c1899 100644 --- a/stories/suspicious_okta_activity.yml +++ b/stories/suspicious_okta_activity.yml @@ -3,6 +3,7 @@ id: 9cbd34af-8f39-4476-a423-bacd126c750b version: 1 date: '2020-04-02' author: Rico Valdez, Splunk +status: production description: Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they diff --git a/stories/suspicious_regsvcs_regasm_activity.yml b/stories/suspicious_regsvcs_regasm_activity.yml index 2196acbe57..ff6aadf5ea 100644 --- a/stories/suspicious_regsvcs_regasm_activity.yml +++ b/stories/suspicious_regsvcs_regasm_activity.yml @@ -1,5 +1,6 @@ author: Michael Haag, Splunk date: '2024-09-24' +status: production description: Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. id: 2cdf33a0-4805-4b61-b025-59c20f418fbe diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml index b14757bc11..bf8b318e92 100644 --- a/stories/suspicious_regsvr32_activity.yml +++ b/stories/suspicious_regsvr32_activity.yml @@ -3,6 +3,7 @@ id: b8bee41e-624f-11eb-ae93-0242ac130002 version: 1 date: '2021-01-29' author: Michael Haag, Splunk +status: production description: Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. narrative: One common adversary tactic is to bypass application control solutions diff --git a/stories/suspicious_rundll32_activity.yml b/stories/suspicious_rundll32_activity.yml index b15e91548d..92edab4242 100644 --- a/stories/suspicious_rundll32_activity.yml +++ b/stories/suspicious_rundll32_activity.yml @@ -3,6 +3,7 @@ id: 80a65487-854b-42f1-80a1-935e4c170694 version: 1 date: '2021-02-03' author: Michael Haag, Splunk +status: production description: Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. narrative: One common adversary tactic is to bypass application control solutions diff --git a/stories/suspicious_windows_registry_activities.yml b/stories/suspicious_windows_registry_activities.yml index 4362c447ad..8f069b1b62 100644 --- a/stories/suspicious_windows_registry_activities.yml +++ b/stories/suspicious_windows_registry_activities.yml @@ -3,6 +3,7 @@ id: 2b1800dd-92f9-47dd-a981-fdf1351e5d55 version: 1 date: '2018-05-31' author: Bhavin Patel, Splunk +status: production description: Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative: "Attackers are developing increasingly sophisticated techniques for hijacking diff --git a/stories/suspicious_wmi_use.yml b/stories/suspicious_wmi_use.yml index 7b1743dd5d..e36079c954 100644 --- a/stories/suspicious_wmi_use.yml +++ b/stories/suspicious_wmi_use.yml @@ -3,6 +3,7 @@ id: c8ddc5be-69bc-4202-b3ab-4010b27d7ad5 version: 2 date: '2018-10-23' author: Rico Valdez, Splunk +status: production description: Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it diff --git a/stories/suspicious_zoom_child_processes.yml b/stories/suspicious_zoom_child_processes.yml index 8a92a67596..c3ed962363 100644 --- a/stories/suspicious_zoom_child_processes.yml +++ b/stories/suspicious_zoom_child_processes.yml @@ -3,6 +3,7 @@ id: aa3749a6-49c7-491e-a03f-4eaee5fe0258 version: 1 date: '2020-04-13' author: David Dorsey, Splunk +status: production description: Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection. diff --git a/stories/swift_slicer.yml b/stories/swift_slicer.yml index 940ff21fee..59ea094300 100644 --- a/stories/swift_slicer.yml +++ b/stories/swift_slicer.yml @@ -3,6 +3,7 @@ id: 234c9dd7-52fb-4d6f-aec9-075ef88a2cea version: 1 date: '2023-02-01' author: Teoderick Contreras, Rod Soto, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the swift slicer malware including overwriting of files and etc. narrative: Swift Slicer is one of Windows destructive malware found by ESET that was used in a targeted organizarion to wipe critical files like windows drivers and other files diff --git a/stories/sysaid_on_prem_software_cve_2023_47246_vulnerability.yml b/stories/sysaid_on_prem_software_cve_2023_47246_vulnerability.yml index 5817f510fe..6e4bf82570 100644 --- a/stories/sysaid_on_prem_software_cve_2023_47246_vulnerability.yml +++ b/stories/sysaid_on_prem_software_cve_2023_47246_vulnerability.yml @@ -3,6 +3,7 @@ id: 228f22cb-3436-4c31-8af4-370d40af7b49 version: 1 date: '2023-11-09' author: Michael Haag, Splunk +status: production description: A zero-day vulnerability was discovered in SysAid's on-premise software, exploited by the group DEV-0950 (Lace Tempest). The attackers uploaded a WebShell and other payloads, gaining unauthorized access and control. SysAid has released a patch (version 23.3.36) to remediate the vulnerability and urges customers to conduct a comprehensive compromise assessment. narrative: The analytics tagged to this analytic story will aid in capturing initial access and some post-exploitation activities. In addition to the application spawning a shell, consider reviewing STRT's Cobalt Strike and PowerShell script block logging analytic stories. On November 2nd, SysAid's security team identified a potential vulnerability in their on-premise software. The investigation revealed a zero-day vulnerability exploited by the group known as DEV-0950 (Lace Tempest). The attackers uploaded a WebShell and other payloads into the webroot of the SysAid Tomcat web service, thereby gaining unauthorized access and control over the affected system. SysAid promptly initiated their incident response protocol and began proactive communication with their on-premise customers to implement a mitigation solution. SysAid has released a patch (version 23.3.36) to remediate the vulnerability and strongly recommends all customers to conduct a comprehensive compromise assessment of their network. references: diff --git a/stories/text4shell_cve_2022_42889.yml b/stories/text4shell_cve_2022_42889.yml index 4c89b47d19..770e32aa17 100644 --- a/stories/text4shell_cve_2022_42889.yml +++ b/stories/text4shell_cve_2022_42889.yml @@ -3,6 +3,7 @@ id: 95ae800d-485e-47f7-866e-8be281aa497b version: 1 date: '2022-10-26' author: Michael Haag, Splunk +status: production description: A new critical vulnerability CVE-2022-42889 a.k.a. Text4shell, similar to the old Spring4Shell and Log4Shell, was originally reported by Alvaro Munoz on the very popular Apache Commons Text library. narrative: Apache Commons Text is a Java library described as "a library focused on algorithms working on strings." We can see it as a general-purpose text manipulation toolkit. This vulnerability affects the StringSubstitutor interpolator class, which is included in the Commons Text library. A default interpolator allows for string lookups that can lead to Remote Code Execution. This is due to a logic flaw that makes the "script," "dns," and "url" lookup keys interpolated by default, as opposed to what it should be, according to the documentation of the StringLookupFactory class. Those keys allow an attacker to execute arbitrary code via lookups. diff --git a/stories/trickbot.yml b/stories/trickbot.yml index 9ecadb1d99..491f869347 100644 --- a/stories/trickbot.yml +++ b/stories/trickbot.yml @@ -3,6 +3,7 @@ id: 16f93769-8342-44c0-9b1d-f131937cce8e version: 1 date: '2021-04-20' author: Rod Soto, Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection diff --git a/stories/trusted_developer_utilities_proxy_execution.yml b/stories/trusted_developer_utilities_proxy_execution.yml index 4c003ce7b9..0f034643fb 100644 --- a/stories/trusted_developer_utilities_proxy_execution.yml +++ b/stories/trusted_developer_utilities_proxy_execution.yml @@ -3,6 +3,7 @@ id: 270a67a6-55d8-11eb-ae93-0242ac130002 version: 1 date: '2021-01-12' author: Michael Haag, Splunk +status: production description: Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code. narrative: 'Adversaries may take advantage of trusted developer utilities to proxy diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml index 3abbd91e73..060c17f32f 100644 --- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml +++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml @@ -3,6 +3,7 @@ id: be3418e2-551b-11eb-ae93-0242ac130002 version: 1 date: '2021-01-21' author: Michael Haag, Splunk +status: production description: Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted diff --git a/stories/unusual_processes.yml b/stories/unusual_processes.yml index 2b14759889..4fd817acc6 100644 --- a/stories/unusual_processes.yml +++ b/stories/unusual_processes.yml @@ -3,6 +3,7 @@ id: f4368e3f-d59f-4192-84f6-748ac5a3ddb6 version: 2 date: '2020-02-04' author: Bhavin Patel, Splunk +status: production description: Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples diff --git a/stories/use_of_cleartext_protocols.yml b/stories/use_of_cleartext_protocols.yml index 56ab8001ed..fc2e0cca7e 100644 --- a/stories/use_of_cleartext_protocols.yml +++ b/stories/use_of_cleartext_protocols.yml @@ -3,6 +3,7 @@ id: 826e6431-aeef-41b4-9fc0-6d0985d65a21 version: 1 date: '2017-09-15' author: Bhavin Patel, Splunk +status: production description: Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative: Various legacy protocols operate by default in the clear, without the protections diff --git a/stories/valleyrat.yml b/stories/valleyrat.yml index a53d866238..d40f36f218 100644 --- a/stories/valleyrat.yml +++ b/stories/valleyrat.yml @@ -3,6 +3,7 @@ id: e9703322-5462-4c4a-a427-b9895c1472de version: 1 date: '2024-09-11' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might be related to ValleyRAT malware. ValleyRAT is a remote access trojan (RAT) known for targeting specific organizations and individuals to gain unauthorized access to systems. It enables attackers to execute commands, steal sensitive data, and manipulate files. This malware often uses phishing emails or malicious attachments to infect systems. Detecting ValleyRAT early is crucial to preventing data breaches and further exploitation. Analysts can use behavioral analysis and signature-based detection to mitigate its impact. narrative: ValleyRAT is a stealthy remote access trojan (RAT) used by cybercriminals to gain unauthorized control over compromised systems. It often infiltrates targets through phishing emails or malicious attachments, allowing attackers to execute commands, steal sensitive information, manipulate files, and monitor user activities remotely. Once inside, ValleyRAT can evade detection by blending in with legitimate processes, making it challenging to identify. references: diff --git a/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml b/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml index 479d8c0696..ea6d8b659b 100644 --- a/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml +++ b/stories/vmware_aria_operations_vrealize_cve_2023_20887.yml @@ -3,6 +3,7 @@ id: 99171cdd-57a1-4b8a-873c-f8bee12e2025 version: 1 date: '2023-06-21' author: Michael Haag, Splunk +status: production description: CVE-2023-20887 is a critical vulnerability affecting VMware's vRealize Network Insight (also known as VMware Aria Operations for Networks). It allows a remote, unauthenticated attacker to execute arbitrary commands with root privileges via the Apache Thrift RPC interface. The exploit, which has a severity score of 9.8, targets an endpoint ("/saas./resttosaasservlet") in the application and delivers a malicious payload designed to create a reverse shell, granting the attacker control over the system. VMware has released an advisory recommending users to update to the latest version to mitigate this threat. narrative: CVE-2023-20887 is a highly critical vulnerability found in VMware's vRealize Network Insight. This software is widely used for intelligent operations management across physical, virtual, and cloud environments, so a vulnerability in it poses a significant risk to many organizations. diff --git a/stories/vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml b/stories/vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml index 1287d494c8..9c78c40d9d 100644 --- a/stories/vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml +++ b/stories/vmware_esxi_ad_integration_authentication_bypass_cve_2024_37085.yml @@ -3,6 +3,7 @@ id: cb77a38a-bc37-42f8-9e34-64ccc7985277 version: 1 date: '2024-07-30' author: Michael Haag, Splunk +status: production description: This analytic story addresses the VMware ESXi Active Directory Integration Authentication Bypass vulnerability (CVE-2024-37085). It detects attempts to exploit this flaw, which allows attackers with sufficient AD permissions to gain full access to ESXi hosts by recreating the 'ESX Admins' group after deletion. narrative: VMware ESXi contains an authentication bypass vulnerability (CVE-2024-37085) that allows attackers to gain unauthorized access to ESXi hosts. Ransomware groups have been observed exploiting this flaw to deploy malware and encrypt virtual machines. This story focuses on detecting potential exploitation attempts, suspicious Active Directory group modifications. It aims to help defenders identify and respond to attacks leveraging this vulnerability in their virtualized environments. references: diff --git a/stories/vmware_server_side_injection_and_privilege_escalation.yml b/stories/vmware_server_side_injection_and_privilege_escalation.yml index c4b781a16e..2446d78bc8 100644 --- a/stories/vmware_server_side_injection_and_privilege_escalation.yml +++ b/stories/vmware_server_side_injection_and_privilege_escalation.yml @@ -3,6 +3,7 @@ id: d6d51cc2-a092-43b7-9f61-1159943afe39 version: 1 date: '2022-05-19' author: Michael Haag, Splunk +status: production description: Recently disclosed CVE-2022-22954 and CVE-2022-22960 have been identified in the wild abusing VMware products to compromise internet faced devices and escalate privileges. narrative: 'On April 6, 2022, VMware published VMSA-2022-0011, which discloses multiple vulnerabilities discovered by Steven Seeley (mr_me) of Qihoo 360 Vulnerability Research Institute. The most critical of the CVEs published in VMSA-2022-0011 is CVE-2022-22954, which is a server-side template injection issue with a CVSSv3 base score of 9.8. The vulnerability allows an unauthenticated user with network access to the web interface to execute an arbitrary shell command as the VMware user. diff --git a/stories/volt_typhoon.yml b/stories/volt_typhoon.yml index 235462c3e1..495436b753 100644 --- a/stories/volt_typhoon.yml +++ b/stories/volt_typhoon.yml @@ -3,6 +3,7 @@ id: f73010e4-49eb-44ef-9f3f-2c25a1ae5415 version: 1 date: '2023-05-25' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the "Volt Typhoon" group targeting critical infrastructure organizations in United States and Guam. The affected organizations include the communications, manufacturing, utility, transportation, construction, maritime, government, information technology, and education sectors. This Analytic story looks for suspicious process execution, lolbin execution, command-line activity, lsass dump and many more. narrative: 'Volt Typhoon is a state sponsored group typically focuses on espionage and information gathering. Based on Microsoft Threat Intelligence, This threat actor group puts strong emphasis on stealth in this campaign by relying almost exclusively on living-off-the-land techniques and hands-on-keyboard activity. diff --git a/stories/warzone_rat.yml b/stories/warzone_rat.yml index 6e01ce2079..6120cb00e2 100644 --- a/stories/warzone_rat.yml +++ b/stories/warzone_rat.yml @@ -3,6 +3,7 @@ id: 8dc84752-f4da-4285-931c-bddd5c4d440b version: 1 date: '2023-07-26' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might related to warzone (Ave maria) RAT. This analytic story looks for suspicious process execution, command-line activity, downloads, persistence, defense evasion and more. narrative: Warzone RAT, also known as Ave Maria, is a sophisticated remote access trojan (RAT) that surfaced in January 2019. diff --git a/stories/whispergate.yml b/stories/whispergate.yml index ad0d9cd5e2..669be3bb55 100644 --- a/stories/whispergate.yml +++ b/stories/whispergate.yml @@ -3,6 +3,7 @@ id: 0150e6e5-3171-442e-83f8-1ccd8599569b version: 1 date: '2022-01-19' author: Teoderick Contreras, Splunk +status: production description: This analytic story contains detections that allow security analysts to detect and investigate unusual activities that might relate to the destructive malware targeting Ukrainian organizations also known as "WhisperGate". This analytic story looks for suspicious process execution, command-line activity, downloads, DNS queries and more. diff --git a/stories/windows_applocker.yml b/stories/windows_applocker.yml index 29aefad92e..2e6ec9d358 100644 --- a/stories/windows_applocker.yml +++ b/stories/windows_applocker.yml @@ -3,6 +3,7 @@ id: 7911b245-e74d-48db-b1cf-69f3eb02ca55 version: 1 date: '2024-03-21' author: Michael Haag, Splunk +status: production description: Windows AppLocker is a feature that enhances security by allowing administrators to specify which users or groups can run particular applications in their organization based on unique identities of files. This story covers various aspects of monitoring and managing AppLocker policies, including detecting unauthorized software installations, enforcing best practices for software usage, and identifying potential security breaches through advanced threat detection techniques. Through the use of Splunk Enterprise, Splunk Enterprise Security, and Splunk Cloud, organizations can gain insights into AppLocker events, ensuring compliance with corporate security policies and mitigating risks associated with unauthorized applications. narrative: AppLocker, a built-in Windows security feature, provides organizations with the ability to control application usage across their networks. It enables administrators to define rules based on file names, publishers, and file hashes to allow or deny the execution of applications. This level of control helps in preventing malware and unlicensed software from running, thereby enhancing the security posture of an organization. \ diff --git a/stories/windows_attack_surface_reduction.yml b/stories/windows_attack_surface_reduction.yml index 39c4e61de6..8bbfb015db 100644 --- a/stories/windows_attack_surface_reduction.yml +++ b/stories/windows_attack_surface_reduction.yml @@ -3,6 +3,7 @@ id: 1d61c474-3cd6-4c23-8c68-f128ac4b209b version: 1 date: '2023-11-27' author: Michael Haag, Splunk +status: production description: 'This story contains detections for Windows Attack Surface Reduction (ASR) events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This story contains detections for ASR events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule.' narrative: 'This story contains detections for Windows Attack Surface Reduction (ASR) events. ASR is a feature of Windows Defender Exploit Guard that prevents actions and apps that are typically used by exploit-seeking malware to infect machines. ASR rules are applied to processes and applications. When a process or application attempts to perform an action that is blocked by an ASR rule, an event is generated. This story contains detections for ASR events that are generated when a process or application attempts to perform an action that is blocked by an ASR rule. It includes detections for both block and audit event IDs. Block event IDs are generated when an action is blocked by an ASR rule, while audit event IDs are generated when an action that would be blocked by an ASR rule is allowed to proceed for auditing purposes.' references: diff --git a/stories/windows_bootkits.yml b/stories/windows_bootkits.yml index 0ca7e4baeb..e7e28cc70c 100644 --- a/stories/windows_bootkits.yml +++ b/stories/windows_bootkits.yml @@ -3,6 +3,7 @@ id: 1bef004d-23b2-4c49-8ceb-b59af0745317 version: 1 date: '2023-05-03' author: Michael Haag, Splunk +status: production description: Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly. narrative: A bootkit is a sophisticated type of malware that targets the boot sectors of a hard drive, specifically the Master Boot Record (MBR) and Volume Boot Record (VBR). The MBR is the initial section of the disk that is loaded following the hardware initialization process executed by the Basic Input/Output System (BIOS). It houses the boot loader, which is responsible for loading the operating system. In contrast, the VBR is located at the beginning of each partition and contains the boot code for that specific partition. When an adversary gains raw access to the boot drive, they can overwrite the MBR or VBR, effectively diverting the execution during startup from the standard boot loader to the malicious code injected by the attacker. This tampering allows the malware to load before the operating system, enabling it to execute malicious activities stealthily and maintain persistence on the compromised system. diff --git a/stories/windows_certificate_services.yml b/stories/windows_certificate_services.yml index d2985db1a3..6c7a1f7225 100644 --- a/stories/windows_certificate_services.yml +++ b/stories/windows_certificate_services.yml @@ -3,6 +3,7 @@ id: b92b4ac7-0026-4408-a6b5-c1d20658e124 version: 1 date: '2023-02-01' author: Michael Haag, Splunk +status: production description: Adversaries may steal or forge certificates used for authentication to access remote systems or resources. Digital certificates are often used to sign and encrypt messages and/or files. Certificates are also used as authentication material. narrative: The following analytic story focuses on remote and local endpoint certificate theft and abuse. Authentication certificates can be both stolen and forged. For example, AD CS certificates can be stolen from encrypted storage (in the Registry or files), misplaced certificate files (i.e. Unsecured Credentials), or directly from the Windows certificate store via various crypto APIs.With appropriate enrollment rights, users and/or machines within a domain can also request and/or manually renew certificates from enterprise certificate authorities (CA). This enrollment process defines various settings and permissions associated with the certificate. Abusing certificates for authentication credentials may enable other behaviors such as Lateral Movement. Certificate-related misconfigurations may also enable opportunities for Privilege Escalation, by way of allowing users to impersonate or assume privileged accounts or permissions via the identities (SANs) associated with a certificate. These abuses may also enable Persistence via stealing or forging certificates that can be used as Valid Accounts for the duration of the certificate's validity, despite user password resets. Authentication certificates can also be stolen and forged for machine accounts. (MITRE ATT&CK) references: diff --git a/stories/windows_defense_evasion_tactics.yml b/stories/windows_defense_evasion_tactics.yml index b700bfb835..d0e0023c25 100644 --- a/stories/windows_defense_evasion_tactics.yml +++ b/stories/windows_defense_evasion_tactics.yml @@ -3,6 +3,7 @@ id: 56e24a28-5003-4047-b2db-e8f3c4618064 version: 2 date: '2024-09-24' author: David Dorsey, Splunk +status: production description: 'Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others' diff --git a/stories/windows_discovery_techniques.yml b/stories/windows_discovery_techniques.yml index ea5d23e596..35401db53c 100644 --- a/stories/windows_discovery_techniques.yml +++ b/stories/windows_discovery_techniques.yml @@ -3,6 +3,7 @@ id: f7aba570-7d59-11eb-825e-acde48001122 version: 1 date: '2021-03-04' author: Michael Hart, Splunk +status: production description: Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack. narrative: Attackers may not have much if any insight into their target's environment diff --git a/stories/windows_dns_sigred_cve_2020_1350.yml b/stories/windows_dns_sigred_cve_2020_1350.yml index 896a58e58d..778c179201 100644 --- a/stories/windows_dns_sigred_cve_2020_1350.yml +++ b/stories/windows_dns_sigred_cve_2020_1350.yml @@ -3,6 +3,7 @@ id: 36dbb206-d073-11ea-87d0-0242ac130003 version: 1 date: '2020-07-28' author: Shannon Davis, Splunk +status: production description: Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker diff --git a/stories/windows_drivers.yml b/stories/windows_drivers.yml index 0788a08230..64313d67de 100644 --- a/stories/windows_drivers.yml +++ b/stories/windows_drivers.yml @@ -3,6 +3,7 @@ id: d0a9323f-9411-4da6-86b2-18c184d750c0 version: 1 date: '2022-03-30' author: Michael Haag, Splunk +status: production description: Adversaries may use rootkits to hide the presence of programs, files, network connections, services, drivers, and other system components. narrative: A rootkit on Windows may sometimes be in the form of a Windows Driver. A driver typically has a file extension of .sys, however the internals of a sys file is similar to a Windows DLL. For Microsoft Windows to load a driver, a few requirements are needed. First, it must have a valid signature. Second, typically it should load from the windows\system32\drivers path. There are a few methods to investigate drivers in the environment. Drivers are noisy. An inventory of all drivers is important to understand prevalence. A driver location (Path) is also important when attempting to baseline. Looking at a driver name and path is not enough, we must also explore the signing information. Product, description, company name, signer and signing result are all items to take into account when reviewing drivers. diff --git a/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml b/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml index b7c5ec28eb..4fd737c217 100644 --- a/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml +++ b/stories/windows_error_reporting_service_elevation_of_privilege_vulnerability.yml @@ -3,6 +3,7 @@ id: 64dea1e5-2c60-461f-b886-05580ed89b5c version: 1 date: '2023-08-24' author: Michael Haag, Splunk +status: production description: In July 2023, CrowdStrike's Falcon Complete managed detection and response (MDR) team uncovered an exploit kit using an unknown vulnerability in the Windows Error Reporting (WER) component. The vulnerability, now identified as CVE-2023-36874, was also independently discovered by Google's Threat Analysis Group. The exploit came to light when suspicious binaries were observed on a European technology system. CrowdStrike's Counter Adversary Operations' analysis revealed a zero-day exploit targeting the WER service, allowing attackers to execute unauthorized code with elevated privileges. The exploit kit seen aimed to spawn a privileged interpreter, displaying the versatility and adaptability of the threat. CrowdStrike has listed some potential indicators of compromise, but these are of low fidelity due to their mutable nature. narrative: In June 2023, CrowdStrike's Falcon Complete team observed suspicious activities on a European technology entity's system. Multiple binaries were dropped onto the system via Remote Desktop Protocol (RDP), some of which were flagged as potential exploits for a known vulnerability. However, a string containing the Russian term for "0day" suggested an unknown vulnerability was at play. Subsequent investigations identified this as a zero-day vulnerability affecting the Windows Error Reporting (WER) component, now known as CVE-2023-36874. diff --git a/stories/windows_file_extension_and_association_abuse.yml b/stories/windows_file_extension_and_association_abuse.yml index 6316df6053..4e0b5c99a9 100644 --- a/stories/windows_file_extension_and_association_abuse.yml +++ b/stories/windows_file_extension_and_association_abuse.yml @@ -3,6 +3,7 @@ id: 30552a76-ac78-48e4-b3c0-de4e34e9563d version: 1 date: '2018-01-26' author: Rico Valdez, Splunk +status: production description: Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different diff --git a/stories/windows_log_manipulation.yml b/stories/windows_log_manipulation.yml index 9f4d430af5..96179a28d8 100644 --- a/stories/windows_log_manipulation.yml +++ b/stories/windows_log_manipulation.yml @@ -3,6 +3,7 @@ id: b6db2c60-a281-48b4-95f1-2cd99ed56835 version: 2 date: '2017-09-12' author: Rico Valdez, Splunk +status: production description: Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. diff --git a/stories/windows_persistence_techniques.yml b/stories/windows_persistence_techniques.yml index 246c73b6a2..1186855ba4 100644 --- a/stories/windows_persistence_techniques.yml +++ b/stories/windows_persistence_techniques.yml @@ -3,6 +3,7 @@ id: 30874d4f-20a1-488f-85ec-5d52ef74e3f9 version: 2 date: '2018-05-31' author: Bhavin Patel, Splunk +status: production description: Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative: Maintaining persistence is one of the first steps taken by attackers after diff --git a/stories/windows_post_exploitation.yml b/stories/windows_post_exploitation.yml index ec3e4e8a17..8130205f46 100644 --- a/stories/windows_post_exploitation.yml +++ b/stories/windows_post_exploitation.yml @@ -3,6 +3,7 @@ id: 992899b7-a5cf-4bcd-bb0d-cf81762188ba version: 1 date: '2022-11-30' author: Teoderick Contreras, Splunk +status: production description: This analytic story identifies popular Windows post exploitation tools for example winpeas.bat, winpeas.exe, WinPrivCheck.bat and many more. narrative: These tools allow operators to find possible exploits or paths for privilege escalation and persistence on a targeted host. Ransomware operator like the "Prestige ransomware" also used or abuses these post exploitation tools such as winPEAS to scan for possible avenue to gain privileges and persistence to a targeted diff --git a/stories/windows_privilege_escalation.yml b/stories/windows_privilege_escalation.yml index fcecb3d990..d367f96e05 100644 --- a/stories/windows_privilege_escalation.yml +++ b/stories/windows_privilege_escalation.yml @@ -3,6 +3,7 @@ id: 644e22d3-598a-429c-a007-16fdb802cae5 version: 2 date: '2020-02-04' author: David Dorsey, Splunk +status: production description: Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. diff --git a/stories/windows_registry_abuse.yml b/stories/windows_registry_abuse.yml index f38fad42ea..9d7c90ceb5 100644 --- a/stories/windows_registry_abuse.yml +++ b/stories/windows_registry_abuse.yml @@ -3,6 +3,7 @@ id: 78df1df1-25f1-4387-90f9-c4ea31ce6b75 version: 1 date: '2022-03-17' author: Teoderick Contreras, Splunk +status: production description: Windows services are often used by attackers for persistence, privilege escalation, lateral movement, defense evasion, collection of data, a tool for recon, credential dumping and payload impact. This Analytic Story helps you monitor your environment for indications diff --git a/stories/windows_service_abuse.yml b/stories/windows_service_abuse.yml index 9f196c709e..036fcb482c 100644 --- a/stories/windows_service_abuse.yml +++ b/stories/windows_service_abuse.yml @@ -3,6 +3,7 @@ id: 6dbd810e-f66d-414b-8dfc-e46de55cbfe2 version: 3 date: '2017-11-02' author: Rico Valdez, Splunk +status: production description: Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are diff --git a/stories/windows_system_binary_proxy_execution_msiexec.yml b/stories/windows_system_binary_proxy_execution_msiexec.yml index 9d96a9c31e..9d08d81b42 100644 --- a/stories/windows_system_binary_proxy_execution_msiexec.yml +++ b/stories/windows_system_binary_proxy_execution_msiexec.yml @@ -3,6 +3,7 @@ id: bea2e16b-4599-46ad-a95b-116078726c68 version: 1 date: '2022-06-16' author: Michael Haag, Splunk +status: production description: Adversaries may abuse msiexec.exe to proxy execution of malicious payloads. Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi). narrative: Adversaries may abuse msiexec.exe to launch local or network accessible MSI files. Msiexec.exe can also execute DLLs. Since it may be signed and native on Windows systems, msiexec.exe can be used to bypass application control solutions that do not account for its potential abuse. Msiexec.exe execution may also be elevated to SYSTEM privileges if the AlwaysInstallElevated policy is enabled. references: diff --git a/stories/winrar_spoofing_attack_cve_2023_38831.yml b/stories/winrar_spoofing_attack_cve_2023_38831.yml index cbe11a8304..b6559c8efd 100644 --- a/stories/winrar_spoofing_attack_cve_2023_38831.yml +++ b/stories/winrar_spoofing_attack_cve_2023_38831.yml @@ -3,6 +3,7 @@ id: 9ba776f3-b8c5-4390-a312-6dab6c5561b9 version: 1 date: '2023-08-29' author: Michael Haag, Splunk +status: production description: Group-IB Threat Intelligence unit discovered a zero-day vulnerability, CVE-2023-38831, in WinRAR, a popular compression tool. Cybercriminals exploited this vulnerability to deliver various malware families, including DarkMe and GuLoader, by crafting ZIP archives with spoofed extensions, which were then distributed on trading forums. Once the malware was executed, it allowed cybercriminals to withdraw funds from brokers' accounts. RARLAB was immediately notified about the vulnerability and released a patch. Group-IB recommends users update WinRAR to the latest version, stay informed about cyber threats, be cautious with unknown attachments, enable 2FA, backup data, and follow the principle of least privilege. narrative: Group-IB Threat Intelligence unit identified a critical zero-day vulnerability, CVE-2023-38831, in WinRAR, a widely used compression tool. This vulnerability was exploited by cybercriminals to craft ZIP archives containing malicious and non-malicious files, distributed on specialized trading forums. The exploit allowed them to spoof file extensions, hiding the launch of malicious scripts within an archive masquerading as a '.jpg', '.txt', or any other file format. When victims opened the specially crafted archive, it executed the malware, leading to unauthorized access to their broker accounts and enabling the cybercriminals to perform illicit financial transactions and withdraw funds. diff --git a/stories/winter_vivern.yml b/stories/winter_vivern.yml index 3c4c58cc0f..893645f94f 100644 --- a/stories/winter_vivern.yml +++ b/stories/winter_vivern.yml @@ -3,6 +3,7 @@ id: 5ce5f311-b311-4568-90ca-0c36781d07a4 version: 1 date: '2023-02-16' author: Teoderick Contreras, Splunk +status: production description: Utilize searches that enable you to detect and investigate unusual activities potentially related to the Winter Vivern malicious software. This includes examining multiple timeout executions, scheduled task creations, screenshots, and downloading files through PowerShell, among other indicators. narrative: The Winter Vivern malware, identified by CERT UA, is designed to download and run multiple PowerShell scripts on targeted hosts. These scripts aim to gather a variety of files with specific extensions, including (.edb, .ems, .eme, .emz, .key, .pem, .ovpn, .bat, .cer, .p12, .cfg, .log, .txt, .pdf, .doc, .docx, .xls, .xlsx, and .rdg), primarily from desktop directories. In addition to this, the malware captures desktop screenshots and performs data exfiltration using HTTP. To maintain its presence on the targeted host, Winter Vivern also establishes a persistence mechanism, such as creating a scheduled task. references: diff --git a/stories/wordpress_vulnerabilities.yml b/stories/wordpress_vulnerabilities.yml index ce4a55b09d..e5f3253bcd 100644 --- a/stories/wordpress_vulnerabilities.yml +++ b/stories/wordpress_vulnerabilities.yml @@ -3,6 +3,7 @@ id: baeaee14-e439-4c95-91e8-aaedd8265c1c version: 1 date: '2024-02-22' author: Michael Haag, Splunk +status: production description: This analytic story provides a collection of analytics that detect potential exploitation of WordPress vulnerabilities. The analytics are focused on the detection of known vulnerabilities in WordPress plugins and themes. narrative: The following collection of analytics are focused on the detection of known vulnerabilities in WordPress plugins and themes. The analytics are focused on the detection of known vulnerabilities in WordPress plugins and themes. references: diff --git a/stories/ws_ftp_server_critical_vulnerabilities.yml b/stories/ws_ftp_server_critical_vulnerabilities.yml index 909f19a49d..32625f6aa4 100644 --- a/stories/ws_ftp_server_critical_vulnerabilities.yml +++ b/stories/ws_ftp_server_critical_vulnerabilities.yml @@ -3,6 +3,7 @@ id: 60466291-3ab4-452b-9c11-456aa2dc7293 version: 1 date: '2023-10-01' author: Michael Haag, Splunk +status: production description: A critical security advisory was released by Progress Software on September 27, 2023, concerning multiple vulnerabilities in WS_FTP Server, a widely-used secure file transfer solution. The two critical vulnerabilities are CVE-2023-40044, a .NET deserialization flaw, and CVE-2023-42657, a directory traversal vulnerability. Rapid7 has observed active exploitation of these vulnerabilities. Affected versions are prior to 8.7.4 and 8.8.2. Immediate action is advised - upgrade to WS_FTP Server version 8.8.2. For those unable to update, disabling the Ad Hoc Transfer module is suggested as a temporary measure. This comes in the wake of increased scrutiny following the Cl0p ransomware attack on MOVEit Transfer in May 2023. narrative: Two critical vulnerabilities have been identified in WS_FTP Server, a widely-used secure file transfer solution. The first, CVE-2023-40044, is a .NET deserialization flaw that targets the Ad Hoc Transfer module of WS_FTP Server versions earlier than 8.7.4 and 8.8.2. This flaw allows an attacker to execute arbitrary commands on the server's operating system without needing authentication. The second vulnerability, CVE-2023-42657, is a directory traversal flaw that allows attackers to perform unauthorized file operations outside of their authorized WS_FTP folder. In severe cases, the attacker could escape the WS_FTP Server file structure and perform operations on the underlying operating system. Both vulnerabilities have been observed being exploited in the wild and immediate action for mitigation is strongly advised. Updating to WS_FTP Server version 8.8.2 is recommended. For those unable to update, disabling the Ad Hoc Transfer module is suggested as a temporary measure. references: diff --git a/stories/xmrig.yml b/stories/xmrig.yml index b9768c5c04..cd94009b32 100644 --- a/stories/xmrig.yml +++ b/stories/xmrig.yml @@ -3,6 +3,7 @@ id: 06723e6a-6bd8-4817-ace2-5fb8a7b06628 version: 1 date: '2021-05-07' author: Teoderick Contreras, Rod Soto Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting diff --git a/stories/xorddos.yml b/stories/xorddos.yml index 4186ee24f2..d454d7fd86 100644 --- a/stories/xorddos.yml +++ b/stories/xorddos.yml @@ -3,6 +3,7 @@ id: 0958965b-82ea-48d0-bc00-01f1457bc93f version: 1 date: '2024-12-17' author: Teoderick Contreras, Splunk +status: production description: XorDdos is a sophisticated Linux malware that compromises devices to conduct high-capacity Distributed Denial of Service (DDoS) attacks. It employs XOR-based encryption to conceal its communications and utilizes rootkit capabilities to evade detection. The malware typically infiltrates systems through brute-force attacks on SSH services, enabling unauthorized access. Once installed, it can launch DDoS attacks exceeding 150 Gbps. To detect XorDdos, monitor for unusual network traffic patterns, unexpected processes, and unauthorized access attempts. Implementing strong, unique passwords and regularly updating system security measures are essential to mitigate the risk of infection. narrative: XorDdos is a sophisticated Linux malware strain known for leveraging infected devices to launch high-capacity Distributed Denial of Service (DDoS) attacks. First identified in 2014, XorDdos has evolved with advanced techniques to maintain stealth and effectiveness. The malware primarily targets Linux-based systems, infiltrating them through brute-force attacks on SSH services. Once compromised, it uses XOR-based encryption to mask its malicious activities and rootkit capabilities to evade detection. Detection involves monitoring for unusual system behavior, such as spikes in CPU usage, unexpected network traffic, and unauthorized SSH access attempts. Preventative measures include implementing strong passwords, disabling unused services, and ensuring systems are patched with the latest security updates. As this malware continues to adapt, maintaining robust cybersecurity practices is essential to defend against its growing threat. references: diff --git a/stories/zscaler_browser_proxy_threats.yml b/stories/zscaler_browser_proxy_threats.yml index 6c617d3011..7fffa92bd8 100644 --- a/stories/zscaler_browser_proxy_threats.yml +++ b/stories/zscaler_browser_proxy_threats.yml @@ -3,6 +3,7 @@ id: 5d4ba315-39df-4309-982f-a7052efccffd version: 1 date: '2023-10-25' author: Rod Soto, Gowthamaraj Rajendran +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to malicious activity from Zscaler. This also encompasses monitoring for events such as users downloading harmful files or accessing websites that pose a risk to system and network security. Additionally, the narrative extends to the detection of insider threats, ensuring comprehensive protection from both external and internal vulnerabilities. By leveraging Zscaler with Splunk, organizations can fortify their defenses, safeguarding against a wide spectrum of cyber threats and maintaining a secure operational environment. narrative: Zscaler Client Connector is an application installed on your device to ensure that your internet traffic and access to your organization's internal apps are secure and in compliance with your organization's policies, even when you're off your corporate network. references: From 18383600545fb6a8efae0d0e12e7befdd34dcd0a Mon Sep 17 00:00:00 2001 From: pyth0n1c Date: Fri, 24 Jan 2025 17:32:14 -0800 Subject: [PATCH 67/82] add status:deprecated to all investigations --- investigations/all_backup_logs_for_host.yml | 1 + investigations/amazon_eks_kubernetes_activity_by_src_ip.yml | 1 + investigations/aws_investigate_security_hub_alerts_by_dest.yml | 1 + .../aws_investigate_user_activities_by_accesskeyid.yml | 1 + investigations/aws_investigate_user_activities_by_arn.yml | 1 + investigations/aws_network_acl_details_from_id.yml | 1 + investigations/aws_network_interface_details_via_resourceid.yml | 1 + investigations/aws_s3_bucket_details_via_bucketname.yml | 1 + investigations/gcp_kubernetes_activity_by_src_ip.yml | 1 + investigations/get_all_aws_activity_from_city.yml | 1 + investigations/get_all_aws_activity_from_country.yml | 1 + investigations/get_all_aws_activity_from_ip_address.yml | 1 + investigations/get_all_aws_activity_from_region.yml | 1 + investigations/get_backup_logs_for_endpoint.yml | 1 + investigations/get_certificate_logs_for_a_domain.yml | 1 + investigations/get_dns_server_history_for_a_host.yml | 1 + investigations/get_dns_traffic_ratio.yml | 1 + investigations/get_ec2_instance_details_by_instanceid.yml | 1 + investigations/get_ec2_launch_details.yml | 1 + investigations/get_email_info.yml | 1 + investigations/get_emails_from_specific_sender.yml | 1 + ...get_first_occurrence_and_last_occurrence_of_a_mac_address.yml | 1 + investigations/get_history_of_email_sources.yml | 1 + investigations/get_logon_rights_modifications_for_endpoint.yml | 1 + investigations/get_logon_rights_modifications_for_user.yml | 1 + investigations/get_notable_history.yml | 1 + .../get_outbound_emails_to_hidden_cobra_threat_actors.yml | 1 + investigations/get_parent_process_info.yml | 1 + investigations/get_process_file_activity.yml | 1 + investigations/get_process_info.yml | 1 + investigations/get_process_information_for_port_activity.yml | 1 + investigations/get_process_responsible_for_the_dns_traffic.yml | 1 + investigations/get_sysmon_wmi_activity_for_host.yml | 1 + investigations/get_web_session_information_via_session_id.yml | 1 + investigations/investigate_aws_activities_via_region_name.yml | 1 + investigations/investigate_aws_user_activities_by_user_field.yml | 1 + .../investigate_failed_logins_for_multiple_destinations.yml | 1 + investigations/investigate_network_traffic_from_src_ip.yml | 1 + investigations/investigate_okta_activity_by_app.yml | 1 + investigations/investigate_okta_activity_by_ip_address.yml | 1 + investigations/investigate_pass_the_hash_attempts.yml | 1 + investigations/investigate_pass_the_ticket_attempts.yml | 1 + investigations/investigate_previous_unseen_user.yml | 1 + .../investigate_successful_remote_desktop_authentications.yml | 1 + investigations/investigate_suspicious_strings_in_http_header.yml | 1 + investigations/investigate_user_activities_in_okta.yml | 1 + investigations/investigate_web_posts_from_src.yml | 1 + 47 files changed, 47 insertions(+) diff --git a/investigations/all_backup_logs_for_host.yml b/investigations/all_backup_logs_for_host.yml index fb5ceeefa9..526e0760f2 100644 --- a/investigations/all_backup_logs_for_host.yml +++ b/investigations/all_backup_logs_for_host.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-12' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully. search: '| search `netbackup` dest=$dest$' diff --git a/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml b/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml index 549b3eec93..fdd85fd8e0 100644 --- a/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml +++ b/investigations/amazon_eks_kubernetes_activity_by_src_ip.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-04-13' author: Rod Soto, Splunk type: Investigation +status: deprecated description: This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster from a specific IP address diff --git a/investigations/aws_investigate_security_hub_alerts_by_dest.yml b/investigations/aws_investigate_security_hub_alerts_by_dest.yml index c000401848..c68fadb66c 100644 --- a/investigations/aws_investigate_security_hub_alerts_by_dest.yml +++ b/investigations/aws_investigate_security_hub_alerts_by_dest.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-06-08' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | diff --git a/investigations/aws_investigate_user_activities_by_accesskeyid.yml b/investigations/aws_investigate_user_activities_by_accesskeyid.yml index 52a16896d9..c9523dd2fd 100644 --- a/investigations/aws_investigate_user_activities_by_accesskeyid.yml +++ b/investigations/aws_investigate_user_activities_by_accesskeyid.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-08' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ diff --git a/investigations/aws_investigate_user_activities_by_arn.yml b/investigations/aws_investigate_user_activities_by_arn.yml index 6c928258e1..d15290547a 100644 --- a/investigations/aws_investigate_user_activities_by_arn.yml +++ b/investigations/aws_investigate_user_activities_by_arn.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-04-30' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and all the user's diff --git a/investigations/aws_network_acl_details_from_id.yml b/investigations/aws_network_acl_details_from_id.yml index 2e54e32512..71ef17baf8 100644 --- a/investigations/aws_network_acl_details_from_id.yml +++ b/investigations/aws_network_acl_details_from_id.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-01-22' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID search: '`aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ diff --git a/investigations/aws_network_interface_details_via_resourceid.yml b/investigations/aws_network_interface_details_via_resourceid.yml index 7ed717720b..081ba1bdc4 100644 --- a/investigations/aws_network_interface_details_via_resourceid.yml +++ b/investigations/aws_network_interface_details_via_resourceid.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will include the ARN of the network interface, its relationships with other AWS resources, diff --git a/investigations/aws_s3_bucket_details_via_bucketname.yml b/investigations/aws_s3_bucket_details_via_bucketname.yml index 875ea0b095..86946b4438 100644 --- a/investigations/aws_s3_bucket_details_via_bucketname.yml +++ b/investigations/aws_s3_bucket_details_via_bucketname.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-26' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket was created, the resource ID, the region it belongs to, the value of action performed, diff --git a/investigations/gcp_kubernetes_activity_by_src_ip.yml b/investigations/gcp_kubernetes_activity_by_src_ip.yml index df57d09804..d4359faeb0 100644 --- a/investigations/gcp_kubernetes_activity_by_src_ip.yml +++ b/investigations/gcp_kubernetes_activity_by_src_ip.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-04-13' author: Rod Soto, Splunk type: Investigation +status: deprecated description: This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes cluster from a specific IP address diff --git a/investigations/get_all_aws_activity_from_city.yml b/investigations/get_all_aws_activity_from_city.yml index 80cc059499..4e9d0f79a9 100644 --- a/investigations/get_all_aws_activity_from_city.yml +++ b/investigations/get_all_aws_activity_from_city.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether or not diff --git a/investigations/get_all_aws_activity_from_country.yml b/investigations/get_all_aws_activity_from_country.yml index e7b9c1124a..aef67b8395 100644 --- a/investigations/get_all_aws_activity_from_country.yml +++ b/investigations/get_all_aws_activity_from_country.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API called, and whether diff --git a/investigations/get_all_aws_activity_from_ip_address.yml b/investigations/get_all_aws_activity_from_ip_address.yml index ec81104fc7..ad00e31621 100644 --- a/investigations/get_all_aws_activity_from_ip_address.yml +++ b/investigations/get_all_aws_activity_from_ip_address.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP address, the AWS region the activity was in, the API called, and whether or not diff --git a/investigations/get_all_aws_activity_from_region.yml b/investigations/get_all_aws_activity_from_region.yml index a6e53b8bde..a9be04ab63 100644 --- a/investigations/get_all_aws_activity_from_region.yml +++ b/investigations/get_all_aws_activity_from_region.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-19' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the type of user, the source IP address, the AWS region the activity was in, the API diff --git a/investigations/get_backup_logs_for_endpoint.yml b/investigations/get_backup_logs_for_endpoint.yml index c1bd52ccac..92c86ed03a 100644 --- a/investigations/get_backup_logs_for_endpoint.yml +++ b/investigations/get_backup_logs_for_endpoint.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-14' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week. search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as diff --git a/investigations/get_certificate_logs_for_a_domain.yml b/investigations/get_certificate_logs_for_a_domain.yml index 932ed57c66..f0b2aa4a3d 100644 --- a/investigations/get_certificate_logs_for_a_domain.yml +++ b/investigations/get_certificate_logs_for_a_domain.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-04-29' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" are widely used by attackers. diff --git a/investigations/get_dns_server_history_for_a_host.yml b/investigations/get_dns_server_history_for_a_host.yml index 53ebad3fa0..58ba43d1c1 100644 --- a/investigations/get_dns_server_history_for_a_host.yml +++ b/investigations/get_dns_server_history_for_a_host.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-11-09' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data that is tagged as DNS and gives you a count and list of DNS servers that a particular diff --git a/investigations/get_dns_traffic_ratio.yml b/investigations/get_dns_traffic_ratio.yml index b9da20a5e3..ede0480799 100644 --- a/investigations/get_dns_traffic_ratio.yml +++ b/investigations/get_dns_traffic_ratio.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this ratio could be very useful to quickly understand if a src_ip (host) is sending a diff --git a/investigations/get_ec2_instance_details_by_instanceid.yml b/investigations/get_ec2_instance_details_by_instanceid.yml index 41faacccf5..ed0ddf0c52 100644 --- a/investigations/get_ec2_instance_details_by_instanceid.yml +++ b/investigations/get_ec2_instance_details_by_instanceid.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-02-12' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries AWS description logs and returns all the information about a specific instance via the instanceId field search: '`aws_description` | dedup id sortby -_time |rename id as instanceId| search diff --git a/investigations/get_ec2_launch_details.yml b/investigations/get_ec2_launch_details.yml index 9eced4ac58..46432d9945 100644 --- a/investigations/get_ec2_launch_details.yml +++ b/investigations/get_ec2_launch_details.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-03-12' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search returns some of the launch details for a EC2 instance. search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, diff --git a/investigations/get_email_info.yml b/investigations/get_email_info.yml index 778409bb43..247576a7cc 100644 --- a/investigations/get_email_info.yml +++ b/investigations/get_email_info.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-11-09' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search returns all the information Splunk might have collected a specific email message over the last 2 hours. search: '| from datamodel Email.All_Email | search message_id=$message_id$' diff --git a/investigations/get_emails_from_specific_sender.yml b/investigations/get_emails_from_specific_sender.yml index 109bbb8bf7..c4e5b0389a 100644 --- a/investigations/get_emails_from_specific_sender.yml +++ b/investigations/get_emails_from_specific_sender.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-11-09' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search returns all the emails from a specific sender over the last 24 and next hours. search: '| from datamodel Email.All_Email | search src_user=$src_user$' diff --git a/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml b/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml index 12c8480ae1..22da000f97 100644 --- a/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml +++ b/investigations/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine the first and last occurrences of the suspicious device attempting to connect with diff --git a/investigations/get_history_of_email_sources.yml b/investigations/get_history_of_email_sources.yml index b5ab421254..6b5b7d83af 100644 --- a/investigations/get_history_of_email_sources.yml +++ b/investigations/get_history_of_email_sources.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-02-21' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source. diff --git a/investigations/get_logon_rights_modifications_for_endpoint.yml b/investigations/get_logon_rights_modifications_for_endpoint.yml index 62a1483ba5..42405d395a 100644 --- a/investigations/get_logon_rights_modifications_for_endpoint.yml +++ b/investigations/get_logon_rights_modifications_for_endpoint.yml @@ -4,6 +4,7 @@ version: 2 date: '2017-09-12' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search allows you to retrieve any modifications to logon rights associated with a specific host. search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ diff --git a/investigations/get_logon_rights_modifications_for_user.yml b/investigations/get_logon_rights_modifications_for_user.yml index 5fcf3325d2..10d81579af 100644 --- a/investigations/get_logon_rights_modifications_for_user.yml +++ b/investigations/get_logon_rights_modifications_for_user.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-02-27' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search allows you to retrieve any modifications to logon rights for a specific user account. search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ diff --git a/investigations/get_notable_history.yml b/investigations/get_notable_history.yml index 01a9d592f6..0263940a86 100644 --- a/investigations/get_notable_history.yml +++ b/investigations/get_notable_history.yml @@ -4,6 +4,7 @@ version: 2 date: '2017-09-20' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents that may have occurred with the host under investigation. diff --git a/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml b/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml index ff887cae70..eb30eaa867 100644 --- a/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml +++ b/investigations/get_outbound_emails_to_hidden_cobra_threat_actors.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-14' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: 'This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, and from `redhat@gmail.com`.' diff --git a/investigations/get_parent_process_info.yml b/investigations/get_parent_process_info.yml index 0d909b9d3e..54a97aea2b 100644 --- a/investigations/get_parent_process_info.yml +++ b/investigations/get_parent_process_info.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-02-28' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest diff --git a/investigations/get_process_file_activity.yml b/investigations/get_process_file_activity.yml index a1acf702dd..04450db005 100644 --- a/investigations/get_process_file_activity.yml +++ b/investigations/get_process_file_activity.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-11-06' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search returns the file activity for a specific process on a specific endpoint search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as diff --git a/investigations/get_process_info.yml b/investigations/get_process_info.yml index 7dfe4d72ec..c5e6c10d84 100644 --- a/investigations/get_process_info.yml +++ b/investigations/get_process_info.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process info, enter the values for the process name in question and the destination IP address. diff --git a/investigations/get_process_information_for_port_activity.yml b/investigations/get_process_information_for_port_activity.yml index 95b0e406a4..de14541ff3 100644 --- a/investigations/get_process_information_for_port_activity.yml +++ b/investigations/get_process_information_for_port_activity.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as diff --git a/investigations/get_process_responsible_for_the_dns_traffic.yml b/investigations/get_process_responsible_for_the_dns_traffic.yml index 1ffd93df83..09b50690c7 100644 --- a/investigations/get_process_responsible_for_the_dns_traffic.yml +++ b/investigations/get_process_responsible_for_the_dns_traffic.yml @@ -4,6 +4,7 @@ version: 2 date: '2019-04-01' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and enter the value of `dest` in the search to get specific details on the process responsible diff --git a/investigations/get_sysmon_wmi_activity_for_host.yml b/investigations/get_sysmon_wmi_activity_for_host.yml index 61e769e8b9..e066466664 100644 --- a/investigations/get_sysmon_wmi_activity_for_host.yml +++ b/investigations/get_sysmon_wmi_activity_for_host.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-10-23' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: This search queries Sysmon WMI events for the host of interest. search: '`sysmon` EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter' diff --git a/investigations/get_web_session_information_via_session_id.yml b/investigations/get_web_session_information_via_session_id.yml index 86854006a5..955b678802 100644 --- a/investigations/get_web_session_information_via_session_id.yml +++ b/investigations/get_web_session_information_via_session_id.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-10-08' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID in the HTTP web traffic and outputs the URL and user agents, grouped by source IP diff --git a/investigations/investigate_aws_activities_via_region_name.yml b/investigations/investigate_aws_activities_via_region_name.yml index 0eaf244531..d1f8bd0bbb 100644 --- a/investigations/investigate_aws_activities_via_region_name.yml +++ b/investigations/investigate_aws_activities_via_region_name.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-02-09' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters requested, the type of the event and the response from the AWS API by each user diff --git a/investigations/investigate_aws_user_activities_by_user_field.yml b/investigations/investigate_aws_user_activities_by_user_field.yml index ad753be950..84f4231bcd 100644 --- a/investigations/investigate_aws_user_activities_by_user_field.yml +++ b/investigations/investigate_aws_user_activities_by_user_field.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the activity, the name and type of the event, the action taken, and the user's identity diff --git a/investigations/investigate_failed_logins_for_multiple_destinations.yml b/investigations/investigate_failed_logins_for_multiple_destinations.yml index 6047c78962..929d971fd4 100644 --- a/investigations/investigate_failed_logins_for_multiple_destinations.yml +++ b/investigations/investigate_failed_logins_for_multiple_destinations.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation +status: deprecated description: This search returns failed logins to multiple destinations by user. search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) diff --git a/investigations/investigate_network_traffic_from_src_ip.yml b/investigations/investigate_network_traffic_from_src_ip.yml index 560f4f52e3..ba7875b78f 100644 --- a/investigations/investigate_network_traffic_from_src_ip.yml +++ b/investigations/investigate_network_traffic_from_src_ip.yml @@ -4,6 +4,7 @@ version: 1 date: '2018-06-15' author: David Dorsey, Splunk type: Investigation +status: deprecated description: This search allows you to find all the network traffic from a specific IP address. search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$' diff --git a/investigations/investigate_okta_activity_by_app.yml b/investigations/investigate_okta_activity_by_app.yml index 875e9467c5..9c9111a9aa 100644 --- a/investigations/investigate_okta_activity_by_app.yml +++ b/investigations/investigate_okta_activity_by_app.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: This search returns all okta events associated with a specific app search: '`okta` app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_okta_activity_by_ip_address.yml b/investigations/investigate_okta_activity_by_ip_address.yml index 07b5763759..a3a945fed5 100644 --- a/investigations/investigate_okta_activity_by_ip_address.yml +++ b/investigations/investigate_okta_activity_by_ip_address.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: This search returns all okta events from a specific IP address. search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_pass_the_hash_attempts.yml b/investigations/investigate_pass_the_hash_attempts.yml index 58dd9550af..e4a495f05f 100644 --- a/investigations/investigate_pass_the_hash_attempts.yml +++ b/investigations/investigate_pass_the_hash_attempts.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation +status: deprecated description: This search hunts for dumped NTLM hashes used for pass the hash. search: '`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate | stats count earliest(_time) as first_login latest(_time) as last_login by src_user diff --git a/investigations/investigate_pass_the_ticket_attempts.yml b/investigations/investigate_pass_the_ticket_attempts.yml index 6fe8ef1f33..3e971419a5 100644 --- a/investigations/investigate_pass_the_ticket_attempts.yml +++ b/investigations/investigate_pass_the_ticket_attempts.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Patrick Bareiss, Splunk type: Investigation +status: deprecated description: This search hunts for dumped kerberos ticket from LSASS memory. search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) diff --git a/investigations/investigate_previous_unseen_user.yml b/investigations/investigate_previous_unseen_user.yml index 861bd4b1e4..1e70b07b01 100644 --- a/investigations/investigate_previous_unseen_user.yml +++ b/investigations/investigate_previous_unseen_user.yml @@ -4,6 +4,7 @@ version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk type: Investigation +status: deprecated description: This search returns previous unseen user, which didn't log in for 30 days. search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login diff --git a/investigations/investigate_successful_remote_desktop_authentications.yml b/investigations/investigate_successful_remote_desktop_authentications.yml index f763bc9c43..b5c02044c6 100644 --- a/investigations/investigate_successful_remote_desktop_authentications.yml +++ b/investigations/investigate_successful_remote_desktop_authentications.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Jose Hernandez, Splunk type: Investigation +status: deprecated description: This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force attack on a destination machine is suspicious behavior. diff --git a/investigations/investigate_suspicious_strings_in_http_header.yml b/investigations/investigate_suspicious_strings_in_http_header.yml index 9dffaedc6b..d2d83857e1 100644 --- a/investigations/investigate_suspicious_strings_in_http_header.yml +++ b/investigations/investigate_suspicious_strings_in_http_header.yml @@ -4,6 +4,7 @@ version: 1 date: '2017-10-20' author: Bhavin Patel, Splunk type: Investigation +status: deprecated description: This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and analyze the "payload" or the commands that were passed to the vulnerable hosts by diff --git a/investigations/investigate_user_activities_in_okta.yml b/investigations/investigate_user_activities_in_okta.yml index 5e0af3da3d..522e019822 100644 --- a/investigations/investigate_user_activities_in_okta.yml +++ b/investigations/investigate_user_activities_in_okta.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-04-02' author: Rico Valdez, Splunk type: Investigation +status: deprecated description: This search returns all okta events by a specific user search: '`okta` user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city diff --git a/investigations/investigate_web_posts_from_src.yml b/investigations/investigate_web_posts_from_src.yml index 267c3fdb22..4e331f13bc 100644 --- a/investigations/investigate_web_posts_from_src.yml +++ b/investigations/investigate_web_posts_from_src.yml @@ -4,6 +4,7 @@ version: 2 date: '2024-09-24' author: Jose Hernandez, Splunk type: Investigation +status: deprecated description: This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination URLs and user agent(s), may help you scope and characterize the suspicious traffic. From 61e4add063b3e4a09454cf603d06703f87a99f92 Mon Sep 17 00:00:00 2001 From: tccontre Date: Mon, 27 Jan 2025 10:18:08 +0100 Subject: [PATCH 68/82] updated_nexus_activity --- .../endpoint/any_powershell_downloadfile.yml | 21 +++--- detections/endpoint/detect_renamed_psexec.yml | 23 +++--- detections/endpoint/detect_renamed_winrar.yml | 9 ++- ..._or_script_creation_in_suspicious_path.yml | 75 ++++++++++--------- ...file_permission_modification_via_chmod.yml | 21 +++--- ..._auditd_nopasswd_entry_in_sudoers_file.yml | 11 +-- ...td_possible_access_to_credential_files.yml | 11 +-- ...auditd_possible_access_to_sudoers_file.yml | 11 +-- ...ux_auditd_preload_hijack_library_calls.yml | 43 +++++++++-- ...x_common_process_for_elevation_control.yml | 11 +-- ...x_file_creation_in_init_boot_directory.yml | 11 +-- .../linux_iptables_firewall_modification.yml | 9 ++- .../linux_nopasswd_entry_in_sudoers_file.yml | 9 ++- ...ux_possible_access_to_credential_files.yml | 11 +-- .../linux_possible_access_to_sudoers_file.yml | 9 ++- .../linux_preload_hijack_library_calls.yml | 9 ++- .../linux_sudoers_tmp_file_creation.yml | 9 ++- ...hell_process___execution_policy_bypass.yml | 47 +++++++++--- ...e_process_accessing_chrome_default_dir.yml | 25 ++++--- .../endpoint/powershell_4104_hunting.yml | 23 +++--- .../registry_keys_used_for_persistence.yml | 48 ++++++------ .../remote_process_instantiation_via_wmi.yml | 13 ++-- ...eduled_task_deleted_or_created_via_cmd.yml | 45 +++++------ ...ious_regsvr32_register_suspicious_path.yml | 12 +-- ...s_scheduled_task_from_public_directory.yml | 21 +++--- ...ss_token_manipulation_sedebugprivilege.yml | 17 +++-- ...windows_archive_collected_data_via_rar.yml | 9 ++- ...ssword_stores_chrome_localstate_access.yml | 23 +++--- ...ssword_stores_chrome_login_data_access.yml | 23 +++--- ...ndows_curl_download_to_suspicious_path.yml | 13 ++-- ...ws_replication_through_removable_media.yml | 14 ++-- ...e_created_with_suspicious_service_path.yml | 20 ++--- ..._service_creation_using_registry_entry.yml | 16 ++-- .../windows_unsigned_dll_side_loading.yml | 10 ++- ..._dll_side_loading_in_same_process_path.yml | 12 +-- .../windows_unsigned_ms_dll_side_loading.yml | 10 ++- ..._scheduled_task_created_to_spawn_shell.yml | 17 +++-- ...eduled_task_created_within_public_path.yml | 29 +++---- .../detect_large_outbound_icmp_packets.yml | 37 +++++---- stories/backdoor_pingpong.yml | 17 +++++ stories/derusbi.yml | 19 +++++ stories/earth_estries.yml | 17 +++++ stories/nexus_apt_threat_activity.yml | 20 +++++ stories/windealer_rat.yml | 17 +++++ 44 files changed, 535 insertions(+), 342 deletions(-) create mode 100644 stories/backdoor_pingpong.yml create mode 100644 stories/derusbi.yml create mode 100644 stories/earth_estries.yml create mode 100644 stories/nexus_apt_threat_activity.yml create mode 100644 stories/windealer_rat.yml diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 1d0c469626..18cadadfe0 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -1,7 +1,7 @@ name: Any Powershell DownloadFile id: 1a93b7ea-7af7-11eb-adb5-acde48001122 -version: 8 -date: '2024-11-13' +version: '10' +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -71,16 +71,18 @@ rba: type: process_name tags: analytic_story: - - Hermetic Wiper - - Log4Shell CVE-2021-44228 - - Phemedrone Stealer - Data Destruction - - PXA Stealer - Ingress Tool Transfer - - Malicious PowerShell - DarkCrystal RAT - - Crypto Stealer + - PXA Stealer - Braodo Stealer + - Phemedrone Stealer + - Log4Shell CVE-2021-44228 + - Malicious PowerShell + - Hermetic Wiper + - Crypto Stealer + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint cve: - CVE-2021-44228 @@ -96,7 +98,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index e28038219d..747949fa2f 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -1,7 +1,7 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: 9 -date: '2024-11-13' +version: '11' +date: '2025-01-27' author: Michael Haag, Splunk, Alex Oberkircher, Github Community status: production type: Hunting @@ -39,15 +39,17 @@ references: - https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ tags: analytic_story: - - SamSam Ransomware - - DHS Report TA18-074A - - HAFNIUM Group - - DarkSide Ransomware - - Active Directory Lateral Movement - - CISA AA22-320A - - Sandworm Tools - BlackByte Ransomware + - DHS Report TA18-074A + - DarkSide Ransomware + - SamSam Ransomware + - CISA AA22-320A + - HAFNIUM Group + - Sandworm Tools + - Active Directory Lateral Movement + - Nexus APT Threat Activity - DarkGate Malware + - Earth Estries - Rhysida Ransomware asset_type: Endpoint mitre_attack_id: @@ -61,7 +63,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index 08dbb45f87..d51e6a4877 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -1,7 +1,7 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: 7 -date: '2024-11-13' +version: '9' +date: '2025-01-27' author: Michael Haag, Splunk status: production type: Hunting @@ -39,6 +39,8 @@ references: tags: analytic_story: - Collection and Staging + - Earth Estries + - Nexus APT Threat Activity - CISA AA22-277A asset_type: Endpoint mitre_attack_id: @@ -52,7 +54,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 8d26940000..b9ee29d61d 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,7 +1,7 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: 6 -date: '2024-12-10' +version: '11' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -61,42 +61,46 @@ rba: type: file_name tags: analytic_story: - - Volt Typhoon - - LockBit Ransomware - - Data Destruction - - Snake Keylogger - - XMRig - - DarkGate Malware - Chaos Ransomware - - Double Zero Destructor - - Hermetic Wiper - - Warzone RAT - - AcidPour - - Graceful Wipe Out Attack - - BlackByte Ransomware - - IcedID - - NjRAT - - Handala Wiper - - Meduza Stealer - - CISA AA23-347A - - AsyncRAT - - Amadey - - Industroyer2 - - ValleyRAT - - Rhysida Ransomware - - DarkCrystal RAT - - Crypto Stealer - - Azorult - - Swift Slicer - - AgentTesla - - Qakbot - - Remcos - Trickbot + - Snake Keylogger + - CISA AA23-347A + - Industroyer2 + - WinDealer RAT + - Qakbot + - Warzone RAT + - IcedID + - ValleyRAT + - Azorult + - Handala Wiper + - LockBit Ransomware + - Meduza Stealer - Brute Ratel C4 - - RedLine Stealer - - PlugX - - MoonPeak + - AsyncRAT + - AcidPour + - Derusbi + - DarkGate Malware + - Graceful Wipe Out Attack + - NjRAT - WhisperGate + - Data Destruction + - BlackByte Ransomware + - AgentTesla + - Swift Slicer + - Crypto Stealer + - Hermetic Wiper + - MoonPeak + - Double Zero Destructor + - XMRig + - PlugX + - Amadey + - DarkCrystal RAT + - Remcos + - Nexus APT Threat Activity + - Earth Estries + - Rhysida Ransomware + - RedLine Stealer + - Volt Typhoon asset_type: Endpoint mitre_attack_id: - T1036 @@ -108,7 +112,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/xmrig_miner/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index d0316fa643..0ab0f724af 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -1,8 +1,8 @@ name: Linux Auditd File Permission Modification Via Chmod id: 5f1d2ea7-eec0-4790-8b24-6875312ad492 -version: 5 -date: '2024-12-19' -author: Teoderick Contreras, Splunk, Ivar Nygård +version: '7' +date: '2025-01-27' +author: "Teoderick Contreras, Splunk, Ivar Nyg\xE5rd" status: production type: Anomaly description: The following analytic detects suspicious file permission modifications @@ -22,9 +22,9 @@ search: '`linux_auditd` `linux_auditd_normalized_proctitle_process` | rename hos max(_time) as lastTime by process_exec proctitle dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_file_permission_modification_via_chmod_filter`' how_to_implement: To implement this detection, the process begins by ingesting auditd - data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line - executions and process details on Unix/Linux systems. These logs should be ingested - and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures + command-line executions and process details on Unix/Linux systems. These logs should + be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources @@ -58,11 +58,13 @@ rba: threat_objects: [] tags: analytic_story: - - XorDDos + - Linux Privilege Escalation - Linux Living Off The Land - Compromised Linux Host - - Linux Privilege Escalation - Linux Persistence Techniques + - XorDDos + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1222.002 @@ -75,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.002/linux_auditd_chmod_exec_attrib/linux_auditd_chmod_exec_attrib.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index 2f6788506b..e908685866 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Nopasswd Entry In Sudoers File id: 651df959-ad17-4b73-a323-90cb96d5fa1b -version: 3 -date: '2024-11-13' +version: '5' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,8 +58,10 @@ rba: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Compromised Linux Host + - Linux Persistence Techniques + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.003 @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_nopasswd/linux_auditd_nopasswd.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index ce1805c364..8547e8a0c9 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 -version: 3 -date: '2024-11-13' +version: '5' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -60,8 +60,10 @@ rba: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Compromised Linux Host + - Linux Persistence Techniques + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1003.008 @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/linux_auditd_access_credential/linux_auditd_access_credential.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index 89197c710b..e41acccf8d 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Auditd Possible Access To Sudoers File id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 -version: 3 -date: '2024-11-13' +version: '5' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,8 +57,10 @@ rba: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Compromised Linux Host + - Linux Persistence Techniques + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.003 @@ -71,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/linux_auditd_sudoers_access/linux_auditd_sudoers_access.log source: /var/log/audit/audit.log sourcetype: linux:audit diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index 905d2fd1db..da96d1753d 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -1,16 +1,36 @@ name: Linux Auditd Preload Hijack Library Calls id: 35c50572-a70b-452f-afa9-bebdf3c3ce36 -version: 3 -date: '2025-01-16' +version: '5' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: TTP -description: The following analytic detects the use of the LD_PRELOAD environment variable to hijack or hook library functions on a Linux platform. It leverages data from Linux Auditd, focusing on process execution logs that include command-line details. This activity is significant because adversaries, malware authors, and red teamers commonly use this technique to gain elevated privileges and establish persistence on a compromised machine. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, and maintain long-term access to the system. +description: The following analytic detects the use of the LD_PRELOAD environment + variable to hijack or hook library functions on a Linux platform. It leverages data + from Linux Auditd, focusing on process execution logs that include command-line + details. This activity is significant because adversaries, malware authors, and + red teamers commonly use this technique to gain elevated privileges and establish + persistence on a compromised machine. If confirmed malicious, this behavior could + allow attackers to execute arbitrary code, escalate privileges, and maintain long-term + access to the system. data_source: - Linux Auditd Execve -search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, "%LD_PRELOAD%")| stats count min(_time) as firstTime max(_time) as lastTime by argc process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `linux_auditd_preload_hijack_library_calls_filter`' -how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed -known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives. +search: '`linux_auditd` `linux_auditd_normalized_execve_process` | rename host as + dest | rename comm as process_name | rename exe as process | where LIKE (process_exec, + "%LD_PRELOAD%")| stats count min(_time) as firstTime max(_time) as lastTime by argc + process_exec dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| + `linux_auditd_preload_hijack_library_calls_filter`' +how_to_implement: To implement this detection, the process begins by ingesting auditd + data, that consists of SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures + command-line executions and process details on Unix/Linux systems. These logs should + be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), + which is essential for correctly parsing and categorizing the data. The next step + involves normalizing the field names to match the field names set by the Splunk + Common Information Model (CIM) to ensure consistency across different data sources + and enhance the efficiency of data modeling. This approach enables effective monitoring + and detection of linux endpoints where auditd is deployed +known_false_positives: Administrator or network operator can execute this command. + Please update the filter macros to remove false positives. references: - https://compilepeace.medium.com/memory-malware-part-0x2-writing-userland-rootkits-via-ld-preload-30121c8343d5 drilldown_searches: @@ -19,7 +39,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -33,8 +58,10 @@ rba: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Compromised Linux Host + - Linux Persistence Techniques + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1574.006 diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index 76739b4d0c..cc9c0dad39 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -1,7 +1,7 @@ name: Linux Common Process For Elevation Control id: 66ab15c0-63d0-11ec-9e70-acde48001122 -version: 4 -date: '2024-11-13' +version: '6' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Hunting @@ -45,8 +45,10 @@ references: tags: analytic_story: - Linux Privilege Escalation - - Linux Persistence Techniques - Linux Living Off The Land + - Linux Persistence Techniques + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1548.001 @@ -59,7 +61,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.001/chmod_uid/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index e5c714cbed..6fcca1a2fc 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -1,7 +1,7 @@ name: Linux File Creation In Init Boot Directory id: 97d9cfb2-61ad-11ec-bb2d-acde48001122 -version: 5 -date: '2024-12-19' +version: '7' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,9 +49,11 @@ rba: threat_objects: [] tags: analytic_story: + - Linux Privilege Escalation + - Backdoor Pingpong - Linux Persistence Techniques - XorDDos - - Linux Privilege Escalation + - Nexus APT Threat Activity asset_type: Endpoint mitre_attack_id: - T1037.004 @@ -64,7 +66,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1546.004/linux_init_profile/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index 40089e9a41..e205677b08 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,7 +1,7 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: 6 -date: '2024-11-13' +version: '8' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -67,6 +67,8 @@ rba: tags: analytic_story: - Sandworm Tools + - Backdoor Pingpong + - Nexus APT Threat Activity - Cyclops Blink asset_type: Endpoint mitre_attack_id: @@ -80,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/cyclopsblink/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index 57cecb4c36..4b2e2393a9 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux NOPASSWD Entry In Sudoers File id: ab1e0d52-624a-11ec-8e0b-acde48001122 -version: 4 -date: '2024-11-13' +version: '6' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -59,6 +59,8 @@ rba: tags: analytic_story: - Linux Privilege Escalation + - Earth Estries + - Nexus APT Threat Activity - Linux Persistence Techniques asset_type: Endpoint mitre_attack_id: @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/nopasswd_sudoers/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index cf66f3b765..7825288713 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -1,7 +1,7 @@ name: Linux Possible Access To Credential Files id: 16107e0e-71fc-11ec-b862-acde48001122 -version: 5 -date: '2024-12-19' +version: '7' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,9 +57,11 @@ rba: threat_objects: [] tags: analytic_story: + - Linux Privilege Escalation - Linux Persistence Techniques - XorDDos - - Linux Privilege Escalation + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1003.008 @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index e23d63ea29..ce0491e3dd 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -1,7 +1,7 @@ name: Linux Possible Access To Sudoers File id: 4479539c-71fc-11ec-b2e2-acde48001122 -version: 4 -date: '2024-11-13' +version: '6' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -58,6 +58,8 @@ rba: tags: analytic_story: - Linux Privilege Escalation + - Earth Estries + - Nexus APT Threat Activity - Linux Persistence Techniques asset_type: Endpoint mitre_attack_id: @@ -71,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.008/copy_file_stdoutpipe/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index e5f075a774..f9dbbe5d4b 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -1,7 +1,7 @@ name: Linux Preload Hijack Library Calls id: cbe2ca30-631e-11ec-8670-acde48001122 -version: 4 -date: '2024-11-13' +version: '6' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -58,6 +58,8 @@ rba: tags: analytic_story: - Linux Privilege Escalation + - Earth Estries + - Nexus APT Threat Activity - Linux Persistence Techniques asset_type: Endpoint mitre_attack_id: @@ -71,7 +73,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.006/lib_hijack/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index 71b5a42aaf..4e903212ae 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -1,7 +1,7 @@ name: Linux Sudoers Tmp File Creation id: be254a5c-63e7-11ec-89da-acde48001122 -version: 4 -date: '2024-11-13' +version: '6' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,6 +52,8 @@ rba: tags: analytic_story: - Linux Privilege Escalation + - Earth Estries + - Nexus APT Threat Activity - Linux Persistence Techniques asset_type: Endpoint mitre_attack_id: @@ -65,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548.003/sudoers_temp/sysmon_linux.log source: Syslog:Linux-Sysmon/Operational sourcetype: sysmon:linux diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 41471fc7c0..1b8771cb20 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,18 +1,40 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: 8 -date: '2024-12-16' +version: '10' +date: '2025-01-27' author: Rico Valdez, Mauricio Velazco, Splunk status: production type: Anomaly -description: The following analytic detects PowerShell processes initiated with parameters that bypass the local execution policy for scripts. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions containing specific flags like "-ex" or "bypass." This activity is significant because bypassing execution policies is a common tactic used by attackers to run malicious scripts undetected. If confirmed malicious, this could allow an attacker to execute arbitrary code, potentially leading to further system compromise, data exfiltration, or persistent access within the environment. +description: The following analytic detects PowerShell processes initiated with parameters + that bypass the local execution policy for scripts. It leverages data from Endpoint + Detection and Response (EDR) agents, focusing on command-line executions containing + specific flags like "-ex" or "bypass." This activity is significant because bypassing + execution policies is a common tactic used by attackers to run malicious scripts + undetected. If confirmed malicious, this could allow an attacker to execute arbitrary + code, potentially leading to further system compromise, data exfiltration, or persistent + access within the environment. data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 - CrowdStrike ProcessRollup2 -search: '| tstats `security_content_summariesonly` values(Processes.process_id) as process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="* -ex*" AND Processes.process="* bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`' -how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. -known_false_positives: There may be legitimate reasons to bypass the PowerShell execution policy. The PowerShell script being run with this parameter should be validated to ensure that it is legitimate. +search: '| tstats `security_content_summariesonly` values(Processes.process_id) as + process_id, values(Processes.parent_process_id) as parent_process_id values(Processes.process) + as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where `process_powershell` (Processes.process="* -ex*" AND Processes.process="* + bypass *") by Processes.process_id, Processes.user, Processes.dest | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `malicious_powershell_process___execution_policy_bypass_filter`' +how_to_implement: The detection is based on data that originates from Endpoint Detection + and Response (EDR) agents. These agents are designed to provide security-related + telemetry from the endpoints where the agent is installed. To implement this search, + you must ingest logs that contain the process GUID, process name, and parent process. + Additionally, you must ingest complete command-line executions. These logs must + be processed using the appropriate Splunk Technology Add-ons that are specific to + the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` + data model. Use the Splunk Common Information Model (CIM) to normalize the field + names and speed up the data modeling process. +known_false_positives: There may be legitimate reasons to bypass the PowerShell execution + policy. The PowerShell script being run with this parameter should be validated + to ensure that it is legitimate. references: - https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/ drilldown_searches: @@ -21,7 +43,12 @@ drilldown_searches: earliest_offset: $info_min_time$ latest_offset: $info_max_time$ - name: View risk events for the last 7 days for - "$dest$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$dest$") + starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime + values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) + as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) + as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)`' earliest_offset: $info_min_time$ latest_offset: $info_max_time$ rba: @@ -34,9 +61,11 @@ rba: tags: analytic_story: - DHS Report TA18-074A - - HAFNIUM Group - - DarkCrystal RAT - AsyncRAT + - DarkCrystal RAT + - HAFNIUM Group + - Nexus APT Threat Activity + - Earth Estries - Volt Typhoon asset_type: Endpoint mitre_attack_id: diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 39954eb225..d6d4cef008 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,7 +1,7 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: 5 -date: '2024-11-13' +version: '7' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -49,17 +49,19 @@ rba: threat_objects: [] tags: analytic_story: - - Remcos - - NjRAT - - Warzone RAT + - Snake Keylogger + - CISA AA23-347A - 3CX Supply Chain Attack - - RedLine Stealer + - Warzone RAT + - Remcos + - AgentTesla + - Phemedrone Stealer - FIN7 - DarkGate Malware - - AgentTesla - - CISA AA23-347A - - Phemedrone Stealer - - Snake Keylogger + - Nexus APT Threat Activity + - Earth Estries + - NjRAT + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1555 @@ -72,7 +74,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/non_chrome_process_accessing_chrome_default_dir/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/non_chrome_process_accessing_chrome_default_dir/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 34677f910e..e51bf17f33 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,7 +1,7 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: 9 -date: '2024-12-16' +version: '11' +date: '2025-01-27' author: Michael Haag, Splunk status: production type: Hunting @@ -59,17 +59,19 @@ references: - https://adlumin.com/post/powerdrop-a-new-insidious-powershell-script-for-command-and-control-attacks-targets-u-s-aerospace-defense-industry/ tags: analytic_story: - - Malicious PowerShell - - Hermetic Wiper - - Rhysida Ransomware - - DarkGate Malware + - Data Destruction - Flax Typhoon - CISA AA23-347A - - Data Destruction - - CISA AA24-241A - Braodo Stealer - - Lumma Stealer - Cleo File Transfer Software + - Malicious PowerShell + - Hermetic Wiper + - DarkGate Malware + - Lumma Stealer + - Nexus APT Threat Activity + - Earth Estries + - Rhysida Ransomware + - CISA AA24-241A asset_type: Endpoint mitre_attack_id: - T1059 @@ -82,7 +84,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_script_block_logging/sbl_xml.log source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index d8633a87fa..5d91fcacff 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,7 +1,7 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: 13 -date: '2024-12-16' +version: '16' +date: '2025-01-27' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production type: TTP @@ -77,32 +77,35 @@ rba: threat_objects: [] tags: analytic_story: - - AsyncRAT - - Ransomware + - Chaos Ransomware - Windows Persistence Techniques + - DHS Report TA18-074A + - Snake Keylogger + - CISA AA23-347A + - WinDealer RAT + - Qakbot + - Warzone RAT + - IcedID + - Azorult + - Suspicious Windows Registry Activities + - AsyncRAT + - Derusbi + - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - DarkGate Malware - NjRAT - - RedLine Stealer - - IcedID - - Sneaky Active Directory Persistence Tricks - - Chaos Ransomware - - Azorult - - DHS Report TA18-074A - - Emotet Malware DHS Report TA18-201A - - Remcos - - Windows Registry Abuse - - Qakbot - - Suspicious MSHTA Activity - - Suspicious Windows Registry Activities - - Warzone RAT - - Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns - - Amadey - BlackByte Ransomware - - CISA AA23-347A - - Snake Keylogger + - Ransomware - MoonPeak - BlackSuit Ransomware + - Emotet Malware DHS Report TA18-201A + - Sneaky Active Directory Persistence Tricks + - Amadey + - Remcos - Braodo Stealer + - Windows Registry Abuse + - Nexus APT Threat Activity + - Suspicious MSHTA Activity + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1547.001 @@ -115,7 +118,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 9f94569a83..4fa23a29ef 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -1,7 +1,7 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -version: 10 -date: '2024-11-13' +version: '12' +date: '2025-01-27' author: Rico Valdez, Mauricio Velazco, Splunk status: production type: TTP @@ -65,10 +65,12 @@ rba: threat_objects: [] tags: analytic_story: - - Ransomware - CISA AA23-347A - - Active Directory Lateral Movement + - Ransomware - Suspicious WMI Use + - Active Directory Lateral Movement + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1047 @@ -80,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index c7dc14ae19..4ed78d182f 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -1,7 +1,7 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c -version: 9 -date: '2024-11-13' +version: '11' +date: '2025-01-27' author: Bhavin Patel, Splunk status: production type: TTP @@ -66,30 +66,32 @@ rba: threat_objects: [] tags: analytic_story: - - AsyncRAT - - Winter Vivern - Windows Persistence Techniques - - Living Off The Land - - Prestige Ransomware - - AgentTesla - - NjRAT - - RedLine Stealer - - Rhysida Ransomware - - Azorult - DHS Report TA18-074A - - Scheduled Tasks - - Sandworm Tools - - Qakbot - - CISA AA22-257A - Trickbot + - CISA AA23-347A + - Qakbot + - Azorult + - ShrinkLocker + - AsyncRAT + - Phemedrone Stealer + - NjRAT + - Prestige Ransomware + - Scheduled Tasks + - AgentTesla + - MoonPeak - NOBELIUM Group + - Living Off The Land + - CISA AA22-257A + - CISA AA24-241A - Amadey - DarkCrystal RAT - - CISA AA23-347A - - Phemedrone Stealer - - ShrinkLocker - - MoonPeak - - CISA AA24-241A + - Sandworm Tools + - Winter Vivern + - Nexus APT Threat Activity + - Earth Estries + - Rhysida Ransomware + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -102,7 +104,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 25cbe43482..57f788e652 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -1,7 +1,7 @@ name: Suspicious Regsvr32 Register Suspicious Path id: 62732736-6250-11eb-ae93-0242ac130002 -version: 7 -date: '2024-11-13' +version: '11' +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -73,10 +73,13 @@ rba: type: process_name tags: analytic_story: + - Qakbot + - Earth Estries - Suspicious Regsvr32 Activity - IcedID + - Derusbi + - Nexus APT Threat Activity - Living Off The Land - - Qakbot asset_type: Endpoint mitre_attack_id: - T1218 @@ -89,7 +92,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.010/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index 3ec0084750..e4658dde75 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -1,7 +1,7 @@ name: Suspicious Scheduled Task from Public Directory id: 7feb7972-7ac3-11eb-bac8-acde48001122 -version: 4 -date: '2024-11-13' +version: '6' +date: '2025-01-27' author: Michael Haag, Splunk status: production type: Anomaly @@ -65,17 +65,19 @@ rba: threat_objects: [] tags: analytic_story: - - Azorult - - MoonPeak - - CISA AA24-241A - Windows Persistence Techniques - CISA AA23-347A - Ransomware - - Scheduled Tasks - - Ryuk Ransomware - - Crypto Stealer - DarkCrystal RAT + - Scheduled Tasks + - Azorult + - Crypto Stealer + - Nexus APT Threat Activity - Living Off The Land + - MoonPeak + - Ryuk Ransomware + - Earth Estries + - CISA AA24-241A asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -88,7 +90,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/schtasks/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index 01b12d08d9..bdad60d3fa 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -1,7 +1,7 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 -version: 6 -date: '2024-12-10' +version: '11' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -57,12 +57,16 @@ rba: tags: analytic_story: - Brute Ratel C4 - - AsyncRAT - - DarkGate Malware - - CISA AA23-347A - PlugX + - AsyncRAT + - CISA AA23-347A + - WinDealer RAT - ValleyRAT + - Derusbi + - Nexus APT Threat Activity + - DarkGate Malware - Meduza Stealer + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1134.002 @@ -75,7 +79,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/brute_ratel/sedebugprivilege_token/security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_archive_collected_data_via_rar.yml b/detections/endpoint/windows_archive_collected_data_via_rar.yml index 4001d4d719..3c00d940fc 100644 --- a/detections/endpoint/windows_archive_collected_data_via_rar.yml +++ b/detections/endpoint/windows_archive_collected_data_via_rar.yml @@ -1,7 +1,7 @@ name: Windows Archive Collected Data via Rar id: 2015de95-fe91-413d-9d62-2fe011b67e82 -version: 4 -date: '2024-11-13' +version: '6' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -61,6 +61,8 @@ rba: threat_objects: [] tags: analytic_story: + - Earth Estries + - Nexus APT Threat Activity - DarkGate Malware asset_type: Endpoint mitre_attack_id: @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility_darkgate/rar_sys.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 4187f7e939..35513fe4b0 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,7 +1,7 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: 6 -date: '2024-12-10' +version: '8' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -51,17 +51,19 @@ rba: threat_objects: [] tags: analytic_story: - - RedLine Stealer + - Snake Keylogger - Amadey - Warzone RAT - - NjRAT - - DarkGate Malware - - Phemedrone Stealer - - Snake Keylogger - - MoonPeak - - Braodo Stealer - PXA Stealer + - Braodo Stealer + - Phemedrone Stealer + - Nexus APT Threat Activity + - DarkGate Malware - Meduza Stealer + - MoonPeak + - Earth Estries + - NjRAT + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1012 @@ -73,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_local_state_simulate_access/redline-localstate-smalldata-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_local_state_simulate_access/redline-localstate-smalldata-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index e09e6ae597..3c20df25f3 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,7 +1,7 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: 6 -date: '2024-12-10' +version: '8' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,17 +52,19 @@ rba: threat_objects: [] tags: analytic_story: - - RedLine Stealer + - Snake Keylogger - Amadey - Warzone RAT - - NjRAT - - DarkGate Malware - - Phemedrone Stealer - - Snake Keylogger - - MoonPeak - - Braodo Stealer - PXA Stealer + - Braodo Stealer + - Phemedrone Stealer + - Nexus APT Threat Activity + - DarkGate Malware - Meduza Stealer + - MoonPeak + - Earth Estries + - NjRAT + - RedLine Stealer asset_type: Endpoint mitre_attack_id: - T1012 @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_login_data_simulate_access/redline-login-data-security-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/redline/chrome_login_data_simulate_access/redline-login-data-security-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 34dfea6cf0..25e3e21929 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,7 +1,7 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: 6 -date: '2024-12-10' +version: '8' +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -70,10 +70,12 @@ rba: type: process_name tags: analytic_story: - - IcedID - - Compromised Windows Host - Ingress Tool Transfer - Forest Blizzard + - IcedID + - Nexus APT Threat Activity + - Compromised Windows Host + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1105 @@ -85,7 +87,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 0c8c2b33db..82cb5ab77e 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -1,7 +1,7 @@ name: Windows Replication Through Removable Media id: 60df805d-4605-41c8-bbba-57baa6a4eb97 -version: 4 -date: '2024-11-13' +version: '8' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: TTP @@ -60,9 +60,12 @@ rba: type: file_name tags: analytic_story: - - Chaos Ransomware - - NjRAT - PlugX + - Chaos Ransomware + - Derusbi + - Nexus APT Threat Activity + - Earth Estries + - NjRAT asset_type: Endpoint mitre_attack_id: - T1091 @@ -74,7 +77,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/chaos_ransomware/spread_in_root_drives/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 94fdbd5137..6c5c30ed82 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,7 +1,7 @@ name: Windows Service Created with Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 -version: 8 -date: '2024-11-13' +version: '12' +date: '2025-01-27' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production type: TTP @@ -54,15 +54,18 @@ rba: type: service tags: analytic_story: - - Qakbot - - CISA AA23-347A - - Flax Typhoon - - Clop Ransomware - Brute Ratel C4 + - Flax Typhoon - PlugX - - Active Directory Lateral Movement + - CISA AA23-347A + - Qakbot - Crypto Stealer + - Active Directory Lateral Movement + - Derusbi + - Nexus APT Threat Activity - Snake Malware + - Clop Ransomware + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1569 @@ -75,7 +78,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/windows_service_created_with_suspicious_service_path/windows-xml.log source: XmlWinEventLog:System sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 80fcea4b98..7f926b23dd 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,7 +1,7 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: 8 -date: '2025-01-20' +version: '12' +date: '2025-01-27' author: Teoderick Contreras, Splunk, Steven Dick status: production type: Anomaly @@ -53,14 +53,17 @@ rba: threat_objects: [] tags: analytic_story: + - Brute Ratel C4 + - PlugX - Windows Persistence Techniques - CISA AA23-347A - Windows Registry Abuse - - Brute Ratel C4 - - PlugX - Suspicious Windows Registry Activities - Active Directory Lateral Movement - Crypto Stealer + - Derusbi + - Nexus APT Threat Activity + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1574.011 @@ -72,7 +75,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.011/change_registry_path_service/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog \ No newline at end of file + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index 4f80f0618c..8824bfeebe 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading id: 5a83ce44-8e0f-4786-a775-8249a525c879 -version: 4 -date: '2024-11-13' +version: '8' +date: '2025-01-27' author: Teoderick Contreras, Splunk status: production type: Anomaly @@ -52,6 +52,9 @@ rba: tags: analytic_story: - Warzone RAT + - Derusbi + - Nexus APT Threat Activity + - Earth Estries - NjRAT asset_type: Endpoint mitre_attack_id: @@ -64,7 +67,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/warzone_rat/unsigned_dll_loaded/loaded_unsigned_dll.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index b9163ad484..0aa50653c9 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -1,7 +1,7 @@ name: Windows Unsigned DLL Side-Loading In Same Process Path id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f -version: 3 -date: '2024-11-13' +version: '7' +date: '2025-01-27' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -54,8 +54,11 @@ rba: threat_objects: [] tags: analytic_story: - - DarkGate Malware - PlugX + - Derusbi + - Nexus APT Threat Activity + - DarkGate Malware + - Earth Estries asset_type: Endpoint mitre_attack_id: - T1574.002 @@ -68,7 +71,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/unsigned_dll_process_path.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_loaded_same_process_path/unsigned_dll_process_path.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 1db59b0464..8c773ea45b 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -1,7 +1,7 @@ name: Windows Unsigned MS DLL Side-Loading id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c -version: 4 -date: '2024-11-13' +version: '8' +date: '2025-01-27' author: Teoderick Contreras, Splunk data_source: - Sysmon EventID 7 @@ -64,7 +64,10 @@ rba: type: file_name tags: analytic_story: + - Derusbi - APT29 Diplomatic Deceptions with WINELOADER + - Nexus APT Threat Activity + - Earth Estries group: - APT29 - Cozy Bear @@ -82,7 +85,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load//wineloader_dll_sideload.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.002/unsigned_dll_load//wineloader_dll_sideload.log sourcetype: XmlWinEventLog source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 38172807f5..57baa464eb 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -1,7 +1,7 @@ name: WinEvent Scheduled Task Created to Spawn Shell id: 203ef0ea-9bd8-11eb-8201-acde48001122 -version: 7 -date: '2024-12-10' +version: '9' +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -55,13 +55,15 @@ rba: tags: analytic_story: - Windows Persistence Techniques - - Windows Error Reporting Service Elevation of Privilege Vulnerability - - CISA AA22-257A - - Ryuk Ransomware - Ransomware + - Windows Error Reporting Service Elevation of Privilege Vulnerability - Scheduled Tasks - - Compromised Windows Host - Winter Vivern + - Nexus APT Threat Activity + - Compromised Windows Host + - Ryuk Ransomware + - Earth Estries + - CISA AA22-257A asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -74,7 +76,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index b860a33f55..0e2928e89b 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -1,7 +1,7 @@ name: WinEvent Scheduled Task Created Within Public Path id: 5d9c6eee-988c-11eb-8253-acde48001122 -version: 7 -date: '2024-12-10' +version: '9' +date: '2025-01-27' author: Michael Haag, Splunk status: production type: TTP @@ -54,20 +54,22 @@ rba: threat_objects: [] tags: analytic_story: - - Windows Persistence Techniques - - Active Directory Lateral Movement - - CISA AA22-257A - - IcedID - - Prestige Ransomware - - Industroyer2 - - Ryuk Ransomware - - AsyncRAT - Data Destruction - - Ransomware + - Windows Persistence Techniques + - AsyncRAT + - Industroyer2 - CISA AA23-347A + - Ransomware + - Prestige Ransomware - Scheduled Tasks - - Compromised Windows Host + - IcedID - Winter Vivern + - Active Directory Lateral Movement + - Nexus APT Threat Activity + - Compromised Windows Host + - Ryuk Ransomware + - Earth Estries + - CISA AA22-257A asset_type: Endpoint mitre_attack_id: - T1053.005 @@ -80,7 +82,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/winevent_scheduled_task_created_to_spawn_shell/windows-xml.log source: XmlWinEventLog:Security sourcetype: XmlWinEventLog diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml index 75813bbf1a..df0f0dd051 100644 --- a/detections/network/detect_large_outbound_icmp_packets.yml +++ b/detections/network/detect_large_outbound_icmp_packets.yml @@ -1,7 +1,7 @@ name: Detect Large Outbound ICMP Packets id: e9c102de-4d43-42a7-b1c8-8062ea297419 -version: 7 -date: '2024-11-15' +version: '9' +date: '2025-01-27' author: Rico Valdez, Dean Luxton, Splunk status: production type: TTP @@ -15,25 +15,23 @@ description: The following analytic identifies outbound ICMP packets with a size the network. data_source: - Palo Alto Network Traffic -search: >- - | tstats `security_content_summariesonly` count earliest(_time) as firstTime - latest(_time) as lastTime values(All_Traffic.action) as action values(All_Traffic.bytes) - as bytes from - datamodel=Network_Traffic where All_Traffic.action !=blocked (All_Traffic.protocol=icmp - OR All_Traffic.transport=icmp) All_Traffic.bytes - > 1000 AND NOT All_Traffic.dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16") - by All_Traffic.src_ip All_Traffic.dest_ip All_Traffic.protocol - | `drop_dm_object_name("All_Traffic")` | iplocation dest_ip | `security_content_ctime(firstTime)` | - `security_content_ctime(lastTime)` | `detect_large_outbound_icmp_packets_filter` -how_to_implement: "In order to run this search effectively, we highly recommend that +search: "| tstats `security_content_summariesonly` count earliest(_time) as firstTime\n\ + \ latest(_time) as lastTime values(All_Traffic.action) as action values(All_Traffic.bytes)\n\ + as bytes from\n datamodel=Network_Traffic where All_Traffic.action !=blocked (All_Traffic.protocol=icmp\n\ + OR All_Traffic.transport=icmp) All_Traffic.bytes\n > 1000 AND NOT All_Traffic.dest_ip\ + \ IN (\"10.0.0.0/8\",\"172.16.0.0/12\",\"192.168.0.0/16\")\nby All_Traffic.src_ip\ + \ All_Traffic.dest_ip All_Traffic.protocol | `drop_dm_object_name(\"All_Traffic\"\ + )` | iplocation dest_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`\ + \ | `detect_large_outbound_icmp_packets_filter`" +how_to_implement: 'In order to run this search effectively, we highly recommend that you leverage the Assets and Identity framework. It is important that you have a good understanding of how your network segments are designed and that you are able to distinguish internal from external address space. Add a category named `internal` - to the CIDRs that host the company's assets in the `assets_by_cidr.csv` lookup file, - which is located in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`. More - information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. + to the CIDRs that host the company''s assets in the `assets_by_cidr.csv` lookup + file, which is located in `$SPLUNK_HOME/etc/apps/SA-IdentityManagement/lookups/`. + More information on updating this lookup can be found here: https://docs.splunk.com/Documentation/ES/5.0.0/Admin/Addassetandidentitydata. This search also requires you to be ingesting your network traffic and populating - the Network_Traffic data model" + the Network_Traffic data model' known_false_positives: ICMP packets are used in a variety of ways to help troubleshoot networking issues and ensure the proper flow of traffic. As such, it is possible that a large ICMP packet could be perfectly legitimate. If large ICMP packets are @@ -68,6 +66,8 @@ rba: threat_objects: [] tags: analytic_story: + - Backdoor Pingpong + - Nexus APT Threat Activity - Command And Control asset_type: Endpoint mitre_attack_id: @@ -80,7 +80,6 @@ tags: tests: - name: True Positive Test attack_data: - - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1095/palologs/large_icmp.log + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1095/palologs/large_icmp.log sourcetype: pan:traffic source: pan:traffic diff --git a/stories/backdoor_pingpong.yml b/stories/backdoor_pingpong.yml new file mode 100644 index 0000000000..1bac40c09f --- /dev/null +++ b/stories/backdoor_pingpong.yml @@ -0,0 +1,17 @@ +name: Backdoor Pingpong +id: 1231ff23-543e-4eb9-b9e0-a97d9333bebc +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Backdoor.PingPong malware, a legacy threat that provides unauthorized remote access to compromised systems. Look for signs such as unexpected pings or ICMP traffic patterns that deviate from normal behavior. Investigate unauthorized processes or network connections, particularly those attempting to establish external communication. Combining threat intelligence with behavioral analytics helps identify this backdoor’s attempts to exploit vulnerabilities. Early detection and response are critical to mitigating the risk of this malware. +narrative: Backdoor.PingPong is an older malware family designed to provide unauthorized remote access to compromised systems. It often utilizes ICMP traffic, including ping requests, as a covert communication channel to receive commands or exfiltrate data. Despite its simplicity compared to modern threats, it can still be effective in environments with inadequate monitoring. By exploiting system vulnerabilities or poor network segmentation, PingPong enables attackers to maintain persistence and control. Detecting its activity requires careful analysis of network traffic and unusual process behaviors. +references: +- https://www.crowdstrike.com/en-us/blog/an-analysis-of-lightbasin-telecommunications-attacks/ +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/derusbi.yml b/stories/derusbi.yml new file mode 100644 index 0000000000..7ad790649e --- /dev/null +++ b/stories/derusbi.yml @@ -0,0 +1,19 @@ +name: Derusbi +id: 7cd48610-6f75-4b49-ae1d-3bf2cfff1c1c +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Derusbi malware, a sophisticated threat often linked to advanced persistent attacks. Monitor anomalies in network traffic, file execution patterns, and unauthorized access attempts to uncover potential compromises. Utilize behavioral analytics and endpoint detection tools to identify indicators such as pesistence, service creation, lateral movement via removable drive, driver loading and dll side loading. By correlating these findings with known threat intelligence, you can quickly respond to and mitigate Derusbi-related incidents. +narrative: Derusbi is a stealthy and versatile malware family often associated with advanced persistent threats (APTs) targeting high-value systems. Known for its adaptability, it employs techniques like process injection and encrypted communications to evade detection. This malware family is frequently used for espionage, data theft, and system compromise, leveraging custom modules tailored to specific targets. Derusbi’s ability to remain undetected for extended periods makes it a significant threat, emphasizing the need for robust monitoring and advanced detection mechanisms to mitigate its impact. +references: +- https://www.virusbulletin.com/uploads/pdf/conference_slides/2015/Pun-etal-VB2015.pdf +- https://www.trendmicro.com/en_us/research/21/g/biopass-rat-new-malware-sniffs-victims-via-live-streaming.html +- https://web.archive.org/web/20180310053107/https://www.rsaconference.com/writable/presentations/file_upload/hta-w02-dissecting-derusbi.pdf +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/earth_estries.yml b/stories/earth_estries.yml new file mode 100644 index 0000000000..269808d624 --- /dev/null +++ b/stories/earth_estries.yml @@ -0,0 +1,17 @@ +name: Earth Estries +id: 608135e2-eb6b-41bf-9f0c-b12f41a1376a +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Earth Estries, a sophisticated threat actor targeting various sectors with espionage-focused campaigns. Monitor for indicators such as spear-phishing emails, unauthorized access attempts, and lateral movement within your network. Investigate anomalous data exfiltration patterns and command-and-control (C2) traffic consistent with known tactics, techniques, and procedures (TTPs) of this group. Combining threat intelligence with advanced monitoring tools helps identify potential Earth Estries activity early, enabling swift response to mitigate risks effectively. +narrative: Earth Estries is a highly capable threat actor known for conducting targeted espionage campaigns against diverse sectors, including government, technology, and critical infrastructure. This group leverages sophisticated tactics such as spear-phishing, credential theft, and exploiting software vulnerabilities to gain initial access. Once inside a network, Earth Estries demonstrates expertise in lateral movement, privilege escalation, and covert data exfiltration. Their use of custom malware and command-and-control (C2) infrastructures highlights their adaptability. Detecting their activity requires robust threat intelligence and proactive monitoring of unusual behaviors and network anomalies. +references: +- https://www.trendmicro.com/en_nl/research/24/k/earth-estries.html +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/nexus_apt_threat_activity.yml b/stories/nexus_apt_threat_activity.yml new file mode 100644 index 0000000000..02ac563314 --- /dev/null +++ b/stories/nexus_apt_threat_activity.yml @@ -0,0 +1,20 @@ +name: Nexus APT Threat Activity +id: 43f8062d-4da0-4f48-8cad-6a20e108961b +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, an advanced persistent threat (APT) group known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss. +narrative: Chinese state-nexus threat actors are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors. +references: +- https://news.sophos.com/en-us/2024/10/31/pacific-rim-neutralizing-china-based-threat/ +- https://www.wsj.com/tech/cybersecurity/typhoon-china-hackers-military-weapons-97d4ef95?st=oe1KKi&reflink=desktopwebshare _permalink +- https://www.judiciary.senate.gov/imo/media/doc/2024-11-19_pm_-_testimony_-_meyers.pdf +- https://go.crowdstrike.com/rs/281-OBQ-266/images/GlobalThreatReport2024.pdf +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/stories/windealer_rat.yml b/stories/windealer_rat.yml new file mode 100644 index 0000000000..061871d185 --- /dev/null +++ b/stories/windealer_rat.yml @@ -0,0 +1,17 @@ +name: WinDealer RAT +id: 94fdd8b7-ae39-454a-85e8-9f0148eddea6 +version: 1 +date: '2025-01-27' +author: Teoderick Contreras, Splunk +description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Windealer Remote Access Trojan (RAT), a versatile malware used for data theft and unauthorized system control. Monitor for signs such as unexpected process token adjustment, abnormal file activity, and unauthorized process execution. Investigate indicators of command-and-control (C2) communications, particularly encrypted or obfuscated traffic patterns. Behavioral analysis and endpoint monitoring can help identify suspicious activities linked to this RAT. Early detection and thorough investigation are essential to mitigate the risks posed by Windealer. +narrative: Windealer is a Remote Access Trojan (RAT) designed for stealthy infiltration and control of compromised systems. Often used in cyberespionage and data theft campaigns, it enables attackers to execute commands, exfiltrate sensitive information, and manipulate system functions remotely. Windealer is known for its ability to maintain persistence and communicate with command-and-control (C2) servers using encrypted or obfuscated protocols, making detection challenging. Its deployment often involves phishing, software exploits, or supply chain attacks. Effective detection requires advanced endpoint monitoring and analysis of unusual network behaviors to identify its covert operations. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.windealer +tags: + category: + - Malware + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 07c0ba75e4967672f4f154cb2bff892605cff5d0 Mon Sep 17 00:00:00 2001 From: research-bot Date: Mon, 27 Jan 2025 13:10:46 -0800 Subject: [PATCH 69/82] version revert --- detections/endpoint/any_powershell_downloadfile.yml | 2 +- detections/endpoint/detect_renamed_psexec.yml | 2 +- detections/endpoint/detect_renamed_winrar.yml | 2 +- .../executables_or_script_creation_in_suspicious_path.yml | 2 +- .../linux_auditd_file_permission_modification_via_chmod.yml | 2 +- .../endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml | 2 +- .../linux_auditd_possible_access_to_credential_files.yml | 2 +- .../endpoint/linux_auditd_possible_access_to_sudoers_file.yml | 2 +- .../endpoint/linux_auditd_preload_hijack_library_calls.yml | 2 +- .../endpoint/linux_common_process_for_elevation_control.yml | 2 +- .../endpoint/linux_file_creation_in_init_boot_directory.yml | 2 +- detections/endpoint/linux_iptables_firewall_modification.yml | 2 +- detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml | 2 +- .../endpoint/linux_possible_access_to_credential_files.yml | 2 +- detections/endpoint/linux_possible_access_to_sudoers_file.yml | 2 +- detections/endpoint/linux_preload_hijack_library_calls.yml | 2 +- detections/endpoint/linux_sudoers_tmp_file_creation.yml | 2 +- .../malicious_powershell_process___execution_policy_bypass.yml | 2 +- .../non_chrome_process_accessing_chrome_default_dir.yml | 2 +- detections/endpoint/powershell_4104_hunting.yml | 2 +- detections/endpoint/registry_keys_used_for_persistence.yml | 2 +- detections/endpoint/remote_process_instantiation_via_wmi.yml | 2 +- .../endpoint/scheduled_task_deleted_or_created_via_cmd.yml | 2 +- .../endpoint/suspicious_regsvr32_register_suspicious_path.yml | 2 +- .../suspicious_scheduled_task_from_public_directory.yml | 2 +- .../windows_access_token_manipulation_sedebugprivilege.yml | 2 +- detections/endpoint/windows_archive_collected_data_via_rar.yml | 2 +- ...redentials_from_password_stores_chrome_localstate_access.yml | 2 +- ...redentials_from_password_stores_chrome_login_data_access.yml | 2 +- .../endpoint/windows_curl_download_to_suspicious_path.yml | 2 +- .../endpoint/windows_replication_through_removable_media.yml | 2 +- .../windows_service_created_with_suspicious_service_path.yml | 2 +- .../endpoint/windows_service_creation_using_registry_entry.yml | 2 +- detections/endpoint/windows_unsigned_dll_side_loading.yml | 2 +- .../windows_unsigned_dll_side_loading_in_same_process_path.yml | 2 +- detections/endpoint/windows_unsigned_ms_dll_side_loading.yml | 2 +- .../endpoint/winevent_scheduled_task_created_to_spawn_shell.yml | 2 +- .../winevent_scheduled_task_created_within_public_path.yml | 2 +- detections/network/detect_large_outbound_icmp_packets.yml | 2 +- 39 files changed, 39 insertions(+), 39 deletions(-) diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 18cadadfe0..74049ff9cb 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -1,6 +1,6 @@ name: Any Powershell DownloadFile id: 1a93b7ea-7af7-11eb-adb5-acde48001122 -version: '10' +version: 9 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index 747949fa2f..3b2380accc 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -1,6 +1,6 @@ name: Detect Renamed PSExec id: 683e6196-b8e8-11eb-9a79-acde48001122 -version: '11' +version: 10 date: '2025-01-27' author: Michael Haag, Splunk, Alex Oberkircher, Github Community status: production diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index d51e6a4877..43af74579c 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -1,6 +1,6 @@ name: Detect Renamed WinRAR id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 -version: '9' +version: 8 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index b9ee29d61d..ead8a42979 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -1,6 +1,6 @@ name: Executables Or Script Creation In Suspicious Path id: a7e3f0f0-ae42-11eb-b245-acde48001122 -version: '11' +version: 10 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml index 0ab0f724af..f33b95fed5 100644 --- a/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml +++ b/detections/endpoint/linux_auditd_file_permission_modification_via_chmod.yml @@ -1,6 +1,6 @@ name: Linux Auditd File Permission Modification Via Chmod id: 5f1d2ea7-eec0-4790-8b24-6875312ad492 -version: '7' +version: 6 date: '2025-01-27' author: "Teoderick Contreras, Splunk, Ivar Nyg\xE5rd" status: production diff --git a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml index e908685866..b0d9f8aa6c 100644 --- a/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_nopasswd_entry_in_sudoers_file.yml @@ -1,6 +1,6 @@ name: Linux Auditd Nopasswd Entry In Sudoers File id: 651df959-ad17-4b73-a323-90cb96d5fa1b -version: '5' +version: 4 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml index 8547e8a0c9..499e0a23bb 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_credential_files.yml @@ -1,6 +1,6 @@ name: Linux Auditd Possible Access To Credential Files id: 0419cb7a-57ea-467b-974f-77c303dfe2a3 -version: '5' +version: 4 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml index e41acccf8d..8dda7e5e89 100644 --- a/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_auditd_possible_access_to_sudoers_file.yml @@ -1,6 +1,6 @@ name: Linux Auditd Possible Access To Sudoers File id: 8be88f46-f7e8-4ae6-b15e-cf1b13392834 -version: '5' +version: 4 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml index da96d1753d..fdfa38e184 100644 --- a/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_auditd_preload_hijack_library_calls.yml @@ -1,6 +1,6 @@ name: Linux Auditd Preload Hijack Library Calls id: 35c50572-a70b-452f-afa9-bebdf3c3ce36 -version: '5' +version: 4 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index cc9c0dad39..9bcb78b36d 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -1,6 +1,6 @@ name: Linux Common Process For Elevation Control id: 66ab15c0-63d0-11ec-9e70-acde48001122 -version: '6' +version: 5 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index 6fcca1a2fc..810914e4f3 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -1,6 +1,6 @@ name: Linux File Creation In Init Boot Directory id: 97d9cfb2-61ad-11ec-bb2d-acde48001122 -version: '7' +version: 6 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index e205677b08..3107d907e2 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,6 +1,6 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: '8' +version: 7 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index 4b2e2393a9..15ca07070f 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -1,6 +1,6 @@ name: Linux NOPASSWD Entry In Sudoers File id: ab1e0d52-624a-11ec-8e0b-acde48001122 -version: '6' +version: 5 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index 7825288713..e5f2c33dce 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -1,6 +1,6 @@ name: Linux Possible Access To Credential Files id: 16107e0e-71fc-11ec-b862-acde48001122 -version: '7' +version: 6 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index ce0491e3dd..2be5685254 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -1,6 +1,6 @@ name: Linux Possible Access To Sudoers File id: 4479539c-71fc-11ec-b2e2-acde48001122 -version: '6' +version: 5 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index f9dbbe5d4b..9ad2401c00 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -1,6 +1,6 @@ name: Linux Preload Hijack Library Calls id: cbe2ca30-631e-11ec-8670-acde48001122 -version: '6' +version: 5 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index 4e903212ae..838f432cab 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -1,6 +1,6 @@ name: Linux Sudoers Tmp File Creation id: be254a5c-63e7-11ec-89da-acde48001122 -version: '6' +version: 5 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 1b8771cb20..228765bed3 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -1,6 +1,6 @@ name: Malicious PowerShell Process - Execution Policy Bypass id: 9be56c82-b1cc-4318-87eb-d138afaaca39 -version: '10' +version: 9 date: '2025-01-27' author: Rico Valdez, Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index d6d4cef008..fa4c8d036a 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -1,6 +1,6 @@ name: Non Chrome Process Accessing Chrome Default Dir id: 81263de4-160a-11ec-944f-acde48001122 -version: '7' +version: 6 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index e51bf17f33..bdf4328edc 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -1,6 +1,6 @@ name: PowerShell 4104 Hunting id: d6f2b006-0041-11ec-8885-acde48001122 -version: '11' +version: 10 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 5d91fcacff..9f542cbcf2 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -1,6 +1,6 @@ name: Registry Keys Used For Persistence id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b -version: '16' +version: 15 date: '2025-01-27' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk status: production diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 4fa23a29ef..45d08b0f06 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -1,6 +1,6 @@ name: Remote Process Instantiation via WMI id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da -version: '12' +version: 11 date: '2025-01-27' author: Rico Valdez, Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 4ed78d182f..3b47886f19 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -1,6 +1,6 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c -version: '11' +version: 10 date: '2025-01-27' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 57f788e652..65c6989495 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -1,6 +1,6 @@ name: Suspicious Regsvr32 Register Suspicious Path id: 62732736-6250-11eb-ae93-0242ac130002 -version: '11' +version: 10 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index e4658dde75..7fce587c31 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -1,6 +1,6 @@ name: Suspicious Scheduled Task from Public Directory id: 7feb7972-7ac3-11eb-bac8-acde48001122 -version: '6' +version: 5 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index bdad60d3fa..9f00ab5ca2 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -1,6 +1,6 @@ name: Windows Access Token Manipulation SeDebugPrivilege id: 6ece9ed0-5f92-4315-889d-48560472b188 -version: '11' +version: 10 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_archive_collected_data_via_rar.yml b/detections/endpoint/windows_archive_collected_data_via_rar.yml index 3c00d940fc..d3403433b5 100644 --- a/detections/endpoint/windows_archive_collected_data_via_rar.yml +++ b/detections/endpoint/windows_archive_collected_data_via_rar.yml @@ -1,6 +1,6 @@ name: Windows Archive Collected Data via Rar id: 2015de95-fe91-413d-9d62-2fe011b67e82 -version: '6' +version: 5 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml index 35513fe4b0..c981720bb5 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_localstate_access.yml @@ -1,6 +1,6 @@ name: Windows Credentials from Password Stores Chrome LocalState Access id: 3b1d09a8-a26f-473e-a510-6c6613573657 -version: '8' +version: 7 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml index 3c20df25f3..5ed95dadf5 100644 --- a/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml +++ b/detections/endpoint/windows_credentials_from_password_stores_chrome_login_data_access.yml @@ -1,6 +1,6 @@ name: Windows Credentials from Password Stores Chrome Login Data Access id: 0d32ba37-80fc-4429-809c-0ba15801aeaf -version: '8' +version: 7 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 25e3e21929..a267aa3e2f 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,6 +1,6 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: '8' +version: 7 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_replication_through_removable_media.yml b/detections/endpoint/windows_replication_through_removable_media.yml index 82cb5ab77e..7817d86c25 100644 --- a/detections/endpoint/windows_replication_through_removable_media.yml +++ b/detections/endpoint/windows_replication_through_removable_media.yml @@ -1,6 +1,6 @@ name: Windows Replication Through Removable Media id: 60df805d-4605-41c8-bbba-57baa6a4eb97 -version: '8' +version: 7 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml index 6c5c30ed82..9dfedd34e8 100644 --- a/detections/endpoint/windows_service_created_with_suspicious_service_path.yml +++ b/detections/endpoint/windows_service_created_with_suspicious_service_path.yml @@ -1,6 +1,6 @@ name: Windows Service Created with Suspicious Service Path id: 429141be-8311-11eb-adb6-acde48001122 -version: '12' +version: 11 date: '2025-01-27' author: Teoderick Contreras, Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index 7f926b23dd..58eaf22cd4 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -1,6 +1,6 @@ name: Windows Service Creation Using Registry Entry id: 25212358-948e-11ec-ad47-acde48001122 -version: '12' +version: 11 date: '2025-01-27' author: Teoderick Contreras, Splunk, Steven Dick status: production diff --git a/detections/endpoint/windows_unsigned_dll_side_loading.yml b/detections/endpoint/windows_unsigned_dll_side_loading.yml index 8824bfeebe..f6c7a56920 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading.yml @@ -1,6 +1,6 @@ name: Windows Unsigned DLL Side-Loading id: 5a83ce44-8e0f-4786-a775-8249a525c879 -version: '8' +version: 7 date: '2025-01-27' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml index 0aa50653c9..08803a7cd9 100644 --- a/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml +++ b/detections/endpoint/windows_unsigned_dll_side_loading_in_same_process_path.yml @@ -1,6 +1,6 @@ name: Windows Unsigned DLL Side-Loading In Same Process Path id: 3cf85c02-f9d6-4186-bf3c-e70ee99fbc7f -version: '7' +version: 6 date: '2025-01-27' author: Teoderick Contreras, Splunk data_source: diff --git a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml index 8c773ea45b..add7f13b4d 100644 --- a/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml +++ b/detections/endpoint/windows_unsigned_ms_dll_side_loading.yml @@ -1,6 +1,6 @@ name: Windows Unsigned MS DLL Side-Loading id: 8d9e0e06-ba71-4dc5-be16-c1a46d58728c -version: '8' +version: 7 date: '2025-01-27' author: Teoderick Contreras, Splunk data_source: diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 57baa464eb..690c5bffb5 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -1,6 +1,6 @@ name: WinEvent Scheduled Task Created to Spawn Shell id: 203ef0ea-9bd8-11eb-8201-acde48001122 -version: '9' +version: 8 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 0e2928e89b..7c383641be 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -1,6 +1,6 @@ name: WinEvent Scheduled Task Created Within Public Path id: 5d9c6eee-988c-11eb-8253-acde48001122 -version: '9' +version: 8 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml index df0f0dd051..e4bdf54ffc 100644 --- a/detections/network/detect_large_outbound_icmp_packets.yml +++ b/detections/network/detect_large_outbound_icmp_packets.yml @@ -1,6 +1,6 @@ name: Detect Large Outbound ICMP Packets id: e9c102de-4d43-42a7-b1c8-8062ea297419 -version: '9' +version: 8 date: '2025-01-27' author: Rico Valdez, Dean Luxton, Splunk status: production From 572cdd43461e10cf760424046d10a6a19488dcf6 Mon Sep 17 00:00:00 2001 From: research-bot Date: Mon, 27 Jan 2025 14:32:06 -0800 Subject: [PATCH 70/82] ctl to 5.0.0 --- .github/workflows/appinspect.yml | 2 +- .github/workflows/build.yml | 2 +- .github/workflows/unit-testing.yml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 4c99832ebe..5d821f8ab1 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -18,7 +18,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==v5.0.0-alpha.3 + pip install contentctl==5.0.0 git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 752e516e3f..46d76ececa 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,7 +19,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==v5.0.0-alpha.3 + pip install contentctl==5.0.0 git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index 925207f4cb..fb10af44eb 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,7 +23,7 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - pip install contentctl==v5.0.0-alpha.3 + pip install contentctl==5.0.0 # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork From 8835efdbb41ea2a29f99282d936f847272fb7c3e Mon Sep 17 00:00:00 2001 From: research-bot Date: Mon, 27 Jan 2025 19:15:49 -0800 Subject: [PATCH 71/82] adding status --- stories/backdoor_pingpong.yml | 1 + stories/derusbi.yml | 1 + stories/earth_estries.yml | 1 + stories/nexus_apt_threat_activity.yml | 1 + stories/windealer_rat.yml | 1 + 5 files changed, 5 insertions(+) diff --git a/stories/backdoor_pingpong.yml b/stories/backdoor_pingpong.yml index 1bac40c09f..bdcb1e61ac 100644 --- a/stories/backdoor_pingpong.yml +++ b/stories/backdoor_pingpong.yml @@ -3,6 +3,7 @@ id: 1231ff23-543e-4eb9-b9e0-a97d9333bebc version: 1 date: '2025-01-27' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Backdoor.PingPong malware, a legacy threat that provides unauthorized remote access to compromised systems. Look for signs such as unexpected pings or ICMP traffic patterns that deviate from normal behavior. Investigate unauthorized processes or network connections, particularly those attempting to establish external communication. Combining threat intelligence with behavioral analytics helps identify this backdoor’s attempts to exploit vulnerabilities. Early detection and response are critical to mitigating the risk of this malware. narrative: Backdoor.PingPong is an older malware family designed to provide unauthorized remote access to compromised systems. It often utilizes ICMP traffic, including ping requests, as a covert communication channel to receive commands or exfiltrate data. Despite its simplicity compared to modern threats, it can still be effective in environments with inadequate monitoring. By exploiting system vulnerabilities or poor network segmentation, PingPong enables attackers to maintain persistence and control. Detecting its activity requires careful analysis of network traffic and unusual process behaviors. references: diff --git a/stories/derusbi.yml b/stories/derusbi.yml index 7ad790649e..7ad346c7d4 100644 --- a/stories/derusbi.yml +++ b/stories/derusbi.yml @@ -3,6 +3,7 @@ id: 7cd48610-6f75-4b49-ae1d-3bf2cfff1c1c version: 1 date: '2025-01-27' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Derusbi malware, a sophisticated threat often linked to advanced persistent attacks. Monitor anomalies in network traffic, file execution patterns, and unauthorized access attempts to uncover potential compromises. Utilize behavioral analytics and endpoint detection tools to identify indicators such as pesistence, service creation, lateral movement via removable drive, driver loading and dll side loading. By correlating these findings with known threat intelligence, you can quickly respond to and mitigate Derusbi-related incidents. narrative: Derusbi is a stealthy and versatile malware family often associated with advanced persistent threats (APTs) targeting high-value systems. Known for its adaptability, it employs techniques like process injection and encrypted communications to evade detection. This malware family is frequently used for espionage, data theft, and system compromise, leveraging custom modules tailored to specific targets. Derusbi’s ability to remain undetected for extended periods makes it a significant threat, emphasizing the need for robust monitoring and advanced detection mechanisms to mitigate its impact. references: diff --git a/stories/earth_estries.yml b/stories/earth_estries.yml index 269808d624..81202bfe35 100644 --- a/stories/earth_estries.yml +++ b/stories/earth_estries.yml @@ -3,6 +3,7 @@ id: 608135e2-eb6b-41bf-9f0c-b12f41a1376a version: 1 date: '2025-01-27' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Earth Estries, a sophisticated threat actor targeting various sectors with espionage-focused campaigns. Monitor for indicators such as spear-phishing emails, unauthorized access attempts, and lateral movement within your network. Investigate anomalous data exfiltration patterns and command-and-control (C2) traffic consistent with known tactics, techniques, and procedures (TTPs) of this group. Combining threat intelligence with advanced monitoring tools helps identify potential Earth Estries activity early, enabling swift response to mitigate risks effectively. narrative: Earth Estries is a highly capable threat actor known for conducting targeted espionage campaigns against diverse sectors, including government, technology, and critical infrastructure. This group leverages sophisticated tactics such as spear-phishing, credential theft, and exploiting software vulnerabilities to gain initial access. Once inside a network, Earth Estries demonstrates expertise in lateral movement, privilege escalation, and covert data exfiltration. Their use of custom malware and command-and-control (C2) infrastructures highlights their adaptability. Detecting their activity requires robust threat intelligence and proactive monitoring of unusual behaviors and network anomalies. references: diff --git a/stories/nexus_apt_threat_activity.yml b/stories/nexus_apt_threat_activity.yml index 02ac563314..bd6aed1350 100644 --- a/stories/nexus_apt_threat_activity.yml +++ b/stories/nexus_apt_threat_activity.yml @@ -3,6 +3,7 @@ id: 43f8062d-4da0-4f48-8cad-6a20e108961b version: 1 date: '2025-01-27' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Nexus, an advanced persistent threat (APT) group known for its stealth and strategic targeting of high-value sectors. Monitor for indicators such as spear-phishing campaigns, exploitation of zero-day vulnerabilities, and unauthorized lateral movement within your network. Investigate anomalous data exfiltration, encrypted communications, and behaviors aligning with their known tactics, techniques, and procedures (TTPs). Combining threat intelligence with real-time monitoring helps identify and respond to Nexus APT activity, minimizing potential damage and data loss. narrative: Chinese state-nexus threat actors are known to target the telecommunications and technology sectors in multiple countries, including the US, to maintain sustained access as well as conduct espionage. Compromised entities in either sector represent potential supply chain vectors of concern to Splunk, although telecommunications entities are a more pervasive and acute concern in this regard. These actors are also known to broadly target unpatched routers, switches and other edge devices across various sectors. Given these threats, Splunk Threat Intelligence (TI) undertook a detailed investigation into China-nexus tactics and techniques that could be used in attempts to compromise Splunk. This report is the result of that investigation, detailing noteworthy behaviors and tools employed by China-nexus targeted intrusion actors. references: diff --git a/stories/windealer_rat.yml b/stories/windealer_rat.yml index 061871d185..1417f913a4 100644 --- a/stories/windealer_rat.yml +++ b/stories/windealer_rat.yml @@ -3,6 +3,7 @@ id: 94fdd8b7-ae39-454a-85e8-9f0148eddea6 version: 1 date: '2025-01-27' author: Teoderick Contreras, Splunk +status: production description: Leverage searches that allow you to detect and investigate unusual activities that might relate to Windealer Remote Access Trojan (RAT), a versatile malware used for data theft and unauthorized system control. Monitor for signs such as unexpected process token adjustment, abnormal file activity, and unauthorized process execution. Investigate indicators of command-and-control (C2) communications, particularly encrypted or obfuscated traffic patterns. Behavioral analysis and endpoint monitoring can help identify suspicious activities linked to this RAT. Early detection and thorough investigation are essential to mitigate the risks posed by Windealer. narrative: Windealer is a Remote Access Trojan (RAT) designed for stealthy infiltration and control of compromised systems. Often used in cyberespionage and data theft campaigns, it enables attackers to execute commands, exfiltrate sensitive information, and manipulate system functions remotely. Windealer is known for its ability to maintain persistence and communicate with command-and-control (C2) servers using encrypted or obfuscated protocols, making detection challenging. Its deployment often involves phishing, software exploits, or supply chain attacks. Effective detection requires advanced endpoint monitoring and analysis of unusual network behaviors to identify its covert operations. references: From 4e88794a21b5326714a184d75e260aa4b3963ec1 Mon Sep 17 00:00:00 2001 From: ljstella Date: Tue, 28 Jan 2025 11:40:33 -0600 Subject: [PATCH 72/82] Adding d3fend technique tag --- ...isco_Talos_Intelligence_Identifier_Reputation_Analysis.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml index cc5b04bcb6..de5b0d3276 100644 --- a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml +++ b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml @@ -5,13 +5,15 @@ date: '2025-01-17' author: Kelby Shelton, Tapish Jain, Splunk type: Investigation description: "Accepts a URL, IP or Domain and provides intelligence on the objects. Generates a per observable report that includes the objects threat level, threat categories, acceptable use categories and score." -playbook: CiscoTalosIntelligence_Identifier_Reputation_Analysis +playbook: Cisco_Talos_Intelligence_Identifier_Reputation_Analysis how_to_implement: This input playbook requires the Cisco Talos Intelligence connector to be configured and a Splunk SOAR cloud license. references: - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/ app_list: - Cisco Talos Intelligence tags: + defend_technique_id: + - D3-IRA platform_tags: - reputation - url From 1a16ff5f293491154be63466784b040422fc4fa6 Mon Sep 17 00:00:00 2001 From: research-bot Date: Tue, 28 Jan 2025 18:12:48 -0800 Subject: [PATCH 73/82] remove falcon data --- detections/endpoint/suspicious_process_file_path.yml | 2 +- ...indows_sensitive_registry_hive_dump_via_commandline.yml | 7 +------ 2 files changed, 2 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index c055850294..1d636ec76c 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -22,7 +22,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime "*\\windows\\temp\\*", "*\\users\\public\\*", "*\\windows\\debug\\*", "*\\Users\\Administrator\\Music\\*", "*\\Windows\\servicing\\*", "*\\Users\\Default\\*", "*Recycle.bin*", "*\\Windows\\Media\\*", "\\Windows\\repair\\*", "*\\temp\\*" , "*\\PerfLogs\\*","*\\windows\\tasks\\*", "*:\\programdata\\*") by - Processes.parent_process_name Processes.parent_process Processes.process_path Processes.dest + Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process_path Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_process_file_path_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 27d9a6ccb8..532d2d864b 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -9,7 +9,7 @@ description: The following analytic detects the use of `reg.exe` to export Windo data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 +- CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` Processes.process IN ("*save*", "*export*")) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND Processes.process IN ("*HKEY_LOCAL_MACHINE*", "*HKLM*") AND Processes.process IN ("*SAM*", "*System*", "*Security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: It is possible some agent based products will generate false positives. Filter as needed. @@ -65,8 +65,3 @@ tests: - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: XmlWinEventLog -- name: True Positive Test - CrowdStrike - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/crowdstrike_falcon.log - source: crowdstrike - sourcetype: crowdstrike:events:sensor From bd608b061fe138b453e79b0790849fe4334a6c8c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Tue, 28 Jan 2025 18:24:23 -0800 Subject: [PATCH 74/82] Update windows_sensitive_registry_hive_dump_via_commandline.yml --- .../windows_sensitive_registry_hive_dump_via_commandline.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index 532d2d864b..d8050741e3 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -9,7 +9,7 @@ description: The following analytic detects the use of `reg.exe` to export Windo data_source: - Sysmon EventID 1 - Windows Event Log Security 4688 -- CrowdStrike ProcessRollup2 +- CrowdStrike ProcessRollup2 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((`process_reg` Processes.process IN ("*save*", "*export*")) OR (`process_regedit` Processes.process IN ("*/E *", "*-E *"))) AND Processes.process IN ("*HKEY_LOCAL_MACHINE*", "*HKLM*") AND Processes.process IN ("*SAM*", "*System*", "*Security*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.parent_process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_sensitive_registry_hive_dump_via_commandline_filter`' how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process. known_false_positives: It is possible some agent based products will generate false positives. Filter as needed. From 857590e1f064b0c77fd849bd8938d7b8225e0f9e Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 30 Jan 2025 08:57:48 -0600 Subject: [PATCH 75/82] Renamed files and updated playbook field so site functions --- ...igence_Identifier_Reputation_Analysis.json | 752 ++++++++++++++++++ ...igence_Identifier_Reputation_Analysis.png} | Bin ...ligence_Identifier_Reputation_Analysis.py} | 0 ...igence_Identifier_Reputation_Analysis.yml} | 2 +- ...igence_Identifier_Reputation_Analysis.json | 752 ------------------ 5 files changed, 753 insertions(+), 753 deletions(-) create mode 100644 playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png => CiscoTalosIntelligence_Identifier_Reputation_Analysis.png} (100%) rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py => CiscoTalosIntelligence_Identifier_Reputation_Analysis.py} (100%) rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml => CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml} (93%) delete mode 100644 playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json new file mode 100644 index 0000000000..24bb6ab01d --- /dev/null +++ b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json @@ -0,0 +1,752 @@ +{ + "blockly": false, + "blockly_xml": "", + "category": "Identifier Reputation Analysis", + "coa": { + "data": { + "description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.", + "edges": [ + { + "id": "port_0_to_port_2", + "sourceNode": "0", + "sourcePort": "0_out", + "targetNode": "2", + "targetPort": "2_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_2_to_port_3", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "3", + "targetPort": "3_in" + }, + { + "conditions": [ + { + "index": 1 + } + ], + "id": "port_2_to_port_4", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "4", + "targetPort": "4_in" + }, + { + "conditions": [ + { + "index": 2 + } + ], + "id": "port_2_to_port_5", + "sourceNode": "2", + "sourcePort": "2_out", + "targetNode": "5", + "targetPort": "5_in" + }, + { + "id": "port_3_to_port_6", + "sourceNode": "3", + "sourcePort": "3_out", + "targetNode": "6", + "targetPort": "6_in" + }, + { + "id": "port_4_to_port_10", + "sourceNode": "4", + "sourcePort": "4_out", + "targetNode": "10", + "targetPort": "10_in" + }, + { + "id": "port_5_to_port_13", + "sourceNode": "5", + "sourcePort": "5_out", + "targetNode": "13", + "targetPort": "13_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_6_to_port_17", + "sourceNode": "6", + "sourcePort": "6_out", + "targetNode": "17", + "targetPort": "17_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_10_to_port_16", + "sourceNode": "10", + "sourcePort": "10_out", + "targetNode": "16", + "targetPort": "16_in" + }, + { + "conditions": [ + { + "index": 0 + } + ], + "id": "port_13_to_port_18", + "sourceNode": "13", + "sourcePort": "13_out", + "targetNode": "18", + "targetPort": "18_in" + }, + { + "id": "port_17_to_port_26", + "sourceNode": "17", + "sourcePort": "17_out", + "targetNode": "26", + "targetPort": "26_in" + }, + { + "id": "port_26_to_port_1", + "sourceNode": "26", + "sourcePort": "26_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_16_to_port_27", + "sourceNode": "16", + "sourcePort": "16_out", + "targetNode": "27", + "targetPort": "27_in" + }, + { + "id": "port_27_to_port_1", + "sourceNode": "27", + "sourcePort": "27_out", + "targetNode": "1", + "targetPort": "1_in" + }, + { + "id": "port_18_to_port_28", + "sourceNode": "18", + "sourcePort": "18_out", + "targetNode": "28", + "targetPort": "28_in" + }, + { + "id": "port_28_to_port_1", + "sourceNode": "28", + "sourcePort": "28_out", + "targetNode": "1", + "targetPort": "1_in" + } + ], + "hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea", + "nodes": { + "0": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_start", + "id": "0", + "type": "start" + }, + "errors": {}, + "id": "0", + "type": "start", + "warnings": {}, + "x": 1000, + "y": 419.9999999999985 + }, + "1": { + "data": { + "advanced": { + "join": [] + }, + "functionName": "on_finish", + "id": "1", + "type": "end" + }, + "errors": {}, + "id": "1", + "type": "end", + "warnings": {}, + "x": 1000, + "y": 1520 + }, + "10": { + "data": { + "advanced": { + "customName": "domain reputation filter", + "customNameId": 0, + "description": "Exclude failing domain reputations", + "join": [], + "note": "Exclude failing domain reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "domain_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 3, + "functionName": "domain_reputation_filter", + "id": "10", + "type": "filter" + }, + "errors": {}, + "id": "10", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 840 + }, + "13": { + "data": { + "advanced": { + "customName": "ip reputation filter", + "customNameId": 0, + "description": "Exclude failing ip reputations", + "join": [], + "note": "Exclude failing ip reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "ip_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 4, + "functionName": "ip_reputation_filter", + "id": "13", + "type": "filter" + }, + "errors": {}, + "id": "13", + "type": "filter", + "warnings": {}, + "x": 1380, + "y": 840 + }, + "16": { + "customCode": null, + "data": { + "advanced": { + "customName": "format 2", + "customNameId": 0, + "description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.", + "join": [], + "note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects." + }, + "functionId": 4, + "functionName": "format_2", + "id": "16", + "parameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "16", + "type": "format", + "userCode": null, + "warnings": {}, + "x": 980, + "y": 1160 + }, + "17": { + "data": { + "advanced": { + "customName": "format 1", + "customNameId": 0, + "description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.", + "join": [], + "note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects." + }, + "functionId": 5, + "functionName": "format_1", + "id": "17", + "parameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "17", + "type": "format", + "warnings": {}, + "x": 640, + "y": 1160 + }, + "18": { + "data": { + "advanced": { + "customName": "format 3", + "customNameId": 0, + "description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ", + "join": [], + "note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. " + }, + "functionId": 6, + "functionName": "format_3", + "id": "18", + "parameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", + "type": "format" + }, + "errors": {}, + "id": "18", + "type": "format", + "warnings": {}, + "x": 1320, + "y": 1160 + }, + "2": { + "data": { + "advanced": { + "customName": "input filter", + "customNameId": 0, + "description": "Filter to pass in a url, domain or ip to it's appropriate action", + "join": [], + "note": "Filter to pass in a url, domain or ip to it's appropriate action" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "!=", + "param": "playbook_input:url", + "value": "" + } + ], + "conditionIndex": 0, + "customName": "url", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 1, + "op": "!=", + "param": "playbook_input:domain", + "value": "" + } + ], + "conditionIndex": 1, + "customName": "domain", + "logic": "and" + }, + { + "comparisons": [ + { + "conditionIndex": 2, + "op": "!=", + "param": "playbook_input:ip", + "value": "" + } + ], + "conditionIndex": 2, + "customName": "ip", + "logic": "and" + } + ], + "functionId": 1, + "functionName": "input_filter", + "id": "2", + "type": "filter" + }, + "errors": {}, + "id": "2", + "type": "filter", + "warnings": {}, + "x": 1040, + "y": 564.5 + }, + "26": { + "customCode": null, + "data": { + "advanced": { + "customName": "build url output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 1, + "functionName": "build_url_output", + "id": "26", + "inputParameters": [ + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", + "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "26", + "type": "code", + "userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 640, + "y": 1380 + }, + "27": { + "customCode": null, + "data": { + "advanced": { + "customName": "build domain output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 2, + "functionName": "build_domain_output", + "id": "27", + "inputParameters": [ + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", + "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "27", + "type": "code", + "userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 980, + "y": 1380 + }, + "28": { + "customCode": null, + "data": { + "advanced": { + "customName": "build ip output", + "customNameId": 0, + "description": "Generate an observable dictionary to output into the observables data path.", + "join": [], + "note": "Generate an observable dictionary to output into the observables data path." + }, + "functionId": 3, + "functionName": "build_ip_output", + "id": "28", + "inputParameters": [ + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", + "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" + ], + "outputVariables": [ + "observable_array" + ], + "type": "code" + }, + "errors": {}, + "id": "28", + "type": "code", + "userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n", + "warnings": {}, + "x": 1320, + "y": 1380 + }, + "3": { + "data": { + "action": "url reputation", + "actionType": "investigate", + "advanced": { + "customName": "url reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an url", + "join": [], + "note": "Use Talos to get threat data on an url" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "url_reputation", + "id": "3", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "url": "filtered-data:input_filter:condition_1:playbook_input:url" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "url" + } + ], + "type": "action" + }, + "errors": {}, + "id": "3", + "type": "action", + "warnings": {}, + "x": 640, + "y": 700 + }, + "4": { + "data": { + "action": "domain reputation", + "actionType": "investigate", + "advanced": { + "customName": "domain reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on a domain", + "join": [], + "note": "Use Talos to get threat data on a domain" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "domain_reputation", + "id": "4", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "domain": "filtered-data:input_filter:condition_2:playbook_input:domain" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "domain" + } + ], + "type": "action" + }, + "errors": {}, + "id": "4", + "type": "action", + "warnings": {}, + "x": 980, + "y": 700 + }, + "5": { + "data": { + "action": "ip reputation", + "actionType": "investigate", + "advanced": { + "customName": "ip reputation", + "customNameId": 0, + "description": "Use Talos to get threat data on an ip", + "join": [], + "note": "Use Talos to get threat data on an ip" + }, + "connector": "Cisco Talos Intelligence", + "connectorConfigs": [ + "cisco_talos_intelligence" + ], + "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", + "connectorVersion": "v1", + "functionId": 1, + "functionName": "ip_reputation", + "id": "5", + "loop": { + "enabled": false, + "exitAfterUnit": "m", + "exitAfterValue": 10, + "exitConditionEnabled": false, + "exitLoopAfter": 2, + "pauseUnit": "m", + "pauseValue": 2 + }, + "parameters": { + "ip": "filtered-data:input_filter:condition_3:playbook_input:ip" + }, + "requiredParameters": [ + { + "data_type": "string", + "default": "", + "field": "ip" + } + ], + "type": "action" + }, + "errors": {}, + "id": "5", + "type": "action", + "warnings": {}, + "x": 1320, + "y": 700 + }, + "6": { + "data": { + "advanced": { + "customName": "url reputation filter", + "customNameId": 0, + "description": "Exclude failing url reputations", + "join": [], + "note": "Exclude failing url reputations" + }, + "conditions": [ + { + "comparisons": [ + { + "conditionIndex": 0, + "op": "==", + "param": "url_reputation:action_result.status", + "value": "success" + } + ], + "conditionIndex": 0, + "customName": "Success", + "logic": "and" + } + ], + "functionId": 2, + "functionName": "url_reputation_filter", + "id": "6", + "type": "filter" + }, + "errors": {}, + "id": "6", + "type": "filter", + "warnings": {}, + "x": 700, + "y": 840 + } + }, + "notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables" + }, + "input_spec": [ + { + "contains": [ + "url" + ], + "description": "A URL provided for reputation analysis", + "name": "url" + }, + { + "contains": [ + "domain" + ], + "description": "A Domain provided for reputation analysis", + "name": "domain" + }, + { + "contains": [ + "ip" + ], + "description": "An IP provided for reputation analysis", + "name": "ip" + } + ], + "output_spec": [ + { + "contains": [], + "datapaths": [ + "build_url_output:custom_function:observable_array", + "build_domain_output:custom_function:observable_array", + "build_ip_output:custom_function:observable_array" + ], + "deduplicate": false, + "description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories", + "metadata": {}, + "name": "observable" + }, + { + "contains": [], + "datapaths": [ + "format_1:formatted_data", + "format_2:formatted_data", + "format_3:formatted_data" + ], + "deduplicate": false, + "description": "An array of reports. One report per observable type.", + "metadata": {}, + "name": "markdown_report" + } + ], + "playbook_trigger": "artifact_created", + "playbook_type": "data", + "python_version": "3", + "schema": "5.0.15", + "version": "6.3.1.176" + }, + "create_time": "2024-12-11T22:12:36.759275+00:00", + "draft_mode": false, + "labels": [ + "*" + ], + "tags": [ + "reputation", + "url", + "ip", + "domain", + "Cisco Talos Intelligence" + ] +} diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png similarity index 100% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py similarity index 100% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml similarity index 93% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml index de5b0d3276..a66cd2fd49 100644 --- a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml +++ b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml @@ -5,7 +5,7 @@ date: '2025-01-17' author: Kelby Shelton, Tapish Jain, Splunk type: Investigation description: "Accepts a URL, IP or Domain and provides intelligence on the objects. Generates a per observable report that includes the objects threat level, threat categories, acceptable use categories and score." -playbook: Cisco_Talos_Intelligence_Identifier_Reputation_Analysis +playbook: CiscoTalosIntelligence_Identifier_Reputation_Analysis how_to_implement: This input playbook requires the Cisco Talos Intelligence connector to be configured and a Splunk SOAR cloud license. references: - https://d3fend.mitre.org/technique/d3f:IdentifierReputationAnalysis/ diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json deleted file mode 100644 index 827ec3798e..0000000000 --- a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json +++ /dev/null @@ -1,752 +0,0 @@ -{ - "blockly": false, - "blockly_xml": "", - "category": "Identifier Reputation Analysis", - "coa": { - "data": { - "description": "Accepts a URL, IP or Domain and does reputation analysis on the objects. Generates a threat level, threat categories and AUP categories that are formatted and added to a container as a note.", - "edges": [ - { - "id": "port_0_to_port_2", - "sourceNode": "0", - "sourcePort": "0_out", - "targetNode": "2", - "targetPort": "2_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_2_to_port_3", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "3", - "targetPort": "3_in" - }, - { - "conditions": [ - { - "index": 1 - } - ], - "id": "port_2_to_port_4", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "4", - "targetPort": "4_in" - }, - { - "conditions": [ - { - "index": 2 - } - ], - "id": "port_2_to_port_5", - "sourceNode": "2", - "sourcePort": "2_out", - "targetNode": "5", - "targetPort": "5_in" - }, - { - "id": "port_3_to_port_6", - "sourceNode": "3", - "sourcePort": "3_out", - "targetNode": "6", - "targetPort": "6_in" - }, - { - "id": "port_4_to_port_10", - "sourceNode": "4", - "sourcePort": "4_out", - "targetNode": "10", - "targetPort": "10_in" - }, - { - "id": "port_5_to_port_13", - "sourceNode": "5", - "sourcePort": "5_out", - "targetNode": "13", - "targetPort": "13_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_6_to_port_17", - "sourceNode": "6", - "sourcePort": "6_out", - "targetNode": "17", - "targetPort": "17_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_10_to_port_16", - "sourceNode": "10", - "sourcePort": "10_out", - "targetNode": "16", - "targetPort": "16_in" - }, - { - "conditions": [ - { - "index": 0 - } - ], - "id": "port_13_to_port_18", - "sourceNode": "13", - "sourcePort": "13_out", - "targetNode": "18", - "targetPort": "18_in" - }, - { - "id": "port_17_to_port_26", - "sourceNode": "17", - "sourcePort": "17_out", - "targetNode": "26", - "targetPort": "26_in" - }, - { - "id": "port_26_to_port_1", - "sourceNode": "26", - "sourcePort": "26_out", - "targetNode": "1", - "targetPort": "1_in" - }, - { - "id": "port_16_to_port_27", - "sourceNode": "16", - "sourcePort": "16_out", - "targetNode": "27", - "targetPort": "27_in" - }, - { - "id": "port_27_to_port_1", - "sourceNode": "27", - "sourcePort": "27_out", - "targetNode": "1", - "targetPort": "1_in" - }, - { - "id": "port_18_to_port_28", - "sourceNode": "18", - "sourcePort": "18_out", - "targetNode": "28", - "targetPort": "28_in" - }, - { - "id": "port_28_to_port_1", - "sourceNode": "28", - "sourcePort": "28_out", - "targetNode": "1", - "targetPort": "1_in" - } - ], - "hash": "eba6b9d077093e83e07346cba73e6ed0a16e86ea", - "nodes": { - "0": { - "data": { - "advanced": { - "join": [] - }, - "functionName": "on_start", - "id": "0", - "type": "start" - }, - "errors": {}, - "id": "0", - "type": "start", - "warnings": {}, - "x": 1000, - "y": 419.9999999999985 - }, - "1": { - "data": { - "advanced": { - "join": [] - }, - "functionName": "on_finish", - "id": "1", - "type": "end" - }, - "errors": {}, - "id": "1", - "type": "end", - "warnings": {}, - "x": 1000, - "y": 1520 - }, - "10": { - "data": { - "advanced": { - "customName": "domain reputation filter", - "customNameId": 0, - "description": "Exclude failing domain reputations", - "join": [], - "note": "Exclude failing domain reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "domain_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 3, - "functionName": "domain_reputation_filter", - "id": "10", - "type": "filter" - }, - "errors": {}, - "id": "10", - "type": "filter", - "warnings": {}, - "x": 1040, - "y": 840 - }, - "13": { - "data": { - "advanced": { - "customName": "ip reputation filter", - "customNameId": 0, - "description": "Exclude failing ip reputations", - "join": [], - "note": "Exclude failing ip reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "ip_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 4, - "functionName": "ip_reputation_filter", - "id": "13", - "type": "filter" - }, - "errors": {}, - "id": "13", - "type": "filter", - "warnings": {}, - "x": 1380, - "y": 840 - }, - "16": { - "customCode": null, - "data": { - "advanced": { - "customName": "format 2", - "customNameId": 0, - "description": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects.", - "join": [], - "note": "Format output of domain threat data into an appropriate format for build_domain_output that generates observable objects." - }, - "functionId": 4, - "functionName": "format_2", - "id": "16", - "parameters": [ - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed Domain using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| Domain | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "16", - "type": "format", - "userCode": null, - "warnings": {}, - "x": 980, - "y": 1160 - }, - "17": { - "data": { - "advanced": { - "customName": "format 1", - "customNameId": 0, - "description": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects.", - "join": [], - "note": "Format output of url threat data into an appropriate format for build_url_output that generates observable objects." - }, - "functionId": 5, - "functionName": "format_1", - "id": "17", - "parameters": [ - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed URL using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| URL | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "17", - "type": "format", - "warnings": {}, - "x": 640, - "y": 1160 - }, - "18": { - "data": { - "advanced": { - "customName": "format 3", - "customNameId": 0, - "description": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. ", - "join": [], - "note": "Format output of ip threat data into an appropriate format for build_ip_output that generates observable objects. " - }, - "functionId": 6, - "functionName": "format_3", - "id": "18", - "parameters": [ - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" - ], - "template": "SOAR analyzed IP using Talos Intelligence. The table below shows a summary of the information gathered.\n\n| IP | Threat Level | Threat Categories | AUP Categories |\n| --- | --- | --- | --- |\n%%\n| {0} | {1} | {2} | {3}\n%%", - "type": "format" - }, - "errors": {}, - "id": "18", - "type": "format", - "warnings": {}, - "x": 1320, - "y": 1160 - }, - "2": { - "data": { - "advanced": { - "customName": "input filter", - "customNameId": 0, - "description": "Filter to pass in a url, domain or ip to it's appropriate action", - "join": [], - "note": "Filter to pass in a url, domain or ip to it's appropriate action" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "!=", - "param": "playbook_input:url", - "value": "" - } - ], - "conditionIndex": 0, - "customName": "url", - "logic": "and" - }, - { - "comparisons": [ - { - "conditionIndex": 1, - "op": "!=", - "param": "playbook_input:domain", - "value": "" - } - ], - "conditionIndex": 1, - "customName": "domain", - "logic": "and" - }, - { - "comparisons": [ - { - "conditionIndex": 2, - "op": "!=", - "param": "playbook_input:ip", - "value": "" - } - ], - "conditionIndex": 2, - "customName": "ip", - "logic": "and" - } - ], - "functionId": 1, - "functionName": "input_filter", - "id": "2", - "type": "filter" - }, - "errors": {}, - "id": "2", - "type": "filter", - "warnings": {}, - "x": 1040, - "y": 564.5 - }, - "26": { - "customCode": null, - "data": { - "advanced": { - "customName": "build url output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 1, - "functionName": "build_url_output", - "id": "26", - "inputParameters": [ - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Observable", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Level", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.Threat_Categories", - "filtered-data:url_reputation_filter:condition_1:url_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "26", - "type": "code", - "userCode": "\n from urllib.parse import urlparse\n build_url_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for url, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n parsed_url = urlparse(url)\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": url,\n \"type\": \"url\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"attributes\": {\n \"hostname\": parsed_url.hostname,\n \"scheme\": parsed_url.scheme\n },\n \"source\": \"Cisco Talos Intelligence\",\n }\n if parsed_url.path:\n observable_object['attributes']['path'] = parsed_url.path\n if parsed_url.query:\n observable_object['attributes']['query'] = parsed_url.query\n if parsed_url.port:\n observable_object['attributes']['port'] = parsed_url.port\n \n build_url_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 640, - "y": 1380 - }, - "27": { - "customCode": null, - "data": { - "advanced": { - "customName": "build domain output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 2, - "functionName": "build_domain_output", - "id": "27", - "inputParameters": [ - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Observable", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Level", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.Threat_Categories", - "filtered-data:domain_reputation_filter:condition_1:domain_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "27", - "type": "code", - "userCode": "\n build_domain_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for domain, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": domain,\n \"type\": \"domain\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n build_domain_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 980, - "y": 1380 - }, - "28": { - "customCode": null, - "data": { - "advanced": { - "customName": "build ip output", - "customNameId": 0, - "description": "Generate an observable dictionary to output into the observables data path.", - "join": [], - "note": "Generate an observable dictionary to output into the observables data path." - }, - "functionId": 3, - "functionName": "build_ip_output", - "id": "28", - "inputParameters": [ - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Observable", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Level", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.Threat_Categories", - "filtered-data:ip_reputation_filter:condition_1:ip_reputation:action_result.data.*.AUP" - ], - "outputVariables": [ - "observable_array" - ], - "type": "code" - }, - "errors": {}, - "id": "28", - "type": "code", - "userCode": "\n import ipaddress\n build_ip_output__observable_array = []\n \n talos_to_score_mapping = {\"unknown\": \"Unknown\", \"trusted\": \"Safe\", \"favorable\": \"Probably_Safe\", \"neutral\": \"May_not_be_Safe\", \"questionable\": \"Suspicious_or_Risky\", \"unstrusted\": \"Malicious\"}\n score_table = {\n \"Unkown\": \"0\",\n \"Very_Safe\": \"1\",\n \"Safe\": \"2\",\n \"Probably_Safe\": \"3\",\n \"Leans_Safe\": \"4\",\n \"May_not_be_Safe\": \"5\",\n \"Exercise_Caution\": \"6\",\n \"Suspicious_or_Risky\": \"7\",\n \"Possibly_Malicious\": \"8\",\n \"Probably_Malicious\": \"9\",\n \"Malicious\": \"10\"\n }\n \n for ip, threat_level, threat_categories, aup in zip(filtered_result_0_data___observable, filtered_result_0_data___threat_level, filtered_result_0_data___threat_categories, filtered_result_0_data___aup):\n score = talos_to_score_mapping.get(threat_level.lower(), \"\")\n observable_object = {\n \"value\": ip,\n \"type\": \"ipv4\",\n \"reputation\": {\n \"threat_level\": threat_level,\n \"threat_categories\": threat_categories,\n \"aup_categories\": aup,\n \"score\": score,\n \"score_id\": score_table.get(score, \"\")\n },\n \"source\": \"Cisco Talos Intelligence\"\n }\n ip_addr = ipaddress.ip_address(ip)\n if isinstance(ip_addr, ipaddress.IPv6Address):\n observable_object[\"type\"] = \"ipv6\"\n\n build_ip_output__observable_array.append(observable_object)\n\n", - "warnings": {}, - "x": 1320, - "y": 1380 - }, - "3": { - "data": { - "action": "url reputation", - "actionType": "investigate", - "advanced": { - "customName": "url reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on an url", - "join": [], - "note": "Use Talos to get threat data on an url" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "url_reputation", - "id": "3", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "url": "filtered-data:input_filter:condition_1:playbook_input:url" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "url" - } - ], - "type": "action" - }, - "errors": {}, - "id": "3", - "type": "action", - "warnings": {}, - "x": 640, - "y": 700 - }, - "4": { - "data": { - "action": "domain reputation", - "actionType": "investigate", - "advanced": { - "customName": "domain reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on a domain", - "join": [], - "note": "Use Talos to get threat data on a domain" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "domain_reputation", - "id": "4", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "domain": "filtered-data:input_filter:condition_2:playbook_input:domain" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "domain" - } - ], - "type": "action" - }, - "errors": {}, - "id": "4", - "type": "action", - "warnings": {}, - "x": 980, - "y": 700 - }, - "5": { - "data": { - "action": "ip reputation", - "actionType": "investigate", - "advanced": { - "customName": "ip reputation", - "customNameId": 0, - "description": "Use Talos to get threat data on an ip", - "join": [], - "note": "Use Talos to get threat data on an ip" - }, - "connector": "Cisco Talos Intelligence", - "connectorConfigs": [ - "cisco_talos_intelligence" - ], - "connectorId": "7c653487-22c8-4ec1-bca0-16a8b1513c86", - "connectorVersion": "v1", - "functionId": 1, - "functionName": "ip_reputation", - "id": "5", - "loop": { - "enabled": false, - "exitAfterUnit": "m", - "exitAfterValue": 10, - "exitConditionEnabled": false, - "exitLoopAfter": 2, - "pauseUnit": "m", - "pauseValue": 2 - }, - "parameters": { - "ip": "filtered-data:input_filter:condition_3:playbook_input:ip" - }, - "requiredParameters": [ - { - "data_type": "string", - "default": "", - "field": "ip" - } - ], - "type": "action" - }, - "errors": {}, - "id": "5", - "type": "action", - "warnings": {}, - "x": 1320, - "y": 700 - }, - "6": { - "data": { - "advanced": { - "customName": "url reputation filter", - "customNameId": 0, - "description": "Exclude failing url reputations", - "join": [], - "note": "Exclude failing url reputations" - }, - "conditions": [ - { - "comparisons": [ - { - "conditionIndex": 0, - "op": "==", - "param": "url_reputation:action_result.status", - "value": "success" - } - ], - "conditionIndex": 0, - "customName": "Success", - "logic": "and" - } - ], - "functionId": 2, - "functionName": "url_reputation_filter", - "id": "6", - "type": "filter" - }, - "errors": {}, - "id": "6", - "type": "filter", - "warnings": {}, - "x": 700, - "y": 840 - } - }, - "notes": "Inputs: url, ip, domain\nInteractions: Cisco Talos Intelligence\nActions: url reputation, ip reputation, domain reputation, file reputation\nOutputs: note, observables" - }, - "input_spec": [ - { - "contains": [ - "url" - ], - "description": "A URL provided for reputation analysis", - "name": "url" - }, - { - "contains": [ - "domain" - ], - "description": "A Domain provided for reputation analysis", - "name": "domain" - }, - { - "contains": [ - "ip" - ], - "description": "An IP provided for reputation analysis", - "name": "ip" - } - ], - "output_spec": [ - { - "contains": [], - "datapaths": [ - "build_url_output:custom_function:observable_array", - "build_domain_output:custom_function:observable_array", - "build_ip_output:custom_function:observable_array" - ], - "deduplicate": false, - "description": "An array of observable dictionaries with value, threat level, threat categories and AUP categories", - "metadata": {}, - "name": "observable" - }, - { - "contains": [], - "datapaths": [ - "format_1:formatted_data", - "format_2:formatted_data", - "format_3:formatted_data" - ], - "deduplicate": false, - "description": "An array of reports. One report per observable type.", - "metadata": {}, - "name": "markdown_report" - } - ], - "playbook_trigger": "artifact_created", - "playbook_type": "data", - "python_version": "3", - "schema": "5.0.15", - "version": "6.3.1.176" - }, - "create_time": "2024-12-11T22:12:36.759275+00:00", - "draft_mode": false, - "labels": [ - "*" - ], - "tags": [ - "reputation", - "url", - "ip", - "domain", - "Cisco Talos Intelligence" - ] -} \ No newline at end of file From 41eb86190484e3a44e84173712fbdf9b747992d5 Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 30 Jan 2025 09:04:37 -0600 Subject: [PATCH 76/82] Renaming again for a new reason --- ...ntelligence_Identifier_Reputation_Analysis.json} | 0 ...Intelligence_Identifier_Reputation_Analysis.png} | Bin ..._Intelligence_Identifier_Reputation_Analysis.py} | 0 ...Intelligence_Identifier_Reputation_Analysis.yml} | 0 4 files changed, 0 insertions(+), 0 deletions(-) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.json => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json} (100%) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.png => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png} (100%) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.py => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py} (100%) rename playbooks/{CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml => Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml} (100%) diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.json rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.json diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.py rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.py diff --git a/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml b/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml similarity index 100% rename from playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.yml rename to playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.yml From 7d265c8efa185fd6d339a787eddc09a082572ccb Mon Sep 17 00:00:00 2001 From: ljstella Date: Thu, 30 Jan 2025 09:15:53 -0600 Subject: [PATCH 77/82] Renaming file again, maybe this won't break --- ...Intelligence_Identifier_Reputation_Analysis.png} | Bin 1 file changed, 0 insertions(+), 0 deletions(-) rename playbooks/{Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png => CiscoTalosIntelligence_Identifier_Reputation_Analysis.png} (100%) diff --git a/playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png b/playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png similarity index 100% rename from playbooks/Cisco_Talos_Intelligence_Identifier_Reputation_Analysis.png rename to playbooks/CiscoTalosIntelligence_Identifier_Reputation_Analysis.png From cc90411ace7ffeb602e6e2813c4072930e59bcf4 Mon Sep 17 00:00:00 2001 From: patel-bhavin <7771446+patel-bhavin@users.noreply.github.com> Date: Fri, 31 Jan 2025 06:57:58 +0000 Subject: [PATCH 78/82] Updated TAs --- contentctl.yml | 4 ++-- data_sources/azure_active_directory.yml | 2 +- ...p_role_assignment_to_service_principal.yml | 2 +- ...re_active_directory_add_member_to_role.yml | 2 +- ...ive_directory_add_owner_to_application.yml | 2 +- ...active_directory_add_service_principal.yml | 2 +- ...active_directory_add_unverified_domain.yml | 2 +- ...ctive_directory_consent_to_application.yml | 2 +- ...irectory_disable_strong_authentication.yml | 2 +- .../azure_active_directory_enable_account.yml | 2 +- ..._active_directory_invite_external_user.yml | 2 +- ...ve_directory_reset_password_(by_admin).yml | 2 +- ...ve_directory_set_domain_authentication.yml | 2 +- ...zure_active_directory_sign_in_activity.yml | 2 +- ...re_active_directory_update_application.yml | 2 +- ..._directory_update_authorization_policy.yml | 2 +- .../azure_active_directory_update_user.yml | 2 +- ...irectory_user_registered_security_info.yml | 2 +- ..._or_update_an_azure_automation_account.yml | 2 +- ..._or_update_an_azure_automation_runbook.yml | 2 +- ..._or_update_an_azure_automation_webhook.yml | 2 +- data_sources/azure_monitor_activity.yml | 21 ++++++++++++++++--- 22 files changed, 40 insertions(+), 25 deletions(-) diff --git a/contentctl.yml b/contentctl.yml index 1608f85298..3cc7816952 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -155,9 +155,9 @@ apps: - uid: 3110 title: Splunk Add-on for Microsoft Cloud Services appid: SPLUNK_TA_MICROSOFT_CLOUD_SERVICES - version: 5.4.1 + version: 5.4.2 description: description of app - hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_541.tgz + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/splunk-add-on-for-microsoft-cloud-services_542.tgz - uid: 4055 title: Splunk Add-on for Microsoft Office 365 appid: SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365 diff --git a/data_sources/azure_active_directory.yml b/data_sources/azure_active_directory.yml index 5acf9c76b5..2fa460b33f 100644 --- a/data_sources/azure_active_directory.yml +++ b/data_sources/azure_active_directory.yml @@ -10,4 +10,4 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 diff --git a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml index 9db213655d..f527bda794 100644 --- a/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml +++ b/data_sources/azure_active_directory_add_app_role_assignment_to_service_principal.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_member_to_role.yml b/data_sources/azure_active_directory_add_member_to_role.yml index c62d91a8c2..3a0db1013e 100644 --- a/data_sources/azure_active_directory_add_member_to_role.yml +++ b/data_sources/azure_active_directory_add_member_to_role.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_owner_to_application.yml b/data_sources/azure_active_directory_add_owner_to_application.yml index 6e3b00d39a..a58de4a47b 100644 --- a/data_sources/azure_active_directory_add_owner_to_application.yml +++ b/data_sources/azure_active_directory_add_owner_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_service_principal.yml b/data_sources/azure_active_directory_add_service_principal.yml index 798a1dd0c9..e3970586a3 100644 --- a/data_sources/azure_active_directory_add_service_principal.yml +++ b/data_sources/azure_active_directory_add_service_principal.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_add_unverified_domain.yml b/data_sources/azure_active_directory_add_unverified_domain.yml index 2cb8e93738..d4103cfef6 100644 --- a/data_sources/azure_active_directory_add_unverified_domain.yml +++ b/data_sources/azure_active_directory_add_unverified_domain.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_consent_to_application.yml b/data_sources/azure_active_directory_consent_to_application.yml index 9464b69c7a..d7a04aa5ad 100644 --- a/data_sources/azure_active_directory_consent_to_application.yml +++ b/data_sources/azure_active_directory_consent_to_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_disable_strong_authentication.yml b/data_sources/azure_active_directory_disable_strong_authentication.yml index 2b1fd79f79..2ef98d1f69 100644 --- a/data_sources/azure_active_directory_disable_strong_authentication.yml +++ b/data_sources/azure_active_directory_disable_strong_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_enable_account.yml b/data_sources/azure_active_directory_enable_account.yml index 710007e9f8..b09a4f4204 100644 --- a/data_sources/azure_active_directory_enable_account.yml +++ b/data_sources/azure_active_directory_enable_account.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_invite_external_user.yml b/data_sources/azure_active_directory_invite_external_user.yml index ebb0a4dea9..e66920d152 100644 --- a/data_sources/azure_active_directory_invite_external_user.yml +++ b/data_sources/azure_active_directory_invite_external_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_reset_password_(by_admin).yml b/data_sources/azure_active_directory_reset_password_(by_admin).yml index 1247baa3b5..b3fb17cd5e 100644 --- a/data_sources/azure_active_directory_reset_password_(by_admin).yml +++ b/data_sources/azure_active_directory_reset_password_(by_admin).yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_set_domain_authentication.yml b/data_sources/azure_active_directory_set_domain_authentication.yml index 07fbd4945f..dda3730b7f 100644 --- a/data_sources/azure_active_directory_set_domain_authentication.yml +++ b/data_sources/azure_active_directory_set_domain_authentication.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_sign_in_activity.yml b/data_sources/azure_active_directory_sign_in_activity.yml index 71e28dc986..7b53354989 100644 --- a/data_sources/azure_active_directory_sign_in_activity.yml +++ b/data_sources/azure_active_directory_sign_in_activity.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_application.yml b/data_sources/azure_active_directory_update_application.yml index 821d432ecf..b77b1dfa80 100644 --- a/data_sources/azure_active_directory_update_application.yml +++ b/data_sources/azure_active_directory_update_application.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_authorization_policy.yml b/data_sources/azure_active_directory_update_authorization_policy.yml index 6d43b471e6..d04c125346 100644 --- a/data_sources/azure_active_directory_update_authorization_policy.yml +++ b/data_sources/azure_active_directory_update_authorization_policy.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_update_user.yml b/data_sources/azure_active_directory_update_user.yml index 4efa2a3816..c589966ec2 100644 --- a/data_sources/azure_active_directory_update_user.yml +++ b/data_sources/azure_active_directory_update_user.yml @@ -10,7 +10,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_active_directory_user_registered_security_info.yml b/data_sources/azure_active_directory_user_registered_security_info.yml index f7bef825fe..5880ca36cd 100644 --- a/data_sources/azure_active_directory_user_registered_security_info.yml +++ b/data_sources/azure_active_directory_user_registered_security_info.yml @@ -11,7 +11,7 @@ separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - Level diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml index 8e30686b23..b341d24461 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_account.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml index 024427c038..6511f9fe3e 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_runbook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml index 35fccd817e..da046c0e0b 100644 --- a/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml +++ b/data_sources/azure_audit_create_or_update_an_azure_automation_webhook.yml @@ -11,7 +11,7 @@ separator: operationName.localizedValue supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - _time - authorization.action diff --git a/data_sources/azure_monitor_activity.yml b/data_sources/azure_monitor_activity.yml index 4a4eb3f0b0..d3526f723c 100644 --- a/data_sources/azure_monitor_activity.yml +++ b/data_sources/azure_monitor_activity.yml @@ -3,14 +3,17 @@ id: 1997a515-a61a-4f78-ada9-54af34c764f2 version: 1 date: '2025-01-13' author: Bhavin Patel, Splunk -description: Data source object for Azure Monitor Activity. The Splunk Add-on for Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic settings > Add diagnostic settings & send events to the activity audit event hub. +description: Data source object for Azure Monitor Activity. The Splunk Add-on for + Microsoft Cloud Services add-on is required to ingest In-Tune audit logs via Azure + EventHub. To configure this logging, visit Intune > Tenant administration > Diagnostic + settings > Add diagnostic settings & send events to the activity audit event hub. source: Azure AD sourcetype: azure:monitor:activity separator: operationName supported_TA: - name: Splunk Add-on for Microsoft Cloud Services url: https://splunkbase.splunk.com/app/3110 - version: 5.4.1 + version: 5.4.2 fields: - column - action @@ -93,4 +96,16 @@ fields: - vendor_product - vendor_region - _time -example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", "Category": 3, "RelationId": null, "TargetDisplayNames": [""], "TargetObjectIds": ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", "identity": "brian.cove@frothlydev.onmicrosoft.com"}' +example_log: '{"time": "2024-04-29T13:30:28.8622000Z", "tenantId": "26db52ee-c1b5-4c96-a0d4-129e25dc0388", + "category": "AuditLogs", "operationName": "createDeviceHealthScript DeviceHealthScript", + "properties": {"ActivityDate": "4/29/2024 1:30:28 PM", "ActivityResultStatus": 1, + "ActivityType": 0, "Actor": {"ActorType": 1, "Application": "5926fc8e-304e-4f59-8bed-58ca97cc39a4", + "ApplicationName": "Microsoft Intune portal extension", "IsDelegatedAdmin": false, + "Name": null, "ObjectId": "cf2ef473-7d3b-4f14-961c-2e470e9a70f2", "PartnerTenantId": + "00000000-0000-0000-0000-000000000000", "UserPermissions": ["*"], "UPN": "brian.cove@frothlydev.onmicrosoft.com"}, + "AdditionalDetails": "", "AuditEventId": "3e7e790e-f15a-4c2c-a91a-516483bb4e37", + "Category": 3, "RelationId": null, "TargetDisplayNames": [""], "TargetObjectIds": + ["b16fcad4-b9f5-46fe-9bf0-841cd9be7bc9"], "Targets": [{"ModifiedProperties": [{"Name": + "DeviceManagementAPIVersion", "Old": null, "New": "5024-02-13"}], "Name": null}]}, + "resultType": "Success", "resultDescription": "None", "correlationId": "949ac544-b4e5-4576-a117-915c47c0ee00", + "identity": "brian.cove@frothlydev.onmicrosoft.com"}' From e1ee551a608a22bfc7412dd24367fe42774d15d3 Mon Sep 17 00:00:00 2001 From: research-bot Date: Mon, 3 Feb 2025 13:50:08 -0800 Subject: [PATCH 79/82] udpating to 5 --- contentctl.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/contentctl.yml b/contentctl.yml index 3cc7816952..1bd5b72e03 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 4.44.0 + version: 5.0.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU From 75617e961dae6b43731c00ec0ec3b87d7bf4ccfe Mon Sep 17 00:00:00 2001 From: Patrick Bareiss Date: Wed, 5 Feb 2025 09:19:19 +0100 Subject: [PATCH 80/82] linux secure data source --- data_sources/linux_secure.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/data_sources/linux_secure.yml b/data_sources/linux_secure.yml index cd08575aa2..468d387446 100644 --- a/data_sources/linux_secure.yml +++ b/data_sources/linux_secure.yml @@ -6,7 +6,10 @@ author: Patrick Bareiss, Splunk description: Data source object for Linux Secure source: /var/log/secure sourcetype: linux_secure -supported_TA: [] +supported_TA: +- name: Splunk Add-on for Unix and Linux + url: https://splunkbase.splunk.com/app/833 + version: 9.2.0 fields: - _time - action From 76a9a02c9e7826721e8867d5838c84a7768d068c Mon Sep 17 00:00:00 2001 From: research-bot Date: Wed, 5 Feb 2025 10:49:03 -0800 Subject: [PATCH 81/82] updating versions --- ..._auth_source_and_verification_response.yml | 2 +- ...s_ad_suspicious_attribute_modification.yml | 2 +- ...windows_ad_suspicious_gpo_modification.yml | 2 +- ...pplication_administrator_role_assigned.yml | 2 +- ...azure_ad_azurehound_useragent_detected.yml | 2 +- .../azure_ad_external_guest_user_invited.yml | 2 +- ...d_multi_factor_authentication_disabled.yml | 2 +- .../azure_ad_privileged_role_assigned.yml | 2 +- ...azure_ad_service_principal_enumeration.yml | 2 +- ...azure_ad_service_principal_owner_added.yml | 2 +- ...ure_ad_user_enabled_and_password_reset.yml | 2 +- ..._ad_user_immutableid_attribute_updated.yml | 2 +- ...p_multi_factor_authentication_disabled.yml | 2 +- .../gsuite_drive_share_in_external_email.yml | 2 +- .../gsuite_suspicious_shared_file_name.yml | 2 +- ...rvice_principal_new_client_credentials.yml | 2 +- .../attempt_to_stop_security_service.yml | 2 +- ...dential_dump_from_registry_via_reg_exe.yml | 2 +- ...cmdline_tool_not_executed_in_cmd_shell.yml | 2 +- ...ate_local_admin_accounts_using_net_exe.yml | 2 +- .../deprecated/deleting_of_net_users.yml | 2 +- ...system_network_configuration_discovery.yml | 2 +- .../deprecated/disabling_net_user_account.yml | 2 +- .../deprecated/excel_spawning_powershell.yml | 2 +- .../excel_spawning_windows_script_host.yml | 2 +- .../deprecated/excessive_usage_of_net_app.yml | 2 +- .../extraction_of_registry_hives.yml | 2 +- .../office_product_spawn_cmd_process.yml | 2 +- ...e_product_spawning_windows_script_host.yml | 2 +- .../deprecated/office_spawning_control.yml | 2 +- .../osquery_pack___coldroot_detection.yml | 2 +- .../windows_lateral_tool_transfer_remcom.yml | 2 +- ...ndows_msiexec_with_network_connections.yml | 2 +- .../windows_office_product_spawning_msdt.yml | 2 +- .../endpoint/anomalous_usage_of_7zip.yml | 2 +- .../endpoint/any_powershell_downloadfile.yml | 2 +- .../any_powershell_downloadstring.yml | 2 +- ..._to_add_certificate_to_untrusted_store.yml | 2 +- .../bcdedit_failure_recovery_modification.yml | 2 +- detections/endpoint/bits_job_persistence.yml | 2 +- .../endpoint/bitsadmin_download_file.yml | 2 +- ...load_with_urlcache_and_split_arguments.yml | 2 +- ...oad_with_verifyctl_and_split_arguments.yml | 2 +- .../certutil_exe_certificate_extraction.yml | 2 +- .../certutil_with_decode_argument.yml | 2 +- .../check_elevated_cmd_using_whoami.yml | 2 +- ...ar_unallocated_sector_using_cipher_app.yml | 2 +- .../endpoint/clop_common_exec_parameter.yml | 2 +- .../endpoint/cmd_echo_pipe___escalation.yml | 2 +- .../endpoint/common_ransomware_extensions.yml | 2 +- .../endpoint/conti_common_exec_parameter.yml | 2 +- ..._loading_from_world_writable_directory.yml | 2 +- ...or_delete_windows_shares_using_net_exe.yml | 2 +- .../endpoint/deleting_shadow_copies.yml | 2 +- ...tect_azurehound_command_line_arguments.yml | 2 +- ...y_with_powershell_script_block_logging.yml | 2 +- .../detect_certipy_file_modifications.yml | 2 +- .../detect_html_help_spawn_child_process.yml | 2 +- .../detect_html_help_url_in_command_line.yml | 2 +- ...z_with_powershell_script_block_logging.yml | 2 +- .../detect_mshta_inline_hta_execution.yml | 2 +- .../detect_mshta_url_in_command_line.yml | 2 +- ...nterception_by_creation_of_program_exe.yml | 2 +- .../detect_psexec_with_accepteula_flag.yml | 2 +- .../detect_rclone_command_line_usage.yml | 2 +- .../detect_regasm_spawning_a_process.yml | 2 +- ..._regasm_with_no_command_line_arguments.yml | 2 +- .../detect_regsvcs_spawning_a_process.yml | 2 +- ...regsvcs_with_no_command_line_arguments.yml | 2 +- ...ct_regsvr32_application_control_bypass.yml | 2 +- ...2_application_control_bypass___advpack.yml | 2 +- ..._application_control_bypass___setupapi.yml | 2 +- ..._application_control_bypass___syssetup.yml | 2 +- ...ssnames_using_pretrained_model_in_dsdl.yml | 2 +- .../dns_exfiltration_using_nslookup_app.yml | 2 +- .../endpoint/dsquery_domain_discovery.yml | 2 +- .../endpoint/dump_lsass_via_comsvcs_dll.yml | 2 +- .../endpoint/dump_lsass_via_procdump.yml | 2 +- detections/endpoint/etw_registry_disabled.yml | 2 +- ...cute_javascript_with_jscript_com_clsid.yml | 2 +- ...ution_of_file_with_multiple_extensions.yml | 2 +- .../endpoint/file_with_samsam_extension.yml | 2 +- ...no_command_line_arguments_with_network.yml | 2 +- ...dless_browser_mockbin_or_mocky_request.yml | 2 +- .../linux_apt_get_privilege_escalation.yml | 2 +- .../linux_apt_privilege_escalation.yml | 2 +- .../linux_awk_privilege_escalation.yml | 2 +- .../linux_busybox_privilege_escalation.yml | 2 +- .../linux_c89_privilege_escalation.yml | 2 +- .../linux_c99_privilege_escalation.yml | 2 +- .../linux_composer_privilege_escalation.yml | 2 +- .../linux_cpulimit_privilege_escalation.yml | 2 +- .../linux_csvtool_privilege_escalation.yml | 2 +- .../linux_data_destruction_command.yml | 2 +- .../endpoint/linux_decode_base64_to_shell.yml | 2 +- .../linux_docker_privilege_escalation.yml | 2 +- .../linux_emacs_privilege_escalation.yml | 2 +- .../linux_find_privilege_escalation.yml | 2 +- .../linux_gdb_privilege_escalation.yml | 2 +- .../linux_gem_privilege_escalation.yml | 2 +- .../linux_gnu_awk_privilege_escalation.yml | 2 +- .../endpoint/linux_java_spawning_shell.yml | 2 +- .../linux_kernel_module_enumeration.yml | 2 +- .../linux_make_privilege_escalation.yml | 2 +- .../linux_mysql_privilege_escalation.yml | 2 +- .../linux_ngrok_reverse_proxy_usage.yml | 2 +- .../linux_node_privilege_escalation.yml | 2 +- ...ted_files_or_information_base64_decode.yml | 2 +- .../linux_octave_privilege_escalation.yml | 2 +- .../linux_openvpn_privilege_escalation.yml | 2 +- .../linux_php_privilege_escalation.yml | 2 +- .../linux_pkexec_privilege_escalation.yml | 2 +- .../endpoint/linux_proxy_socks_curl.yml | 2 +- .../linux_puppet_privilege_escalation.yml | 2 +- .../linux_rpm_privilege_escalation.yml | 2 +- .../linux_ruby_privilege_escalation.yml | 2 +- .../linux_sqlite3_privilege_escalation.yml | 2 +- ...linux_ssh_authorized_keys_modification.yml | 2 +- ...nux_ssh_remote_services_script_execute.yml | 2 +- .../microsoft_defender_atp_alerts.yml | 2 +- .../microsoft_defender_incident_alerts.yml | 2 +- ..._spawning_rundll32_or_regsvr32_process.yml | 2 +- ...notepad_with_no_command_line_arguments.yml | 2 +- ...twork_configuration_discovery_activity.yml | 2 +- .../powershell_load_module_in_meterpreter.yml | 2 +- ...ding_dotnet_into_memory_via_reflection.yml | 2 +- .../powershell_processing_stream_of_data.yml | 2 +- ...hell_remove_windows_defender_directory.yml | 2 +- .../powershell_start_bitstransfer.yml | 2 +- ...nt_automatic_repair_mode_using_bcdedit.yml | 2 +- .../process_kill_base_on_file_path.yml | 2 +- .../recon_avproduct_through_pwh_or_wmi.yml | 2 +- ...ulating_windows_services_registry_keys.yml | 2 +- ...istry_keys_for_creating_shim_databases.yml | 2 +- ...2_silent_and_install_param_dll_loading.yml | 2 +- ...svr32_with_known_silent_switch_cmdline.yml | 2 +- ...ontrol_rundll_world_writable_directory.yml | 2 +- .../sc_exe_manipulating_windows_services.yml | 2 +- ...eduled_task_deleted_or_created_via_cmd.yml | 2 +- .../schtasks_used_for_forcing_a_reboot.yml | 2 +- ...ceprincipalnames_discovery_with_setspn.yml | 2 +- .../spoolsv_suspicious_process_access.yml | 2 +- ...uspicious_computer_account_name_change.yml | 2 +- .../endpoint/suspicious_reg_exe_process.yml | 2 +- ...ious_regsvr32_register_suspicious_path.yml | 2 +- .../suspicious_rundll32_dllregisterserver.yml | 2 +- .../endpoint/suspicious_wevtutil_usage.yml | 2 +- ..._of_kerberos_service_tickets_requested.yml | 2 +- .../windows_ad_adminsdholder_acl_modified.yml | 2 +- ...s_ad_cross_domain_sid_history_addition.yml | 2 +- ...ows_ad_domain_replication_acl_addition.yml | 2 +- ...ernate_datastream___executable_content.yml | 2 +- .../windows_apache_benchmark_binary.yml | 2 +- ...ndows_attempt_to_stop_security_service.yml | 2 +- .../endpoint/windows_autoit3_execution.yml | 2 +- ...roxy_execution_mavinject_dll_injection.yml | 2 +- ...ws_certutil_download_with_url_argument.yml | 2 +- ..._tool_execution_from_non_shell_process.yml | 2 +- ..._hijacking_inprocserver32_modification.yml | 2 +- ...te_local_administrator_account_via_net.yml | 2 +- ...ential_dumping_lsass_memory_createdump.yml | 2 +- ...ndows_curl_download_to_suspicious_path.yml | 2 +- ...dows_curl_upload_to_remote_destination.yml | 2 +- ...s_default_group_policy_object_modified.yml | 2 +- ...group_policy_object_modified_with_gpme.yml | 2 +- ...indows_detect_network_scanner_behavior.yml | 126 +++++++++--------- .../windows_disable_memory_crash_dump.yml | 2 +- ...ows_event_logging_disable_http_logging.yml | 2 +- .../endpoint/windows_dism_remove_defender.yml | 2 +- ...l_search_order_hijacking_with_iscsicpl.yml | 2 +- ...ows_dotnet_binary_in_non_standard_path.yml | 2 +- ...dows_esx_admins_group_creation_via_net.yml | 2 +- ...x_admins_group_creation_via_powershell.yml | 2 +- .../windows_excessive_usage_of_net_app.yml | 2 +- ...s_execute_arbitrary_commands_with_msdt.yml | 2 +- .../windows_findstr_gpp_discovery.yml | 2 +- ...ttp_network_communication_from_msiexec.yml | 2 +- .../windows_iis_components_add_new_module.yml | 2 +- ...nses_disable_av_autostart_via_registry.yml | 2 +- ...s_ingress_tool_transfer_using_explorer.yml | 2 +- ...ndows_installutil_in_non_standard_path.yml | 2 +- ..._installutil_remote_network_connection.yml | 2 +- .../windows_installutil_uninstall_option.yml | 2 +- ...tallutil_uninstall_option_with_network.yml | 2 +- ...indows_installutil_url_in_command_line.yml | 2 +- .../endpoint/windows_java_spawning_shells.yml | 2 +- ...ndows_ldifde_directory_object_behavior.yml | 2 +- .../windows_mimikatz_binary_execution.yml | 2 +- ...ws_modify_registry_valleyrat_c2_config.yml | 2 +- ...odify_registry_valleyrat_pwn_reg_entry.yml | 2 +- ..._mof_event_triggered_execution_via_wmi.yml | 2 +- .../windows_msiexec_dllregisterserver.yml | 2 +- .../windows_msiexec_remote_download.yml | 2 +- ...indows_msiexec_spawn_discovery_command.yml | 2 +- .../endpoint/windows_msiexec_spawn_windbg.yml | 2 +- ...s_msiexec_unregister_dllregisterserver.yml | 2 +- .../windows_ngrok_reverse_proxy_usage.yml | 2 +- .../endpoint/windows_nirsoft_advancedrun.yml | 2 +- .../endpoint/windows_odbcconf_load_dll.yml | 2 +- .../windows_odbcconf_load_response_file.yml | 2 +- ...windows_office_product_spawned_control.yml | 2 +- .../windows_office_product_spawned_msdt.yml | 2 +- .../windows_papercut_ng_spawn_shell.yml | 2 +- .../windows_powersploit_gpp_discovery.yml | 2 +- ...scalation_suspicious_process_elevation.yml | 2 +- .../windows_protocol_tunneling_with_plink.yml | 2 +- ...indows_raccine_scheduled_task_deletion.yml | 2 +- .../windows_rasautou_dll_execution.yml | 2 +- ...y_dotnet_etw_disabled_via_env_variable.yml | 2 +- ...ows_remote_assistance_spawning_process.yml | 2 +- .../windows_remote_create_service.yml | 2 +- .../windows_rundll32_webdav_request.yml | 2 +- ...undll32_webdav_with_network_connection.yml | 2 +- ...ive_registry_hive_dump_via_commandline.yml | 2 +- ...tware_component_gacutil_install_to_gac.yml | 2 +- .../windows_service_create_with_tscon.yml | 2 +- .../windows_service_execution_remcom.yml | 2 +- .../windows_sql_spawning_certutil.yml | 2 +- ...thentication_certificates___esc1_abuse.yml | 2 +- ...ion_certificates___esc1_authentication.yml | 2 +- ...ntication_certificates_certutil_backup.yml | 2 +- ...cation_certificates_export_certificate.yml | 2 +- ...ion_certificates_export_pfxcertificate.yml | 2 +- ...ct_process_with_authentication_traffic.yml | 2 +- ...execution_compiled_html_file_decompile.yml | 2 +- ...oxy_execution_syncappvpublishingserver.yml | 2 +- ...ws_uac_bypass_suspicious_child_process.yml | 2 +- ..._bypass_suspicious_escalation_behavior.yml | 2 +- .../windows_user_deletion_via_net.yml | 2 +- .../windows_user_disabled_via_net.yml | 2 +- .../windows_windbg_spawning_autoit3.yml | 2 +- .../endpoint/winhlp32_spawning_a_process.yml | 2 +- .../winrar_spawning_shell_application.yml | 2 +- .../endpoint/wmic_xsl_execution_via_url.yml | 2 +- .../xsl_script_execution_with_wmic.yml | 2 +- .../detect_large_outbound_icmp_packets.yml | 2 +- ...etect_remote_access_software_usage_url.yml | 2 +- ...caler_adware_activities_threat_blocked.yml | 2 +- ...caler_behavior_analysis_threat_blocked.yml | 2 +- .../web/zscaler_exploit_threat_blocked.yml | 2 +- ...scaler_malware_activity_threat_blocked.yml | 2 +- ...caler_potentially_abused_file_download.yml | 2 +- ...ivacy_risk_destinations_threat_blocked.yml | 2 +- ...caler_scam_destinations_threat_blocked.yml | 2 +- .../zscaler_virus_download_threat_blocked.yml | 2 +- 245 files changed, 307 insertions(+), 307 deletions(-) diff --git a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml index 021ec93c2e..17e059d927 100644 --- a/detections/application/pingid_mismatch_auth_source_and_verification_response.yml +++ b/detections/application/pingid_mismatch_auth_source_and_verification_response.yml @@ -1,6 +1,6 @@ name: PingID Mismatch Auth Source and Verification Response id: 15b0694e-caa2-4009-8d83-a1f98b86d086 -version: 4 +version: 5 date: '2025-01-21' author: Steven Dick status: production diff --git a/detections/application/windows_ad_suspicious_attribute_modification.yml b/detections/application/windows_ad_suspicious_attribute_modification.yml index df005bfae6..01c2dd31bc 100644 --- a/detections/application/windows_ad_suspicious_attribute_modification.yml +++ b/detections/application/windows_ad_suspicious_attribute_modification.yml @@ -1,6 +1,6 @@ name: Windows AD Suspicious Attribute Modification id: 5682052e-ce55-4f9f-8d28-59191420b7e0 -version: 3 +version: 4 date: '2025-01-21' author: Dean Luxton status: production diff --git a/detections/application/windows_ad_suspicious_gpo_modification.yml b/detections/application/windows_ad_suspicious_gpo_modification.yml index 976ed7ea7d..00ca4b7616 100644 --- a/detections/application/windows_ad_suspicious_gpo_modification.yml +++ b/detections/application/windows_ad_suspicious_gpo_modification.yml @@ -1,6 +1,6 @@ name: Windows AD Suspicious GPO Modification id: 0a2afc18-a3b5-4452-b60a-2e774214f9bf -version: 3 +version: 4 date: '2025-01-21' author: Dean Luxton status: experimental diff --git a/detections/cloud/azure_ad_application_administrator_role_assigned.yml b/detections/cloud/azure_ad_application_administrator_role_assigned.yml index 33eb6d2a8d..33305b12f6 100644 --- a/detections/cloud/azure_ad_application_administrator_role_assigned.yml +++ b/detections/cloud/azure_ad_application_administrator_role_assigned.yml @@ -1,6 +1,6 @@ name: Azure AD Application Administrator Role Assigned id: eac4de87-7a56-4538-a21b-277897af6d8d -version: 6 +version: 7 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/azure_ad_azurehound_useragent_detected.yml b/detections/cloud/azure_ad_azurehound_useragent_detected.yml index 12b044f4c3..b81c81b399 100644 --- a/detections/cloud/azure_ad_azurehound_useragent_detected.yml +++ b/detections/cloud/azure_ad_azurehound_useragent_detected.yml @@ -1,6 +1,6 @@ name: Azure AD AzureHound UserAgent Detected id: d62852db-a1f1-40db-a7fc-c3d56fa8bda3 -version: 1 +version: 2 date: '2025-01-06' author: Dean Luxton data_source: diff --git a/detections/cloud/azure_ad_external_guest_user_invited.yml b/detections/cloud/azure_ad_external_guest_user_invited.yml index 0a30335c00..b21df736a9 100644 --- a/detections/cloud/azure_ad_external_guest_user_invited.yml +++ b/detections/cloud/azure_ad_external_guest_user_invited.yml @@ -1,6 +1,6 @@ name: Azure AD External Guest User Invited id: c1fb4edb-cab1-4359-9b40-925ffd797fb5 -version: 5 +version: 6 date: '2024-11-14' author: Gowthamaraj Rajendran, Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml index 9ede5d603b..7e8ff92cd0 100644 --- a/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml +++ b/detections/cloud/azure_ad_multi_factor_authentication_disabled.yml @@ -1,6 +1,6 @@ name: Azure AD Multi-Factor Authentication Disabled id: 482dd42a-acfa-486b-a0bb-d6fcda27318e -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/azure_ad_privileged_role_assigned.yml b/detections/cloud/azure_ad_privileged_role_assigned.yml index e08cfb1eea..1bdea42857 100644 --- a/detections/cloud/azure_ad_privileged_role_assigned.yml +++ b/detections/cloud/azure_ad_privileged_role_assigned.yml @@ -1,6 +1,6 @@ name: Azure AD Privileged Role Assigned id: a28f0bc3-3400-4a6e-a2da-89b9e95f0d2a -version: 6 +version: 7 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/azure_ad_service_principal_enumeration.yml b/detections/cloud/azure_ad_service_principal_enumeration.yml index 67af2a74cc..67efb06d67 100644 --- a/detections/cloud/azure_ad_service_principal_enumeration.yml +++ b/detections/cloud/azure_ad_service_principal_enumeration.yml @@ -1,6 +1,6 @@ name: Azure AD Service Principal Enumeration id: 3f0647ce-add5-4436-8039-cbd1abe74563 -version: 1 +version: 2 date: '2025-01-06' author: Dean Luxton data_source: diff --git a/detections/cloud/azure_ad_service_principal_owner_added.yml b/detections/cloud/azure_ad_service_principal_owner_added.yml index 652d5977ff..70759d0bbc 100644 --- a/detections/cloud/azure_ad_service_principal_owner_added.yml +++ b/detections/cloud/azure_ad_service_principal_owner_added.yml @@ -1,6 +1,6 @@ name: Azure AD Service Principal Owner Added id: 7ddf2084-6cf3-4a44-be83-474f7b73c701 -version: 7 +version: 8 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml index 5cd6090c48..f3601f5b68 100644 --- a/detections/cloud/azure_ad_user_enabled_and_password_reset.yml +++ b/detections/cloud/azure_ad_user_enabled_and_password_reset.yml @@ -1,6 +1,6 @@ name: Azure AD User Enabled And Password Reset id: 1347b9e8-2daa-4a6f-be73-b421d3d9e268 -version: 6 +version: 7 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml index 597d44032d..bb46d01420 100644 --- a/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml +++ b/detections/cloud/azure_ad_user_immutableid_attribute_updated.yml @@ -1,6 +1,6 @@ name: Azure AD User ImmutableId Attribute Updated id: 0c0badad-4536-4a84-a561-5ff760f3c00e -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/cloud/gcp_multi_factor_authentication_disabled.yml b/detections/cloud/gcp_multi_factor_authentication_disabled.yml index dc6b0479ea..411d36c82b 100644 --- a/detections/cloud/gcp_multi_factor_authentication_disabled.yml +++ b/detections/cloud/gcp_multi_factor_authentication_disabled.yml @@ -1,6 +1,6 @@ name: GCP Multi-Factor Authentication Disabled id: b9bc5513-6fc1-4821-85a3-e1d81e451c83 -version: 5 +version: 6 date: '2024-11-14' author: Bhavin Patel, Mauricio Velazco, Splunk status: production diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 469c97577b..cda144c5d9 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -1,6 +1,6 @@ name: Gsuite Drive Share In External Email id: f6ee02d6-fea0-11eb-b2c2-acde48001122 -version: 4 +version: 5 date: '2024-11-14' author: Teoderick Contreras, Splunk status: experimental diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index 311f449b7f..1081e01e57 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -1,6 +1,6 @@ name: Gsuite Suspicious Shared File Name id: 07eed200-03f5-11ec-98fb-acde48001122 -version: 4 +version: 5 date: '2024-11-14' author: Teoderick Contreras, Splunk status: production diff --git a/detections/cloud/o365_service_principal_new_client_credentials.yml b/detections/cloud/o365_service_principal_new_client_credentials.yml index 702f8ee8f9..4748ee38f9 100644 --- a/detections/cloud/o365_service_principal_new_client_credentials.yml +++ b/detections/cloud/o365_service_principal_new_client_credentials.yml @@ -1,6 +1,6 @@ name: O365 Service Principal New Client Credentials id: a1b229e9-d962-4222-8c62-905a8a010453 -version: 5 +version: 6 date: '2024-11-14' author: Mauricio Velazco, Splunk status: production diff --git a/detections/deprecated/attempt_to_stop_security_service.yml b/detections/deprecated/attempt_to_stop_security_service.yml index 6527800094..d3307c59bf 100644 --- a/detections/deprecated/attempt_to_stop_security_service.yml +++ b/detections/deprecated/attempt_to_stop_security_service.yml @@ -1,6 +1,6 @@ name: Attempt To Stop Security Service id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 -version: 9 +version: 10 date: '2025-01-24' author: Rico Valdez, Splunk status: deprecated diff --git a/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml index 409c21747b..86d2c20c82 100644 --- a/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/deprecated/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -1,6 +1,6 @@ name: Attempted Credential Dump From Registry via Reg exe id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 -version: 12 +version: 13 date: '2025-01-15' author: Patrick Bareiss, Splunk status: deprecated diff --git a/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml index 1df440f488..2a47831d2c 100644 --- a/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/deprecated/cmdline_tool_not_executed_in_cmd_shell.yml @@ -1,6 +1,6 @@ name: Cmdline Tool Not Executed In CMD Shell id: 6c3f7dd8-153c-11ec-ac2d-acde48001122 -version: 7 +version: 8 date: '2025-01-24' author: Teoderick Contreras, Splunk status: deprecated diff --git a/detections/deprecated/create_local_admin_accounts_using_net_exe.yml b/detections/deprecated/create_local_admin_accounts_using_net_exe.yml index 08cc384790..28560103fa 100644 --- a/detections/deprecated/create_local_admin_accounts_using_net_exe.yml +++ b/detections/deprecated/create_local_admin_accounts_using_net_exe.yml @@ -1,6 +1,6 @@ name: Create local admin accounts using net exe id: b89919ed-fe5f-492c-b139-151bb162040e -version: 15 +version: 16 date: '2025-01-24' author: Bhavin Patel, Splunk status: deprecated diff --git a/detections/deprecated/deleting_of_net_users.yml b/detections/deprecated/deleting_of_net_users.yml index 53d81b2248..379264584f 100644 --- a/detections/deprecated/deleting_of_net_users.yml +++ b/detections/deprecated/deleting_of_net_users.yml @@ -1,6 +1,6 @@ name: Deleting Of Net Users id: 1c8c6f66-acce-11eb-aafb-acde48001122 -version: 7 +version: 8 date: '2025-01-24' author: Teoderick Contreras, Splunk status: deprecated diff --git a/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml index 077d4c8017..d0851935d2 100644 --- a/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/deprecated/detect_processes_used_for_system_network_configuration_discovery.yml @@ -1,6 +1,6 @@ name: Detect processes used for System Network Configuration Discovery id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 -version: 7 +version: 8 date: '2025-01-24' author: Bhavin Patel, Splunk status: deprecated diff --git a/detections/deprecated/disabling_net_user_account.yml b/detections/deprecated/disabling_net_user_account.yml index 2a10320558..409e89854a 100644 --- a/detections/deprecated/disabling_net_user_account.yml +++ b/detections/deprecated/disabling_net_user_account.yml @@ -1,6 +1,6 @@ name: Disabling Net User Account id: c0325326-acd6-11eb-98c2-acde48001122 -version: 7 +version: 8 date: '2025-01-24' author: Teoderick Contreras, Splunk status: deprecated diff --git a/detections/deprecated/excel_spawning_powershell.yml b/detections/deprecated/excel_spawning_powershell.yml index a4808cc05e..83c5d6bd07 100644 --- a/detections/deprecated/excel_spawning_powershell.yml +++ b/detections/deprecated/excel_spawning_powershell.yml @@ -1,6 +1,6 @@ name: Excel Spawning PowerShell id: 42d40a22-9be3-11eb-8f08-acde48001122 -version: 7 +version: 8 date: '2025-01-13' author: Michael Haag, Splunk status: deprecated diff --git a/detections/deprecated/excel_spawning_windows_script_host.yml b/detections/deprecated/excel_spawning_windows_script_host.yml index 70da2b9f10..db56778daf 100644 --- a/detections/deprecated/excel_spawning_windows_script_host.yml +++ b/detections/deprecated/excel_spawning_windows_script_host.yml @@ -1,6 +1,6 @@ name: Excel Spawning Windows Script Host id: 57fe880a-9be3-11eb-9bf3-acde48001122 -version: 8 +version: 9 date: '2025-01-13' author: Michael Haag, Splunk status: deprecated diff --git a/detections/deprecated/excessive_usage_of_net_app.yml b/detections/deprecated/excessive_usage_of_net_app.yml index e48ea823d4..1b3556f57b 100644 --- a/detections/deprecated/excessive_usage_of_net_app.yml +++ b/detections/deprecated/excessive_usage_of_net_app.yml @@ -1,6 +1,6 @@ name: Excessive Usage Of Net App id: 45e52536-ae42-11eb-b5c6-acde48001122 -version: 6 +version: 7 date: '2025-01-24' author: Teoderick Contreras, Splunk status: deprecated diff --git a/detections/deprecated/extraction_of_registry_hives.yml b/detections/deprecated/extraction_of_registry_hives.yml index 565dccabfa..f31196f4e5 100644 --- a/detections/deprecated/extraction_of_registry_hives.yml +++ b/detections/deprecated/extraction_of_registry_hives.yml @@ -1,6 +1,6 @@ name: Extraction of Registry Hives id: 8bbb7d58-b360-11eb-ba21-acde48001122 -version: 6 +version: 7 date: '2025-01-24' author: Michael Haag, Splunk status: deprecated diff --git a/detections/deprecated/office_product_spawn_cmd_process.yml b/detections/deprecated/office_product_spawn_cmd_process.yml index acbe347fb7..812d2a3bc1 100644 --- a/detections/deprecated/office_product_spawn_cmd_process.yml +++ b/detections/deprecated/office_product_spawn_cmd_process.yml @@ -1,6 +1,6 @@ name: Office Product Spawn CMD Process id: b8b19420-e892-11eb-9244-acde48001122 -version: 8 +version: 9 date: '2025-01-13' author: Teoderick Contreras, Splunk status: deprecated diff --git a/detections/deprecated/office_product_spawning_windows_script_host.yml b/detections/deprecated/office_product_spawning_windows_script_host.yml index 20ee47bc5c..8ff8d57259 100644 --- a/detections/deprecated/office_product_spawning_windows_script_host.yml +++ b/detections/deprecated/office_product_spawning_windows_script_host.yml @@ -1,6 +1,6 @@ name: Office Product Spawning Windows Script Host id: b3628a5b-8d02-42fa-a891-eebf2351cbe1 -version: 10 +version: 11 date: '2025-01-13' author: Michael Haag, Splunk status: deprecated diff --git a/detections/deprecated/office_spawning_control.yml b/detections/deprecated/office_spawning_control.yml index ac4c987bc2..8f472a4168 100644 --- a/detections/deprecated/office_spawning_control.yml +++ b/detections/deprecated/office_spawning_control.yml @@ -1,6 +1,6 @@ name: Office Spawning Control id: 053e027c-10c7-11ec-8437-acde48001122 -version: 10 +version: 11 date: '2025-01-24' author: Michael Haag, Splunk status: deprecated diff --git a/detections/deprecated/osquery_pack___coldroot_detection.yml b/detections/deprecated/osquery_pack___coldroot_detection.yml index 3ba9866bed..369173b8fd 100644 --- a/detections/deprecated/osquery_pack___coldroot_detection.yml +++ b/detections/deprecated/osquery_pack___coldroot_detection.yml @@ -1,6 +1,6 @@ name: Osquery pack - ColdRoot detection id: a6fffe5e-05c3-4c04-badc-887607fbb8dc -version: 4 +version: 5 date: '2024-11-14' author: Rico Valdez, Splunk status: deprecated diff --git a/detections/deprecated/windows_lateral_tool_transfer_remcom.yml b/detections/deprecated/windows_lateral_tool_transfer_remcom.yml index 0611c1c8f6..47789c6b30 100644 --- a/detections/deprecated/windows_lateral_tool_transfer_remcom.yml +++ b/detections/deprecated/windows_lateral_tool_transfer_remcom.yml @@ -1,6 +1,6 @@ name: Windows Lateral Tool Transfer RemCom id: e373a840-5bdc-47ef-b2fd-9cc7aaf387f0 -version: 5 +version: 6 date: '2024-12-10' author: Michael Haag, Splunk type: TTP diff --git a/detections/deprecated/windows_msiexec_with_network_connections.yml b/detections/deprecated/windows_msiexec_with_network_connections.yml index 26347f6535..5c17518468 100644 --- a/detections/deprecated/windows_msiexec_with_network_connections.yml +++ b/detections/deprecated/windows_msiexec_with_network_connections.yml @@ -1,6 +1,6 @@ name: Windows MSIExec With Network Connections id: 827409a1-5393-4d8d-8da4-bbb297c262a7 -version: 6 +version: 7 date: '2025-01-24' author: Michael Haag, Splunk status: deprecated diff --git a/detections/deprecated/windows_office_product_spawning_msdt.yml b/detections/deprecated/windows_office_product_spawning_msdt.yml index ad36ac3325..cfdabb0241 100644 --- a/detections/deprecated/windows_office_product_spawning_msdt.yml +++ b/detections/deprecated/windows_office_product_spawning_msdt.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawning MSDT id: 127eba64-c981-40bf-8589-1830638864a7 -version: 9 +version: 10 date: '2025-01-24' author: Michael Haag, Teoderick Contreras, Splunk status: deprecated diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 952bab98c5..c92c682b76 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -1,6 +1,6 @@ name: Anomalous usage of 7zip id: 9364ee8e-a39a-11eb-8f1d-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 74049ff9cb..65331578b1 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -1,6 +1,6 @@ name: Any Powershell DownloadFile id: 1a93b7ea-7af7-11eb-adb5-acde48001122 -version: 9 +version: 10 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 3a5fdced6f..c94d2f49c5 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -1,6 +1,6 @@ name: Any Powershell DownloadString id: 4d015ef2-7adf-11eb-95da-acde48001122 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index e23a285c6c..e9c57444bf 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -1,6 +1,6 @@ name: Attempt To Add Certificate To Untrusted Store id: 6bc5243e-ef36-45dc-9b12-f4a6be131159 -version: 11 +version: 12 date: '2024-11-13' author: Patrick Bareiss, Rico Valdez, Splunk status: production diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 29bdb7ba33..1425eee424 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -1,6 +1,6 @@ name: BCDEdit Failure Recovery Modification id: 809b31d2-5462-11eb-ae93-0242ac130002 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index b115098430..eee12eeb44 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -1,6 +1,6 @@ name: BITS Job Persistence id: e97a5ffe-90bf-11eb-928a-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index da8e3522bb..bdab9e207a 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -1,6 +1,6 @@ name: BITSAdmin Download File id: 80630ff4-8e4c-11eb-aab5-acde48001122 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Sittikorn S status: production diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 7e3407c516..b6d19b0b39 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -1,6 +1,6 @@ name: CertUtil Download With URLCache and Split Arguments id: 415b4306-8bfb-11eb-85c4-acde48001122 -version: 9 +version: 10 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index 7c6a453b69..97a0c24ba9 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -1,6 +1,6 @@ name: CertUtil Download With VerifyCtl and Split Arguments id: 801ad9e4-8bfb-11eb-8b31-acde48001122 -version: 9 +version: 10 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 34b29335c5..6dafec9ff9 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -1,6 +1,6 @@ name: Certutil exe certificate extraction id: 337a46be-600f-11eb-ae93-0242ac130002 -version: 7 +version: 8 date: '2024-12-10' author: Rod Soto, Splunk status: production diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 0fc4d9b902..f00b0f4387 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -1,6 +1,6 @@ name: CertUtil With Decode Argument id: bfe94226-8c10-11eb-a4b3-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index abb19e8ac8..b5f5648875 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -1,6 +1,6 @@ name: Check Elevated CMD using whoami id: a9079b18-1633-11ec-859c-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index ee6d5594e2..2e3eaddaf9 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -1,6 +1,6 @@ name: Clear Unallocated Sector Using Cipher App id: cd80a6ac-c9d9-11eb-8839-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index 0be756484b..3618dec57d 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -1,6 +1,6 @@ name: Clop Common Exec Parameter id: 5a8a2a72-8322-11eb-9ee9-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index 618a7f1670..107dc77582 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -1,6 +1,6 @@ name: CMD Echo Pipe - Escalation id: eb277ba0-b96b-11eb-b00e-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 281a998ed1..b7dbef7eb3 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -1,6 +1,6 @@ name: Common Ransomware Extensions id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec -version: 10 +version: 11 date: '2025-01-07' author: David Dorsey, Michael Haag, Splunk, Steven Dick status: production diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index fe3227dd29..68ddb073f8 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -1,6 +1,6 @@ name: Conti Common Exec parameter id: 624919bc-c382-11eb-adcc-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 0b02258a47..aaddd2c8b2 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -1,6 +1,6 @@ name: Control Loading from World Writable Directory id: 10423ac4-10c9-11ec-8dc4-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index c90a12c6e9..2b94e92f3d 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -1,6 +1,6 @@ name: Create or delete windows shares using net exe id: 743a322c-9a68-4a0f-9c17-85d9cce2a27c -version: 10 +version: 11 date: '2024-12-12' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 43b2d363b6..89b5ebed9b 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -1,6 +1,6 @@ name: Deleting Shadow Copies id: b89919ed-ee5f-492c-b139-95dbb162039e -version: 9 +version: 10 date: '2024-12-10' author: David Dorsey, Splunk status: production diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index a20929459c..406db0ca35 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect AzureHound Command-Line Arguments id: 26f02e96-c300-11eb-b611-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml index 38e25e1fcc..80357f3580 100644 --- a/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_certify_with_powershell_script_block_logging.yml @@ -1,6 +1,6 @@ name: Detect Certify With PowerShell Script Block Logging id: f533ca6c-9440-4686-80cb-7f294c07812a -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/detect_certipy_file_modifications.yml b/detections/endpoint/detect_certipy_file_modifications.yml index 932c36dce7..48a6a3129b 100644 --- a/detections/endpoint/detect_certipy_file_modifications.yml +++ b/detections/endpoint/detect_certipy_file_modifications.yml @@ -1,6 +1,6 @@ name: Detect Certipy File Modifications id: 7e3df743-b1d8-4631-8fa8-bd5819688876 -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 05aed6328e..7bbbcdff80 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -1,6 +1,6 @@ name: Detect HTML Help Spawn Child Process id: 723716de-ee55-4cd4-9759-c44e7e55ba4b -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index d72c7f64a1..b91592327f 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -1,6 +1,6 @@ name: Detect HTML Help URL in Command Line id: 8c5835b9-39d9-438b-817c-95f14c69a31e -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 0960910cc8..d3616fae42 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -1,6 +1,6 @@ name: Detect Mimikatz With PowerShell Script Block Logging id: 8148c29c-c952-11eb-9255-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index 09c4f17867..7c5118b8b9 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -1,6 +1,6 @@ name: Detect mshta inline hta execution id: a0873b32-5b68-11eb-ae93-0242ac130002 -version: 12 +version: 13 date: '2024-12-10' author: Bhavin Patel, Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 7a9bc24261..ca6dcb56be 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -1,6 +1,6 @@ name: Detect MSHTA Url in Command Line id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index f6f07579ae..0151aeb432 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -1,6 +1,6 @@ name: Detect Path Interception By Creation Of program exe id: cbef820c-e1ff-407f-887f-0a9240a2d477 -version: 9 +version: 10 date: '2024-11-13' author: Patrick Bareiss, Splunk status: production diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 6004101254..24de8df12b 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -1,6 +1,6 @@ name: Detect PsExec With accepteula Flag id: 27c3a83d-cada-47c6-9042-67baf19d2574 -version: 8 +version: 9 date: '2024-11-13' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 31e5bc6329..a36e49cace 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -1,6 +1,6 @@ name: Detect RClone Command-Line Usage id: 32e0baea-b3f1-11eb-a2ce-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index edd0e0652f..008e3a9fdf 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -1,6 +1,6 @@ name: Detect Regasm Spawning a Process id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 3431b74b40..39e4bbbd17 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect Regasm with no Command Line Arguments id: c3bc1430-04e7-4178-835f-047d8e6e97df -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index 369fa49db9..621501a8a9 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -1,6 +1,6 @@ name: Detect Regsvcs Spawning a Process id: bc477b57-5c21-4ab6-9c33-668772e7f114 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index c8dfa3767d..05dfb21ac7 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Detect Regsvcs with No Command Line Arguments id: 6b74d578-a02e-4e94-a0d1-39440d0bf254 -version: 7 +version: 8 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index e2130893c1..ba41b5d992 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -1,6 +1,6 @@ name: Detect Regsvr32 Application Control Bypass id: 070e9b80-6252-11eb-ae93-0242ac130002 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index 8774c0b8e9..8e285e9c2f 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -1,6 +1,6 @@ name: Detect Rundll32 Application Control Bypass - advpack id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index 5870f0e87b..c61eded5b1 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -1,6 +1,6 @@ name: Detect Rundll32 Application Control Bypass - setupapi id: 61e7b44a-6088-4f26-b788-9a96ba13b37a -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index cab866b351..58bfea6011 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -1,6 +1,6 @@ name: Detect Rundll32 Application Control Bypass - syssetup id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml index 6fa1b4cdd0..93af7b9881 100644 --- a/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml +++ b/detections/endpoint/detect_suspicious_processnames_using_pretrained_model_in_dsdl.yml @@ -1,6 +1,6 @@ name: Detect suspicious processnames using pretrained model in DSDL id: a15f8977-ad7d-4669-92ef-b59b97219bf5 -version: 4 +version: 5 date: '2024-11-13' author: Abhinav Mishra, Kumar Sharad and Namratha Sreekanta, Splunk type: Anomaly diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index a244b2a733..9e42a31685 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -1,6 +1,6 @@ name: DNS Exfiltration Using Nslookup App id: 2452e632-9e0d-11eb-bacd-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Teoderick Contreras, Splunk, Wouter Jansen status: production diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 3ee0399230..72e21dfb8e 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -1,6 +1,6 @@ name: DSQuery Domain Discovery id: cc316032-924a-11eb-91a2-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index ea6d606030..f2ca5506a9 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -1,6 +1,6 @@ name: Dump LSASS via comsvcs DLL id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 -version: 7 +version: 8 date: '2024-12-10' author: Patrick Bareiss, Splunk status: production diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 56b38267ec..e1881104a9 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -1,6 +1,6 @@ name: Dump LSASS via procdump id: 3742ebfe-64c2-11eb-ae93-0242ac130002 -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index e001bbdc5b..6a16286298 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -1,6 +1,6 @@ name: ETW Registry Disabled id: 8ed523ac-276b-11ec-ac39-acde48001122 -version: 9 +version: 10 date: '2024-12-16' author: Teoderick Contreras, Splunk, Steven Dick status: production diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index d389a1626f..3c5861b898 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -1,6 +1,6 @@ name: Execute Javascript With Jscript COM CLSID id: dc64d064-d346-11eb-8588-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 306a367e2b..906eec9db6 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -1,6 +1,6 @@ name: Execution of File with Multiple Extensions id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 -version: 7 +version: 8 date: '2024-11-13' author: Rico Valdez, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 0d86b46dcd..f09d658da1 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -1,6 +1,6 @@ name: File with Samsam Extension id: 02c6cfc2-ae66-4735-bfc7-6291da834cbf -version: 5 +version: 6 date: '2024-11-13' author: Rico Valdez, Splunk status: production diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index c60512b788..46ab4b2a2e 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -1,6 +1,6 @@ name: GPUpdate with no Command Line Arguments with Network id: 2c853856-a140-11eb-a5b5-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml b/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml index a5a0e59b2d..6d6557e0ab 100644 --- a/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml +++ b/detections/endpoint/headless_browser_mockbin_or_mocky_request.yml @@ -1,6 +1,6 @@ name: Headless Browser Mockbin or Mocky Request id: 94fc85a1-e55b-4265-95e1-4b66730e05c0 -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_apt_get_privilege_escalation.yml b/detections/endpoint/linux_apt_get_privilege_escalation.yml index 7924c146e3..086b376e70 100644 --- a/detections/endpoint/linux_apt_get_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_get_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux apt-get Privilege Escalation id: d870ce3b-e796-402f-b2af-cab4da1223f2 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_apt_privilege_escalation.yml b/detections/endpoint/linux_apt_privilege_escalation.yml index 7f6804cbfb..4466f0e3e7 100644 --- a/detections/endpoint/linux_apt_privilege_escalation.yml +++ b/detections/endpoint/linux_apt_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux APT Privilege Escalation id: 4d5a05fa-77d9-4fd0-af9c-05704f9f9a88 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_awk_privilege_escalation.yml b/detections/endpoint/linux_awk_privilege_escalation.yml index 1036c94106..f7a4f975d6 100644 --- a/detections/endpoint/linux_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_awk_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux AWK Privilege Escalation id: 4510cae0-96a2-4840-9919-91d262db210a -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_busybox_privilege_escalation.yml b/detections/endpoint/linux_busybox_privilege_escalation.yml index f6bbd0bde7..4f7d70ec4a 100644 --- a/detections/endpoint/linux_busybox_privilege_escalation.yml +++ b/detections/endpoint/linux_busybox_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Busybox Privilege Escalation id: 387c4e78-f4a4-413d-ad44-e9f7bc4642c9 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_c89_privilege_escalation.yml b/detections/endpoint/linux_c89_privilege_escalation.yml index 3919b610e8..9e9c19688c 100644 --- a/detections/endpoint/linux_c89_privilege_escalation.yml +++ b/detections/endpoint/linux_c89_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux c89 Privilege Escalation id: 54c95f4d-3e5d-44be-9521-ea19ba62f7a8 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_c99_privilege_escalation.yml b/detections/endpoint/linux_c99_privilege_escalation.yml index 9e76c91bfe..2b4cc5888a 100644 --- a/detections/endpoint/linux_c99_privilege_escalation.yml +++ b/detections/endpoint/linux_c99_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux c99 Privilege Escalation id: e1c6dec5-2249-442d-a1f9-99a4bd228183 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_composer_privilege_escalation.yml b/detections/endpoint/linux_composer_privilege_escalation.yml index 4128c46843..5753643b61 100644 --- a/detections/endpoint/linux_composer_privilege_escalation.yml +++ b/detections/endpoint/linux_composer_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Composer Privilege Escalation id: a3bddf71-6ba3-42ab-a6b2-396929b16d92 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_cpulimit_privilege_escalation.yml b/detections/endpoint/linux_cpulimit_privilege_escalation.yml index 2d565e6a8b..655e36cbef 100644 --- a/detections/endpoint/linux_cpulimit_privilege_escalation.yml +++ b/detections/endpoint/linux_cpulimit_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Cpulimit Privilege Escalation id: d4e40b7e-aad3-4a7d-aac8-550ea5222be5 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_csvtool_privilege_escalation.yml b/detections/endpoint/linux_csvtool_privilege_escalation.yml index 0b4a4ed4b6..ed76fcb05a 100644 --- a/detections/endpoint/linux_csvtool_privilege_escalation.yml +++ b/detections/endpoint/linux_csvtool_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Csvtool Privilege Escalation id: f8384f9e-1a5c-4c3a-96d6-8a7e5a38a8b8 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_data_destruction_command.yml b/detections/endpoint/linux_data_destruction_command.yml index 0ed0562b5d..d995933ae4 100644 --- a/detections/endpoint/linux_data_destruction_command.yml +++ b/detections/endpoint/linux_data_destruction_command.yml @@ -1,6 +1,6 @@ name: Linux Data Destruction Command id: b11d3979-b2f7-411b-bb1a-bd00e642173b -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/linux_decode_base64_to_shell.yml b/detections/endpoint/linux_decode_base64_to_shell.yml index a60cd9db88..a332d7535a 100644 --- a/detections/endpoint/linux_decode_base64_to_shell.yml +++ b/detections/endpoint/linux_decode_base64_to_shell.yml @@ -1,6 +1,6 @@ name: Linux Decode Base64 to Shell id: 637b603e-1799-40fd-bf87-47ecbd551b66 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_docker_privilege_escalation.yml b/detections/endpoint/linux_docker_privilege_escalation.yml index a6c8d07606..5b3c7f3d26 100644 --- a/detections/endpoint/linux_docker_privilege_escalation.yml +++ b/detections/endpoint/linux_docker_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Docker Privilege Escalation id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_emacs_privilege_escalation.yml b/detections/endpoint/linux_emacs_privilege_escalation.yml index 2e3b916845..1bdef39406 100644 --- a/detections/endpoint/linux_emacs_privilege_escalation.yml +++ b/detections/endpoint/linux_emacs_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Emacs Privilege Escalation id: 92033cab-1871-483d-a03b-a7ce98665cfc -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_find_privilege_escalation.yml b/detections/endpoint/linux_find_privilege_escalation.yml index faeeb076e0..ea4a8f3b0d 100644 --- a/detections/endpoint/linux_find_privilege_escalation.yml +++ b/detections/endpoint/linux_find_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Find Privilege Escalation id: 2ff4e0c2-8256-4143-9c07-1e39c7231111 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_gdb_privilege_escalation.yml b/detections/endpoint/linux_gdb_privilege_escalation.yml index fd91250e3a..3e0b7e05d0 100644 --- a/detections/endpoint/linux_gdb_privilege_escalation.yml +++ b/detections/endpoint/linux_gdb_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux GDB Privilege Escalation id: 310b7da2-ab52-437f-b1bf-0bd458674308 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_gem_privilege_escalation.yml b/detections/endpoint/linux_gem_privilege_escalation.yml index 7976f81781..848b8f393f 100644 --- a/detections/endpoint/linux_gem_privilege_escalation.yml +++ b/detections/endpoint/linux_gem_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Gem Privilege Escalation id: 0115482a-5dcb-4bb0-bcca-5d095d224236 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml index 818ca801e4..f7fc077d77 100644 --- a/detections/endpoint/linux_gnu_awk_privilege_escalation.yml +++ b/detections/endpoint/linux_gnu_awk_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux GNU Awk Privilege Escalation id: 0dcf43b9-50d8-42a6-acd9-d1c9201fe6ae -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml index 4625c20fb7..a13f0d306e 100644 --- a/detections/endpoint/linux_java_spawning_shell.yml +++ b/detections/endpoint/linux_java_spawning_shell.yml @@ -1,6 +1,6 @@ name: Linux Java Spawning Shell id: 7b09db8a-5c20-11ec-9945-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_kernel_module_enumeration.yml b/detections/endpoint/linux_kernel_module_enumeration.yml index 9939c3de7c..157f255449 100644 --- a/detections/endpoint/linux_kernel_module_enumeration.yml +++ b/detections/endpoint/linux_kernel_module_enumeration.yml @@ -1,6 +1,6 @@ name: Linux Kernel Module Enumeration id: 6df99886-0e04-4c11-8b88-325747419278 -version: 6 +version: 7 date: '2024-11-17' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_make_privilege_escalation.yml b/detections/endpoint/linux_make_privilege_escalation.yml index a8e87a9bf6..9d81cbaa3d 100644 --- a/detections/endpoint/linux_make_privilege_escalation.yml +++ b/detections/endpoint/linux_make_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Make Privilege Escalation id: 80b22836-5091-4944-80ee-f733ac443f4f -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_mysql_privilege_escalation.yml b/detections/endpoint/linux_mysql_privilege_escalation.yml index 370c6cc5e1..77ade04a7d 100644 --- a/detections/endpoint/linux_mysql_privilege_escalation.yml +++ b/detections/endpoint/linux_mysql_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux MySQL Privilege Escalation id: c0d810f4-230c-44ea-b703-989da02ff145 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml index eeaf7de9e4..ace58aa7ad 100644 --- a/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/linux_ngrok_reverse_proxy_usage.yml @@ -1,6 +1,6 @@ name: Linux Ngrok Reverse Proxy Usage id: bc84d574-708c-467d-b78a-4c1e20171f97 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_node_privilege_escalation.yml b/detections/endpoint/linux_node_privilege_escalation.yml index 5e26a21d55..09569d3dd1 100644 --- a/detections/endpoint/linux_node_privilege_escalation.yml +++ b/detections/endpoint/linux_node_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Node Privilege Escalation id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml index 033284562b..eeb2fe21ba 100644 --- a/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml +++ b/detections/endpoint/linux_obfuscated_files_or_information_base64_decode.yml @@ -1,6 +1,6 @@ name: Linux Obfuscated Files or Information Base64 Decode id: 303b38b2-c03f-44e2-8f41-4594606fcfc7 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_octave_privilege_escalation.yml b/detections/endpoint/linux_octave_privilege_escalation.yml index 37839dd3cb..748265ca07 100644 --- a/detections/endpoint/linux_octave_privilege_escalation.yml +++ b/detections/endpoint/linux_octave_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Octave Privilege Escalation id: 78f7487d-42ce-4f7f-8685-2159b25fb477 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_openvpn_privilege_escalation.yml b/detections/endpoint/linux_openvpn_privilege_escalation.yml index 452799d717..dac490faf9 100644 --- a/detections/endpoint/linux_openvpn_privilege_escalation.yml +++ b/detections/endpoint/linux_openvpn_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux OpenVPN Privilege Escalation id: d25feebe-fa1c-4754-8a1e-afb03bedc0f2 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_php_privilege_escalation.yml b/detections/endpoint/linux_php_privilege_escalation.yml index 521ece7f21..4ca46b1699 100644 --- a/detections/endpoint/linux_php_privilege_escalation.yml +++ b/detections/endpoint/linux_php_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux PHP Privilege Escalation id: 4fc4c031-e5be-4cc0-8cf9-49f9f507bcb5 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml index e4fa7129d7..81844e155e 100644 --- a/detections/endpoint/linux_pkexec_privilege_escalation.yml +++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux pkexec Privilege Escalation id: 03e22c1c-8086-11ec-ac2e-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_proxy_socks_curl.yml b/detections/endpoint/linux_proxy_socks_curl.yml index 1093bc6413..2501295d79 100644 --- a/detections/endpoint/linux_proxy_socks_curl.yml +++ b/detections/endpoint/linux_proxy_socks_curl.yml @@ -1,6 +1,6 @@ name: Linux Proxy Socks Curl id: bd596c22-ad1e-44fc-b242-817253ce8b08 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_puppet_privilege_escalation.yml b/detections/endpoint/linux_puppet_privilege_escalation.yml index 05c7c3d735..ee0c832bfc 100644 --- a/detections/endpoint/linux_puppet_privilege_escalation.yml +++ b/detections/endpoint/linux_puppet_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Puppet Privilege Escalation id: 1d19037f-466e-4d56-8d87-36fafd9aa3ce -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_rpm_privilege_escalation.yml b/detections/endpoint/linux_rpm_privilege_escalation.yml index 612f08ab5f..1535df3087 100644 --- a/detections/endpoint/linux_rpm_privilege_escalation.yml +++ b/detections/endpoint/linux_rpm_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux RPM Privilege Escalation id: f8e58a23-cecd-495f-9c65-6c76b4cb9774 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_ruby_privilege_escalation.yml b/detections/endpoint/linux_ruby_privilege_escalation.yml index b004b42783..340e46c341 100644 --- a/detections/endpoint/linux_ruby_privilege_escalation.yml +++ b/detections/endpoint/linux_ruby_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Ruby Privilege Escalation id: 097b28b5-7004-4d40-a715-7e390501788b -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_sqlite3_privilege_escalation.yml b/detections/endpoint/linux_sqlite3_privilege_escalation.yml index 60c9288b4e..dd00c643bd 100644 --- a/detections/endpoint/linux_sqlite3_privilege_escalation.yml +++ b/detections/endpoint/linux_sqlite3_privilege_escalation.yml @@ -1,6 +1,6 @@ name: Linux Sqlite3 Privilege Escalation id: ab75dbb7-c3ba-4689-9c1b-8d2717bdcba1 -version: 5 +version: 6 date: '2024-11-13' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/endpoint/linux_ssh_authorized_keys_modification.yml b/detections/endpoint/linux_ssh_authorized_keys_modification.yml index a2a4c09110..d513ccb7c5 100644 --- a/detections/endpoint/linux_ssh_authorized_keys_modification.yml +++ b/detections/endpoint/linux_ssh_authorized_keys_modification.yml @@ -1,6 +1,6 @@ name: Linux SSH Authorized Keys Modification id: f5ab595e-28e5-4327-8077-5008ba97c850 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/linux_ssh_remote_services_script_execute.yml b/detections/endpoint/linux_ssh_remote_services_script_execute.yml index 6fcbed4dcd..cddd81fa59 100644 --- a/detections/endpoint/linux_ssh_remote_services_script_execute.yml +++ b/detections/endpoint/linux_ssh_remote_services_script_execute.yml @@ -1,6 +1,6 @@ name: Linux SSH Remote Services Script Execute id: aa1748dd-4a5c-457a-9cf6-ca7b4eb711b3 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/microsoft_defender_atp_alerts.yml b/detections/endpoint/microsoft_defender_atp_alerts.yml index e18398545b..eba3aaecd3 100644 --- a/detections/endpoint/microsoft_defender_atp_alerts.yml +++ b/detections/endpoint/microsoft_defender_atp_alerts.yml @@ -1,6 +1,6 @@ name: Microsoft Defender ATP Alerts id: 38f034ed-1598-46c8-95e8-14edf05fdf5d -version: 2 +version: 3 date: '2025-01-20' author: Bryan Pluta, Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/microsoft_defender_incident_alerts.yml b/detections/endpoint/microsoft_defender_incident_alerts.yml index 2133ecae98..4cae1ede0f 100644 --- a/detections/endpoint/microsoft_defender_incident_alerts.yml +++ b/detections/endpoint/microsoft_defender_incident_alerts.yml @@ -1,6 +1,6 @@ name: Microsoft Defender Incident Alerts id: 13435b55-afd8-46d4-9045-7d5457f430a5 -version: 2 +version: 3 date: '2025-01-20' author: Bryan Pluta, Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 904d7c0ff7..1d9de05366 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -1,6 +1,6 @@ name: Mshta spawning Rundll32 OR Regsvr32 Process id: 4aa5d062-e893-11eb-9eb2-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/notepad_with_no_command_line_arguments.yml b/detections/endpoint/notepad_with_no_command_line_arguments.yml index 1b8e50b748..9598488359 100644 --- a/detections/endpoint/notepad_with_no_command_line_arguments.yml +++ b/detections/endpoint/notepad_with_no_command_line_arguments.yml @@ -1,6 +1,6 @@ name: Notepad with no Command Line Arguments id: 5adbc5f1-9a2f-41c1-a810-f37e015f8179 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml index 593947e09e..7939bcde78 100644 --- a/detections/endpoint/potential_system_network_configuration_discovery_activity.yml +++ b/detections/endpoint/potential_system_network_configuration_discovery_activity.yml @@ -1,6 +1,6 @@ name: Potential System Network Configuration Discovery Activity id: 3f0b95e3-3195-46ac-bea3-84fb59e7fac5 -version: 1 +version: 2 date: '2025-01-20' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/powershell_load_module_in_meterpreter.yml b/detections/endpoint/powershell_load_module_in_meterpreter.yml index de6090bb3f..7f8f0917d4 100644 --- a/detections/endpoint/powershell_load_module_in_meterpreter.yml +++ b/detections/endpoint/powershell_load_module_in_meterpreter.yml @@ -1,6 +1,6 @@ name: Powershell Load Module in Meterpreter id: d5905da5-d050-48db-9259-018d8f034fcf -version: 4 +version: 5 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index d848c784db..8c3ae5d352 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -1,6 +1,6 @@ name: PowerShell Loading DotNET into Memory via Reflection id: 85bc3f30-ca28-11eb-bd21-acde48001122 -version: 6 +version: 7 date: '2025-01-16' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index 24967a1f8b..3f4244f0ca 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -1,6 +1,6 @@ name: Powershell Processing Stream Of Data id: 0d718b52-c9f1-11eb-bc61-acde48001122 -version: 6 +version: 7 date: '2024-11-22' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index 6f0ea6b1e1..118090ab0d 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -1,6 +1,6 @@ name: Powershell Remove Windows Defender Directory id: adf47620-79fa-11ec-b248-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 104e8afe41..6b50ec5b4f 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -1,6 +1,6 @@ name: PowerShell Start-BitsTransfer id: 39e2605a-90d8-11eb-899e-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index 0bac5ac032..06ea69848f 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -1,6 +1,6 @@ name: Prevent Automatic Repair Mode using Bcdedit id: 7742aa92-c9d9-11eb-bbfc-acde48001122 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 22d03dda5e..bb4f8eb862 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -1,6 +1,6 @@ name: Process Kill Base On File Path id: 5ffaa42c-acdb-11eb-9ad3-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index 15539d184d..b217c5d2a0 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -1,6 +1,6 @@ name: Recon AVProduct Through Pwh or WMI id: 28077620-c9f6-11eb-8785-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index f11cc03166..033abc60c4 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -1,6 +1,6 @@ name: Reg exe Manipulating Windows Services Registry Keys id: 8470d755-0c13-45b3-bd63-387a373c10cf -version: 8 +version: 9 date: '2024-11-13' author: Rico Valdez, Splunk status: production diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 7d20f02115..ab697057ee 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -1,6 +1,6 @@ name: Registry Keys for Creating SHIM Databases id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb -version: 10 +version: 11 date: '2024-12-08' author: Patrick Bareiss, Teoderick Contreras, Splunk, Steven Dick, Bhavin Patel status: production diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index fa6a03e4f6..ccdeb39f99 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -1,6 +1,6 @@ name: Regsvr32 Silent and Install Param Dll Loading id: f421c250-24e7-11ec-bc43-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 624108b462..1726b73a91 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -1,6 +1,6 @@ name: Regsvr32 with Known Silent Switch Cmdline id: c9ef7dc4-eeaf-11eb-b2b6-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index aa845361b4..151768e0f0 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -1,6 +1,6 @@ name: Rundll32 Control RunDLL World Writable Directory id: 1adffe86-10c3-11ec-8ce6-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index ab462622b5..2ca5eeaf14 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -1,6 +1,6 @@ name: Sc exe Manipulating Windows Services id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d -version: 7 +version: 8 date: '2024-11-13' author: Rico Valdez, Splunk status: production diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 3b47886f19..6d89907f5b 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -1,6 +1,6 @@ name: Scheduled Task Deleted Or Created via CMD id: d5af132c-7c17-439c-9d31-13d55340f36c -version: 10 +version: 11 date: '2025-01-27' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index 72e8073ffc..b49abbe0fc 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -1,6 +1,6 @@ name: Schtasks used for forcing a reboot id: 1297fb80-f42a-4b4a-9c8a-88c066437cf6 -version: 7 +version: 8 date: '2024-11-13' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index 735ed9149a..1abd21eb3c 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -1,6 +1,6 @@ name: ServicePrincipalNames Discovery with SetSPN id: ae8b3efc-2d2e-11ec-8b57-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index ee46ef235d..a41111a7b1 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -1,6 +1,6 @@ name: Spoolsv Suspicious Process Access id: 799b606e-da81-11eb-93f8-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml index 25a57db4be..04edcd2a70 100644 --- a/detections/endpoint/suspicious_computer_account_name_change.yml +++ b/detections/endpoint/suspicious_computer_account_name_change.yml @@ -1,6 +1,6 @@ name: Suspicious Computer Account Name Change id: 35a61ed8-61c4-11ec-bc1e-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index 1d7dfc280a..0add6178bb 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -1,6 +1,6 @@ name: Suspicious Reg exe Process id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 -version: 8 +version: 9 date: '2024-11-13' author: David Dorsey, Splunk status: production diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 65c6989495..1167ae4fa3 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -1,6 +1,6 @@ name: Suspicious Regsvr32 Register Suspicious Path id: 62732736-6250-11eb-ae93-0242ac130002 -version: 10 +version: 11 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 31ca3d198e..6443c7a1f4 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -1,6 +1,6 @@ name: Suspicious Rundll32 dllregisterserver id: 8c00a385-9b86-4ac0-8932-c9ec3713b159 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 321027b633..db66f571be 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -1,6 +1,6 @@ name: Suspicious wevtutil Usage id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f -version: 8 +version: 9 date: '2024-11-13' author: David Dorsey, Michael Haag, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml index 7735319ec4..104fb978fa 100644 --- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml +++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml @@ -1,6 +1,6 @@ name: Unusual Number of Kerberos Service Tickets Requested id: eb3e6702-8936-11ec-98fe-acde48001122 -version: 6 +version: 7 date: '2024-11-13' author: Mauricio Velazco, Dean Luxton, Splunk status: production diff --git a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml index 9b011c912c..87740e631d 100644 --- a/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml +++ b/detections/endpoint/windows_ad_adminsdholder_acl_modified.yml @@ -1,6 +1,6 @@ name: Windows AD AdminSDHolder ACL Modified id: 00d877c3-7b7b-443d-9562-6b231e2abab9 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Dean Luxton, Splunk type: TTP diff --git a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml index 1a951ffa45..d84075b5e2 100644 --- a/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml +++ b/detections/endpoint/windows_ad_cross_domain_sid_history_addition.yml @@ -1,6 +1,6 @@ name: Windows AD Cross Domain SID History Addition id: 41bbb371-28ba-439c-bb5c-d9930c28365d -version: 5 +version: 6 date: '2024-12-10' author: Dean Luxton type: TTP diff --git a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml index 5afac44a1b..a303064df9 100644 --- a/detections/endpoint/windows_ad_domain_replication_acl_addition.yml +++ b/detections/endpoint/windows_ad_domain_replication_acl_addition.yml @@ -1,6 +1,6 @@ name: Windows AD Domain Replication ACL Addition id: 8c372853-f459-4995-afdc-280c114d33ab -version: 7 +version: 8 date: '2024-12-10' author: Dean Luxton type: TTP diff --git a/detections/endpoint/windows_alternate_datastream___executable_content.yml b/detections/endpoint/windows_alternate_datastream___executable_content.yml index 9ff5c8ee67..363e9075c2 100644 --- a/detections/endpoint/windows_alternate_datastream___executable_content.yml +++ b/detections/endpoint/windows_alternate_datastream___executable_content.yml @@ -1,6 +1,6 @@ name: Windows Alternate DataStream - Executable Content id: a258bf2a-34fd-4986-8086-78f506e00206 -version: 5 +version: 6 date: '2024-11-13' author: Steven Dick, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_apache_benchmark_binary.yml b/detections/endpoint/windows_apache_benchmark_binary.yml index 17a494d0c6..ecbb29f74e 100644 --- a/detections/endpoint/windows_apache_benchmark_binary.yml +++ b/detections/endpoint/windows_apache_benchmark_binary.yml @@ -1,6 +1,6 @@ name: Windows Apache Benchmark Binary id: 894f48ea-8d85-4dcd-9132-c66cdb407c9b -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_attempt_to_stop_security_service.yml b/detections/endpoint/windows_attempt_to_stop_security_service.yml index 44e85bbc42..0719d4656f 100644 --- a/detections/endpoint/windows_attempt_to_stop_security_service.yml +++ b/detections/endpoint/windows_attempt_to_stop_security_service.yml @@ -1,6 +1,6 @@ name: Windows Attempt To Stop Security Service id: 9ed27cea-4e27-4eff-b2c6-aac9e78a7517 -version: 1 +version: 2 date: '2025-01-13' author: Rico Valdez, Nasreddine Bencherchali, Splunk status: production diff --git a/detections/endpoint/windows_autoit3_execution.yml b/detections/endpoint/windows_autoit3_execution.yml index 27d70e95ba..e6ddf3ce77 100644 --- a/detections/endpoint/windows_autoit3_execution.yml +++ b/detections/endpoint/windows_autoit3_execution.yml @@ -1,6 +1,6 @@ name: Windows AutoIt3 Execution id: 0ecb40d9-492b-4a57-9f87-515dd742794c -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml index a14fab9b60..30f986c479 100644 --- a/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml +++ b/detections/endpoint/windows_binary_proxy_execution_mavinject_dll_injection.yml @@ -1,6 +1,6 @@ name: Windows Binary Proxy Execution Mavinject DLL Injection id: ccf4b61b-1b26-4f2e-a089-f2009c569c57 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_certutil_download_with_url_argument.yml b/detections/endpoint/windows_certutil_download_with_url_argument.yml index e7ac8ebf6c..87ff45c03c 100644 --- a/detections/endpoint/windows_certutil_download_with_url_argument.yml +++ b/detections/endpoint/windows_certutil_download_with_url_argument.yml @@ -1,6 +1,6 @@ name: Windows CertUtil Download With URL Argument id: 4fc5ca00-4c7c-46b3-8772-c98a4b8bd944 -version: 2 +version: 3 date: '2025-01-07' author: Nasreddine Bencherchali, Splunk status: production diff --git a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml index 76789b01ac..441ba5036d 100644 --- a/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml +++ b/detections/endpoint/windows_cmdline_tool_execution_from_non_shell_process.yml @@ -1,6 +1,6 @@ name: Windows Cmdline Tool Execution From Non-Shell Process id: 2afa393f-b88d-41b7-9793-623c93a2dfde -version: 1 +version: 2 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml index 80717d56c4..4c8b9324c6 100644 --- a/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml +++ b/detections/endpoint/windows_com_hijacking_inprocserver32_modification.yml @@ -1,6 +1,6 @@ name: Windows COM Hijacking InprocServer32 Modification id: b7bd83c0-92b5-4fc7-b286-23eccfa2c561 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_create_local_administrator_account_via_net.yml b/detections/endpoint/windows_create_local_administrator_account_via_net.yml index 518245a6d4..9a9f76fffd 100644 --- a/detections/endpoint/windows_create_local_administrator_account_via_net.yml +++ b/detections/endpoint/windows_create_local_administrator_account_via_net.yml @@ -1,6 +1,6 @@ name: Windows Create Local Administrator Account Via Net id: 2c568c34-bb57-4b43-9d75-19c605b98e70 -version: 1 +version: 2 date: '2025-01-13' author: Bhavin Patel, Splunk status: production diff --git a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml index 1308709d7f..b33e006ced 100644 --- a/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml +++ b/detections/endpoint/windows_credential_dumping_lsass_memory_createdump.yml @@ -1,6 +1,6 @@ name: Windows Credential Dumping LSASS Memory Createdump id: b3b7ce35-fce5-4c73-85f4-700aeada81a9 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index a267aa3e2f..fc5ad0009f 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -1,6 +1,6 @@ name: Windows Curl Download to Suspicious Path id: c32f091e-30db-11ec-8738-acde48001122 -version: 7 +version: 8 date: '2025-01-27' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 0ebd3235eb..8b99b345c5 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -1,6 +1,6 @@ name: Windows Curl Upload to Remote Destination id: 42f8f1a2-4228-11ec-aade-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_default_group_policy_object_modified.yml b/detections/endpoint/windows_default_group_policy_object_modified.yml index 4955cf8b89..0f8ba948b0 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified.yml @@ -1,6 +1,6 @@ name: Windows Default Group Policy Object Modified id: fe6a6cc4-9e0d-4d66-bcf4-2c7f44860876 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml index 6c21379d47..732f0e172d 100644 --- a/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml +++ b/detections/endpoint/windows_default_group_policy_object_modified_with_gpme.yml @@ -1,6 +1,6 @@ name: Windows Default Group Policy Object Modified with GPME id: eaf688b3-bb8f-454d-b105-920a862cd8cb -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/windows_detect_network_scanner_behavior.yml b/detections/endpoint/windows_detect_network_scanner_behavior.yml index 7a05993d0d..3db7828a2b 100644 --- a/detections/endpoint/windows_detect_network_scanner_behavior.yml +++ b/detections/endpoint/windows_detect_network_scanner_behavior.yml @@ -1,63 +1,63 @@ -name: Windows Detect Network Scanner Behavior -id: 78e678d2-bf64-4fe6-aa52-2f7b11dddee7 -version: 2 -date: '2025-01-09' -author: Steven Dick -status: production -type: Anomaly -description: The following analytic detects when an application is used to connect a large number of unique ports/targets within a short time frame. Network enumeration may be used by adversaries as a method of discovery, lateral movement, or remote execution. This analytic may require significant tuning depending on the organization and applications being actively used, highly recommended to pre-populate the filter macro prior to activation. -data_source: -- Sysmon EventID 3 -search: '| tstats `security_content_summariesonly` count latest(All_Traffic.dest_port) as dest_port dc(All_Traffic.dest_port) as port_count dc(All_Traffic.dest) as dest_count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id from datamodel=Network_Traffic.All_Traffic where sourcetype=XmlWinEventLog All_Traffic.app = "*\\*" All_Traffic.dest_port < 32000 NOT All_Traffic.dest_port IN (8443,8080,5353,3268,443,389,88,80,53,25) by host,All_Traffic.app,All_Traffic.src,All_Traffic.src_ip,All_Traffic.user _time span=5m -| `drop_dm_object_name(All_Traffic)` -| rex field=app ".*\\\(?.*)$" -| where port_count > 10 OR dest_count > 10 -| stats latest(src) as src, latest(src_ip) as src_ip, max(dest_count) as dest_count, max(port_count) as port_count, latest(dest_port) as dest_port, min(firstTime) as firstTime, max(lastTime) as lastTime, max(count) as count by host,user,app,process_name -| `security_content_ctime(firstTime)` -| `security_content_ctime(lastTime)` -| `windows_detect_network_scanner_behavior_filter`' -how_to_implement: This detection relies on Sysmon EventID 3 events being ingested AND tagged into the Network_Traffic datamodel. -known_false_positives: Various, could be noisy depending on processes in the organization and sysmon configuration used. Adjusted port/dest count thresholds as needed. -references: -- https://attack.mitre.org/techniques/T1595 -drilldown_searches: -- name: View the detection results for - "$src$" and "$user$" - search: '%original_detection_search% | search src = "$src$" user = "$user$"' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -- name: View risk events for the last 7 days for - "$src$" and "$user$" - search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' - earliest_offset: $info_min_time$ - latest_offset: $info_max_time$ -rba: - message: A process exhibiting network scanning behavior [$process_name$] was detected on $src$ - risk_objects: - - field: src - type: system - score: 25 - - field: user - type: user - score: 25 - threat_objects: - - field: process_name - type: process_name -tags: - analytic_story: - - Network Discovery - - Windows Discovery Techniques - asset_type: Endpoint - mitre_attack_id: - - T1595 - - T1595.001 - - T1595.002 - product: - - Splunk Enterprise - - Splunk Enterprise Security - - Splunk Cloud - security_domain: network -tests: -- name: True Positive Test - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/sysmon_scanning_events/sysmon_scanning_events.log - source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational - sourcetype: XmlWinEventLog +name: Windows Detect Network Scanner Behavior +id: 78e678d2-bf64-4fe6-aa52-2f7b11dddee7 +version: 3 +date: '2025-01-09' +author: Steven Dick +status: production +type: Anomaly +description: The following analytic detects when an application is used to connect a large number of unique ports/targets within a short time frame. Network enumeration may be used by adversaries as a method of discovery, lateral movement, or remote execution. This analytic may require significant tuning depending on the organization and applications being actively used, highly recommended to pre-populate the filter macro prior to activation. +data_source: +- Sysmon EventID 3 +search: '| tstats `security_content_summariesonly` count latest(All_Traffic.dest_port) as dest_port dc(All_Traffic.dest_port) as port_count dc(All_Traffic.dest) as dest_count min(_time) as firstTime max(_time) as lastTime values(All_Traffic.process_id) as process_id from datamodel=Network_Traffic.All_Traffic where sourcetype=XmlWinEventLog All_Traffic.app = "*\\*" All_Traffic.dest_port < 32000 NOT All_Traffic.dest_port IN (8443,8080,5353,3268,443,389,88,80,53,25) by host,All_Traffic.app,All_Traffic.src,All_Traffic.src_ip,All_Traffic.user _time span=5m +| `drop_dm_object_name(All_Traffic)` +| rex field=app ".*\\\(?.*)$" +| where port_count > 10 OR dest_count > 10 +| stats latest(src) as src, latest(src_ip) as src_ip, max(dest_count) as dest_count, max(port_count) as port_count, latest(dest_port) as dest_port, min(firstTime) as firstTime, max(lastTime) as lastTime, max(count) as count by host,user,app,process_name +| `security_content_ctime(firstTime)` +| `security_content_ctime(lastTime)` +| `windows_detect_network_scanner_behavior_filter`' +how_to_implement: This detection relies on Sysmon EventID 3 events being ingested AND tagged into the Network_Traffic datamodel. +known_false_positives: Various, could be noisy depending on processes in the organization and sysmon configuration used. Adjusted port/dest count thresholds as needed. +references: +- https://attack.mitre.org/techniques/T1595 +drilldown_searches: +- name: View the detection results for - "$src$" and "$user$" + search: '%original_detection_search% | search src = "$src$" user = "$user$"' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +- name: View risk events for the last 7 days for - "$src$" and "$user$" + search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$") starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories) as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic) as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`' + earliest_offset: $info_min_time$ + latest_offset: $info_max_time$ +rba: + message: A process exhibiting network scanning behavior [$process_name$] was detected on $src$ + risk_objects: + - field: src + type: system + score: 25 + - field: user + type: user + score: 25 + threat_objects: + - field: process_name + type: process_name +tags: + analytic_story: + - Network Discovery + - Windows Discovery Techniques + asset_type: Endpoint + mitre_attack_id: + - T1595 + - T1595.001 + - T1595.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + security_domain: network +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1595/sysmon_scanning_events/sysmon_scanning_events.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: XmlWinEventLog diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index c8c1b362d2..c53c115e73 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -1,6 +1,6 @@ name: Windows Disable Memory Crash Dump id: 59e54602-9680-11ec-a8a6-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml index 8419dcfa0e..5c03275ca5 100644 --- a/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml +++ b/detections/endpoint/windows_disable_windows_event_logging_disable_http_logging.yml @@ -1,6 +1,6 @@ name: Windows Disable Windows Event Logging Disable HTTP Logging id: 23fb6787-255f-4d5b-9a66-9fd7504032b5 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index 8a4786b5ea..a84e7ed383 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -1,6 +1,6 @@ name: Windows DISM Remove Defender id: 8567da9e-47f0-11ec-99a9-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml index 5ddb5d8355..d5d279ce64 100644 --- a/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml +++ b/detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml @@ -1,6 +1,6 @@ name: Windows DLL Search Order Hijacking with iscsicpl id: f39ee679-3b1e-4f47-841c-5c3c580acda2 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index a356cdce76..6efd4b398f 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -1,6 +1,6 @@ name: Windows DotNet Binary in Non Standard Path id: fddf3b56-7933-11ec-98a6-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml index 0fecbadc81..373e172977 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_net.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_net.yml @@ -1,6 +1,6 @@ name: Windows ESX Admins Group Creation via Net id: 3d7df60b-3332-4667-8090-afe03e08dce0 -version: 4 +version: 5 date: '2025-01-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml index 71b3808e94..fd301786bb 100644 --- a/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml +++ b/detections/endpoint/windows_esx_admins_group_creation_via_powershell.yml @@ -1,6 +1,6 @@ name: Windows ESX Admins Group Creation via PowerShell id: f48a5557-be06-4b96-b8e8-be563e387620 -version: 3 +version: 4 date: '2024-11-13' author: Michael Haag, Splunk data_source: diff --git a/detections/endpoint/windows_excessive_usage_of_net_app.yml b/detections/endpoint/windows_excessive_usage_of_net_app.yml index 68d8e0a30f..10716cc575 100644 --- a/detections/endpoint/windows_excessive_usage_of_net_app.yml +++ b/detections/endpoint/windows_excessive_usage_of_net_app.yml @@ -1,6 +1,6 @@ name: Windows Excessive Usage Of Net App id: 355ba810-0a20-4215-8485-9ce3f87f2e38 -version: 1 +version: 2 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml index 576e79a52b..abbcec0359 100644 --- a/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml +++ b/detections/endpoint/windows_execute_arbitrary_commands_with_msdt.yml @@ -1,6 +1,6 @@ name: Windows Execute Arbitrary Commands with MSDT id: e1d5145f-38fe-42b9-a5d5-457796715f97 -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_findstr_gpp_discovery.yml b/detections/endpoint/windows_findstr_gpp_discovery.yml index b141be9c81..90504904d8 100644 --- a/detections/endpoint/windows_findstr_gpp_discovery.yml +++ b/detections/endpoint/windows_findstr_gpp_discovery.yml @@ -1,6 +1,6 @@ name: Windows Findstr GPP Discovery id: 1631ac2d-f2a9-42fa-8a59-d6e210d472f5 -version: 4 +version: 5 date: '2024-11-13' author: Mauricio Velazco, Splunk type: TTP diff --git a/detections/endpoint/windows_http_network_communication_from_msiexec.yml b/detections/endpoint/windows_http_network_communication_from_msiexec.yml index 46426413d7..d312721aa7 100644 --- a/detections/endpoint/windows_http_network_communication_from_msiexec.yml +++ b/detections/endpoint/windows_http_network_communication_from_msiexec.yml @@ -1,6 +1,6 @@ name: Windows HTTP Network Communication From MSIExec id: b0fd38c7-f71a-43a2-870e-f3ca06bcdd99 -version: 1 +version: 2 date: '2025-01-17' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_iis_components_add_new_module.yml b/detections/endpoint/windows_iis_components_add_new_module.yml index bd66a0d8fb..eb129002c3 100644 --- a/detections/endpoint/windows_iis_components_add_new_module.yml +++ b/detections/endpoint/windows_iis_components_add_new_module.yml @@ -1,6 +1,6 @@ name: Windows IIS Components Add New Module id: 38fe731c-1f13-43d4-b878-a5bbe44807e3 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml b/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml index 9d3ed5adac..0499d7e3de 100644 --- a/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml +++ b/detections/endpoint/windows_impair_defenses_disable_av_autostart_via_registry.yml @@ -1,6 +1,6 @@ name: Windows Impair Defenses Disable AV AutoStart via Registry id: 31a13f43-812e-4752-a6ca-c6c87bf03e83 -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: diff --git a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml index 8bfb3df253..75fd3bf93a 100644 --- a/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml +++ b/detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml @@ -1,6 +1,6 @@ name: Windows Ingress Tool Transfer Using Explorer id: 76753bab-f116-4ea3-8fb9-89b638be58a9 -version: 6 +version: 7 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 3f0452bd4f..34a84e25f7 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil in Non Standard Path id: dcf74b22-7933-11ec-857c-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index 7058757a08..63710acabf 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil Remote Network Connection id: 4fbf9270-43da-11ec-9486-acde48001122 -version: 8 +version: 9 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 97ee5f6a58..7a969b6004 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil Uninstall Option id: cfa7b9ac-43f0-11ec-9b48-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index fb760e80bd..20601ae9a5 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil Uninstall Option with Network id: 1a52c836-43ef-11ec-a36c-acde48001122 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index bfae587299..980615a788 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -1,6 +1,6 @@ name: Windows InstallUtil URL in Command Line id: 28e06670-43df-11ec-a569-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_java_spawning_shells.yml b/detections/endpoint/windows_java_spawning_shells.yml index 8ed67cb7ab..19a3260fbf 100644 --- a/detections/endpoint/windows_java_spawning_shells.yml +++ b/detections/endpoint/windows_java_spawning_shells.yml @@ -1,6 +1,6 @@ name: Windows Java Spawning Shells id: 28c81306-5c47-11ec-bfea-acde48001122 -version: 7 +version: 8 date: '2024-12-16' author: Michael Haag, Splunk status: experimental diff --git a/detections/endpoint/windows_ldifde_directory_object_behavior.yml b/detections/endpoint/windows_ldifde_directory_object_behavior.yml index f03a5ff5a1..30ab7ce4b3 100644 --- a/detections/endpoint/windows_ldifde_directory_object_behavior.yml +++ b/detections/endpoint/windows_ldifde_directory_object_behavior.yml @@ -1,6 +1,6 @@ name: Windows Ldifde Directory Object Behavior id: 35cd29ca-f08c-4489-8815-f715c45460d3 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_mimikatz_binary_execution.yml b/detections/endpoint/windows_mimikatz_binary_execution.yml index b33a7416d4..8578d406d4 100644 --- a/detections/endpoint/windows_mimikatz_binary_execution.yml +++ b/detections/endpoint/windows_mimikatz_binary_execution.yml @@ -1,6 +1,6 @@ name: Windows Mimikatz Binary Execution id: a9e0d6d3-9676-4e26-994d-4e0406bb4467 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml index 6d180da12f..f83503b284 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_c2_config.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry ValleyRAT C2 Config id: ac59298a-8d81-4c02-8c9b-ffdac993891f -version: 4 +version: 5 date: '2024-11-13' author: Teoderick Contreras, Splunk data_source: diff --git a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml index cc16e59756..1f0d757c88 100644 --- a/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml +++ b/detections/endpoint/windows_modify_registry_valleyrat_pwn_reg_entry.yml @@ -1,6 +1,6 @@ name: Windows Modify Registry ValleyRat PWN Reg Entry id: 6947c44e-be1f-4dd9-b198-bc42be5be196 -version: 5 +version: 6 date: '2024-12-16' author: Teoderick Contreras, Splunk data_source: diff --git a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml index 273ecf6bf3..5906eedfab 100644 --- a/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml +++ b/detections/endpoint/windows_mof_event_triggered_execution_via_wmi.yml @@ -1,6 +1,6 @@ name: Windows MOF Event Triggered Execution via WMI id: e59b5a73-32bf-4467-a585-452c36ae10c1 -version: 7 +version: 8 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_msiexec_dllregisterserver.yml b/detections/endpoint/windows_msiexec_dllregisterserver.yml index fab94a6582..862e6c9f89 100644 --- a/detections/endpoint/windows_msiexec_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_dllregisterserver.yml @@ -1,6 +1,6 @@ name: Windows MSIExec DLLRegisterServer id: fdb59aef-d88f-4909-8369-ec2afbd2c398 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_msiexec_remote_download.yml b/detections/endpoint/windows_msiexec_remote_download.yml index 1d89715d94..ea822dfe4d 100644 --- a/detections/endpoint/windows_msiexec_remote_download.yml +++ b/detections/endpoint/windows_msiexec_remote_download.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Remote Download id: 6aa49ff2-3c92-4586-83e0-d83eb693dfda -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml index dde48d4cb7..a604c6a7d5 100644 --- a/detections/endpoint/windows_msiexec_spawn_discovery_command.yml +++ b/detections/endpoint/windows_msiexec_spawn_discovery_command.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Spawn Discovery Command id: e9d05aa2-32f0-411b-930c-5b8ca5c4fcee -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_msiexec_spawn_windbg.yml b/detections/endpoint/windows_msiexec_spawn_windbg.yml index 4e4121a5d0..c80059d8d6 100644 --- a/detections/endpoint/windows_msiexec_spawn_windbg.yml +++ b/detections/endpoint/windows_msiexec_spawn_windbg.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Spawn WinDBG id: 9a18f7c2-1fe3-47b8-9467-8b3976770a30 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml index b7255c3665..697c254586 100644 --- a/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml +++ b/detections/endpoint/windows_msiexec_unregister_dllregisterserver.yml @@ -1,6 +1,6 @@ name: Windows MSIExec Unregister DLLRegisterServer id: a27db3c5-1a9a-46df-a577-765d3f1a3c24 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml index 9d6caf3abd..aae826157a 100644 --- a/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml +++ b/detections/endpoint/windows_ngrok_reverse_proxy_usage.yml @@ -1,6 +1,6 @@ name: Windows Ngrok Reverse Proxy Usage id: e2549f2c-0aef-408a-b0c1-e0f270623436 -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index 62b05e5300..4a5461615e 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -1,6 +1,6 @@ name: Windows NirSoft AdvancedRun id: bb4f3090-7ae4-11ec-897f-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_odbcconf_load_dll.yml b/detections/endpoint/windows_odbcconf_load_dll.yml index 815aa3b02f..f7a52f0e6a 100644 --- a/detections/endpoint/windows_odbcconf_load_dll.yml +++ b/detections/endpoint/windows_odbcconf_load_dll.yml @@ -1,6 +1,6 @@ name: Windows Odbcconf Load DLL id: 141e7fca-a9f0-40fd-a539-9aac8be41f1b -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_odbcconf_load_response_file.yml b/detections/endpoint/windows_odbcconf_load_response_file.yml index 0fa23e5e03..7d234fd114 100644 --- a/detections/endpoint/windows_odbcconf_load_response_file.yml +++ b/detections/endpoint/windows_odbcconf_load_response_file.yml @@ -1,6 +1,6 @@ name: Windows Odbcconf Load Response File id: 1acafff9-1347-4b40-abae-f35aa4ba85c1 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_office_product_spawned_control.yml b/detections/endpoint/windows_office_product_spawned_control.yml index 5590c761b9..314783f994 100644 --- a/detections/endpoint/windows_office_product_spawned_control.yml +++ b/detections/endpoint/windows_office_product_spawned_control.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned Control id: 081c485d-ac8d-4bee-ad4c-525772fead4d -version: 1 +version: 2 date: '2025-01-14' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_office_product_spawned_msdt.yml b/detections/endpoint/windows_office_product_spawned_msdt.yml index 3a79e47208..446f762e55 100644 --- a/detections/endpoint/windows_office_product_spawned_msdt.yml +++ b/detections/endpoint/windows_office_product_spawned_msdt.yml @@ -1,6 +1,6 @@ name: Windows Office Product Spawned MSDT id: a3148fad-3734-4b7f-9a71-62f08d39fab1 -version: 1 +version: 2 date: '2025-01-14' author: Michael Haag, Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_papercut_ng_spawn_shell.yml b/detections/endpoint/windows_papercut_ng_spawn_shell.yml index 31198dc5a3..d647e50311 100644 --- a/detections/endpoint/windows_papercut_ng_spawn_shell.yml +++ b/detections/endpoint/windows_papercut_ng_spawn_shell.yml @@ -1,6 +1,6 @@ name: Windows PaperCut NG Spawn Shell id: a602d9a2-aaea-45f8-bf0f-d851168d61ca -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_powersploit_gpp_discovery.yml b/detections/endpoint/windows_powersploit_gpp_discovery.yml index c0bc3bffb3..ab9be17dd3 100644 --- a/detections/endpoint/windows_powersploit_gpp_discovery.yml +++ b/detections/endpoint/windows_powersploit_gpp_discovery.yml @@ -1,6 +1,6 @@ name: Windows PowerSploit GPP Discovery id: 0130a0df-83a1-4647-9011-841e950ff302 -version: 5 +version: 6 date: '2024-11-13' author: Mauricio Velazco, Splunk status: production diff --git a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml index 6b4490c90e..c94417e9e5 100644 --- a/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml +++ b/detections/endpoint/windows_privilege_escalation_suspicious_process_elevation.yml @@ -1,6 +1,6 @@ name: Windows Privilege Escalation Suspicious Process Elevation id: 6a80300a-9f8a-4f22-bd3e-09ca577cfdfc -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/windows_protocol_tunneling_with_plink.yml b/detections/endpoint/windows_protocol_tunneling_with_plink.yml index 3a6481da48..b55caf7791 100644 --- a/detections/endpoint/windows_protocol_tunneling_with_plink.yml +++ b/detections/endpoint/windows_protocol_tunneling_with_plink.yml @@ -1,6 +1,6 @@ name: Windows Protocol Tunneling with Plink id: 8aac5e1e-0fab-4437-af0b-c6e60af23eed -version: 6 +version: 7 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml index 4c61efa0c7..9e419ace18 100644 --- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -1,6 +1,6 @@ name: Windows Raccine Scheduled Task Deletion id: c9f010da-57ab-11ec-82bd-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index f04f743ef0..47773b52e9 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -1,6 +1,6 @@ name: Windows Rasautou DLL Execution id: 6f42b8be-8e96-11ec-ad5a-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml index d938db4eac..256ee2f8e3 100644 --- a/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml +++ b/detections/endpoint/windows_registry_dotnet_etw_disabled_via_env_variable.yml @@ -1,6 +1,6 @@ name: Windows Registry Dotnet ETW Disabled Via ENV Variable id: 55502381-5cce-491b-9277-7cb1d10bc0df -version: 2 +version: 3 date: '2025-01-07' author: Nasreddine Bencherchali, Splunk status: production diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index 90cb689064..e6810e6c34 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -1,6 +1,6 @@ name: Windows Remote Assistance Spawning Process id: ced50492-8849-11ec-9f68-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_remote_create_service.yml b/detections/endpoint/windows_remote_create_service.yml index 93c28d5380..c963d8e1d7 100644 --- a/detections/endpoint/windows_remote_create_service.yml +++ b/detections/endpoint/windows_remote_create_service.yml @@ -1,6 +1,6 @@ name: Windows Remote Create Service id: 0dc44d03-8c00-482d-ba7c-796ba7ab18c9 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_rundll32_webdav_request.yml b/detections/endpoint/windows_rundll32_webdav_request.yml index ce111cff26..68ccb04ab4 100644 --- a/detections/endpoint/windows_rundll32_webdav_request.yml +++ b/detections/endpoint/windows_rundll32_webdav_request.yml @@ -1,6 +1,6 @@ name: Windows Rundll32 WebDAV Request id: 320099b7-7eb1-4153-a2b4-decb53267de2 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml b/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml index de78c6f02b..8ef7992823 100644 --- a/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml +++ b/detections/endpoint/windows_rundll32_webdav_with_network_connection.yml @@ -1,6 +1,6 @@ name: Windows Rundll32 WebDav With Network Connection id: f03355e0-28b5-4e9b-815a-6adffc63b38c -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml index d8050741e3..fe239f0596 100644 --- a/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml +++ b/detections/endpoint/windows_sensitive_registry_hive_dump_via_commandline.yml @@ -1,6 +1,6 @@ name: Windows Sensitive Registry Hive Dump Via CommandLine id: 5aaff29d-0cce-405b-9ee8-5d06b49d045e -version: 1 +version: 2 date: '2025-01-15' author: Michael Haag, Patrick Bareiss, Nasreddine Bencherchali, Splunk status: production diff --git a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml index 64c9bcdd4f..ec7cef2ae6 100644 --- a/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml +++ b/detections/endpoint/windows_server_software_component_gacutil_install_to_gac.yml @@ -1,6 +1,6 @@ name: Windows Server Software Component GACUtil Install to GAC id: 7c025ef0-9e65-4c57-be39-1c13dbb1613e -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_service_create_with_tscon.yml b/detections/endpoint/windows_service_create_with_tscon.yml index 150f198cc2..94c6c19992 100644 --- a/detections/endpoint/windows_service_create_with_tscon.yml +++ b/detections/endpoint/windows_service_create_with_tscon.yml @@ -1,6 +1,6 @@ name: Windows Service Create with Tscon id: c13b3d74-6b63-4db5-a841-4206f0370077 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/windows_service_execution_remcom.yml b/detections/endpoint/windows_service_execution_remcom.yml index 01840501c6..43198428c0 100644 --- a/detections/endpoint/windows_service_execution_remcom.yml +++ b/detections/endpoint/windows_service_execution_remcom.yml @@ -1,6 +1,6 @@ name: Windows Service Execution RemCom id: 7e3d68db-ea4d-419b-adbd-e14a525ecf09 -version: 2 +version: 3 date: '2025-01-07' author: Michael Haag, Splunk type: TTP diff --git a/detections/endpoint/windows_sql_spawning_certutil.yml b/detections/endpoint/windows_sql_spawning_certutil.yml index f2e58cc866..d612a17e7e 100644 --- a/detections/endpoint/windows_sql_spawning_certutil.yml +++ b/detections/endpoint/windows_sql_spawning_certutil.yml @@ -1,6 +1,6 @@ name: Windows SQL Spawning CertUtil id: dfc18a5a-946e-44ee-a373-c0f60d06e676 -version: 6 +version: 7 date: '2024-12-16' author: Michael Haag, Splunk status: experimental diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml index f62cbf81c9..10ca564046 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_abuse.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates - ESC1 Abuse id: cbe761fc-d945-4c8c-a71d-e26d12255d32 -version: 5 +version: 6 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml b/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml index 725f04e04e..5fcaaba267 100644 --- a/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml +++ b/detections/endpoint/windows_steal_authentication_certificates___esc1_authentication.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates - ESC1 Authentication id: f0306acf-a6ab-437a-bbc6-8628f8d5c97e -version: 5 +version: 6 date: '2024-12-10' author: Steven Dick status: production diff --git a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml index bf954e1d52..9e7ceb2759 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_certutil_backup.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates CertUtil Backup id: bac85b56-0b65-4ce5-aad5-d94880df0967 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml index d1a5eb3d7b..af44db774c 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_certificate.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates Export Certificate id: e39dc429-c2a5-4f1f-9c3c-6b211af6b332 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml index 459417802e..2e01886698 100644 --- a/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml +++ b/detections/endpoint/windows_steal_authentication_certificates_export_pfxcertificate.yml @@ -1,6 +1,6 @@ name: Windows Steal Authentication Certificates Export PfxCertificate id: 391329f3-c14b-4b8d-8b37-ac5012637360 -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml index 3b28765cce..a9ace2226c 100644 --- a/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml +++ b/detections/endpoint/windows_suspect_process_with_authentication_traffic.yml @@ -1,6 +1,6 @@ name: Windows Suspect Process With Authentication Traffic id: 953322db-128a-4ce9-8e89-56e039e33d98 -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml index 115d30093e..318fc412e7 100644 --- a/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml +++ b/detections/endpoint/windows_system_binary_proxy_execution_compiled_html_file_decompile.yml @@ -1,6 +1,6 @@ name: Windows System Binary Proxy Execution Compiled HTML File Decompile id: 2acf0e19-4149-451c-a3f3-39cd3c77e37d -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml index 40f299551f..151b86c366 100644 --- a/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml +++ b/detections/endpoint/windows_system_script_proxy_execution_syncappvpublishingserver.yml @@ -1,6 +1,6 @@ name: Windows System Script Proxy Execution Syncappvpublishingserver id: 8dd73f89-682d-444c-8b41-8e679966ad3c -version: 5 +version: 6 date: '2024-11-13' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml index ffd2829b98..7921f897c6 100644 --- a/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml +++ b/detections/endpoint/windows_uac_bypass_suspicious_child_process.yml @@ -1,6 +1,6 @@ name: Windows UAC Bypass Suspicious Child Process id: 453a6b0f-b0ea-48fa-9cf4-20537ffdd22c -version: 4 +version: 5 date: '2024-11-13' author: Steven Dick status: production diff --git a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml index 29e8eca705..977a72aeee 100644 --- a/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml +++ b/detections/endpoint/windows_uac_bypass_suspicious_escalation_behavior.yml @@ -1,6 +1,6 @@ name: Windows UAC Bypass Suspicious Escalation Behavior id: 00d050d3-a5b4-4565-a6a5-a31f69681dc3 -version: 5 +version: 6 date: '2024-12-10' author: Steven Dick status: production diff --git a/detections/endpoint/windows_user_deletion_via_net.yml b/detections/endpoint/windows_user_deletion_via_net.yml index 33ae19c5ea..32bb43dd91 100644 --- a/detections/endpoint/windows_user_deletion_via_net.yml +++ b/detections/endpoint/windows_user_deletion_via_net.yml @@ -1,6 +1,6 @@ name: Windows User Deletion Via Net id: b0b6fd2c-8953-4d1b-8f7b-56075ea6ab3e -version: 1 +version: 2 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_user_disabled_via_net.yml b/detections/endpoint/windows_user_disabled_via_net.yml index dd390a4128..547248419e 100644 --- a/detections/endpoint/windows_user_disabled_via_net.yml +++ b/detections/endpoint/windows_user_disabled_via_net.yml @@ -1,6 +1,6 @@ name: Windows User Disabled Via Net id: b0359e05-c87b-4354-83d8-aee0d890243f -version: 1 +version: 2 date: '2025-01-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/endpoint/windows_windbg_spawning_autoit3.yml b/detections/endpoint/windows_windbg_spawning_autoit3.yml index ddf09e5373..323c29de1d 100644 --- a/detections/endpoint/windows_windbg_spawning_autoit3.yml +++ b/detections/endpoint/windows_windbg_spawning_autoit3.yml @@ -1,6 +1,6 @@ name: Windows WinDBG Spawning AutoIt3 id: 7aec015b-cd69-46c3-85ed-dac152056aa4 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index 97671e24f0..71018871f9 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -1,6 +1,6 @@ name: Winhlp32 Spawning a Process id: d17dae9e-2618-11ec-b9f5-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/winrar_spawning_shell_application.yml b/detections/endpoint/winrar_spawning_shell_application.yml index 9ef1be04ff..104bc4f1d3 100644 --- a/detections/endpoint/winrar_spawning_shell_application.yml +++ b/detections/endpoint/winrar_spawning_shell_application.yml @@ -1,6 +1,6 @@ name: WinRAR Spawning Shell Application id: d2f36034-37fa-4bd4-8801-26807c15540f -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index b8efe7f1fc..a9fa113597 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -1,6 +1,6 @@ name: WMIC XSL Execution via URL id: 787e9dd0-4328-11ec-a029-acde48001122 -version: 6 +version: 7 date: '2024-12-10' author: Michael Haag, Splunk status: production diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index 02f24699a2..28584c4d66 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -1,6 +1,6 @@ name: XSL Script Execution With WMIC id: 004e32e2-146d-11ec-a83f-acde48001122 -version: 5 +version: 6 date: '2024-11-13' author: Teoderick Contreras, Splunk status: production diff --git a/detections/network/detect_large_outbound_icmp_packets.yml b/detections/network/detect_large_outbound_icmp_packets.yml index e4bdf54ffc..9fa1a7f4b5 100644 --- a/detections/network/detect_large_outbound_icmp_packets.yml +++ b/detections/network/detect_large_outbound_icmp_packets.yml @@ -1,6 +1,6 @@ name: Detect Large Outbound ICMP Packets id: e9c102de-4d43-42a7-b1c8-8062ea297419 -version: 8 +version: 9 date: '2025-01-27' author: Rico Valdez, Dean Luxton, Splunk status: production diff --git a/detections/web/detect_remote_access_software_usage_url.yml b/detections/web/detect_remote_access_software_usage_url.yml index d60f2af086..4e51d42198 100644 --- a/detections/web/detect_remote_access_software_usage_url.yml +++ b/detections/web/detect_remote_access_software_usage_url.yml @@ -1,6 +1,6 @@ name: Detect Remote Access Software Usage URL id: 9296f515-073c-43a5-88ec-eda5a4626654 -version: 5 +version: 6 date: '2024-11-15' author: Steven Dick status: production diff --git a/detections/web/zscaler_adware_activities_threat_blocked.yml b/detections/web/zscaler_adware_activities_threat_blocked.yml index f662cc0a16..c47abd8740 100644 --- a/detections/web/zscaler_adware_activities_threat_blocked.yml +++ b/detections/web/zscaler_adware_activities_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Adware Activities Threat Blocked id: 3407b250-345a-4d71-80db-c91e555a3ece -version: 4 +version: 5 date: '2024-11-15' author: Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/web/zscaler_behavior_analysis_threat_blocked.yml b/detections/web/zscaler_behavior_analysis_threat_blocked.yml index 8875d8762b..8a55d3f407 100644 --- a/detections/web/zscaler_behavior_analysis_threat_blocked.yml +++ b/detections/web/zscaler_behavior_analysis_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Behavior Analysis Threat Blocked id: 289ad59f-8939-4331-b805-f2bd51d36fb8 -version: 4 +version: 5 date: '2024-11-15' author: Rod Soto, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/web/zscaler_exploit_threat_blocked.yml b/detections/web/zscaler_exploit_threat_blocked.yml index 0da0906592..e88d087743 100644 --- a/detections/web/zscaler_exploit_threat_blocked.yml +++ b/detections/web/zscaler_exploit_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Exploit Threat Blocked id: 94665d8c-b841-4ff4-acb4-34d613e2cbfe -version: 4 +version: 5 date: '2024-11-15' author: Rod Soto, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/web/zscaler_malware_activity_threat_blocked.yml b/detections/web/zscaler_malware_activity_threat_blocked.yml index 3494bd9e23..34061dc5be 100644 --- a/detections/web/zscaler_malware_activity_threat_blocked.yml +++ b/detections/web/zscaler_malware_activity_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Malware Activity Threat Blocked id: ae874ad8-e353-40a7-87d4-420cdfb27d1a -version: 4 +version: 5 date: '2024-11-15' author: Rod Soto, Gowthamaraj Rajendran, Splunk status: production diff --git a/detections/web/zscaler_potentially_abused_file_download.yml b/detections/web/zscaler_potentially_abused_file_download.yml index 040b02ae71..f18bdfe4f0 100644 --- a/detections/web/zscaler_potentially_abused_file_download.yml +++ b/detections/web/zscaler_potentially_abused_file_download.yml @@ -1,6 +1,6 @@ name: Zscaler Potentially Abused File Download id: b0c21379-f4ba-4bac-a958-897e260f964a -version: 4 +version: 5 date: '2024-11-15' author: Gowthamaraj Rajendran, Rod Soto, Splunk status: production diff --git a/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml b/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml index cad5f20065..abf94751e3 100644 --- a/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml +++ b/detections/web/zscaler_privacy_risk_destinations_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Privacy Risk Destinations Threat Blocked id: 5456bdef-d765-4565-8e1f-61ca027bc50d -version: 4 +version: 5 date: '2024-11-15' author: Gowthamaraj Rajendran, Rod Soto, Splunk status: production diff --git a/detections/web/zscaler_scam_destinations_threat_blocked.yml b/detections/web/zscaler_scam_destinations_threat_blocked.yml index d91cf5e7e9..5c7281924b 100644 --- a/detections/web/zscaler_scam_destinations_threat_blocked.yml +++ b/detections/web/zscaler_scam_destinations_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Scam Destinations Threat Blocked id: a0c21379-f4ba-4bac-a958-897e260f964a -version: 4 +version: 5 date: '2024-11-15' author: Gowthamaraj Rajendran, Rod Soto, Splunk status: production diff --git a/detections/web/zscaler_virus_download_threat_blocked.yml b/detections/web/zscaler_virus_download_threat_blocked.yml index 656efd2fac..f0c094a07c 100644 --- a/detections/web/zscaler_virus_download_threat_blocked.yml +++ b/detections/web/zscaler_virus_download_threat_blocked.yml @@ -1,6 +1,6 @@ name: Zscaler Virus Download threat blocked id: aa19e627-d448-4a31-85cd-82068dec5691 -version: 4 +version: 5 date: '2024-11-15' author: Gowthamaraj Rajendran, Rod Soto, Splunk status: production From ba8f23593a20179931b92b738de079207daa75ae Mon Sep 17 00:00:00 2001 From: research-bot Date: Wed, 5 Feb 2025 10:56:37 -0800 Subject: [PATCH 82/82] udpating ctl --- .github/workflows/appinspect.yml | 2 +- .github/workflows/build.yml | 3 ++- .github/workflows/unit-testing.yml | 2 +- 3 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/appinspect.yml b/.github/workflows/appinspect.yml index 5d821f8ab1..6eaf1a1025 100644 --- a/.github/workflows/appinspect.yml +++ b/.github/workflows/appinspect.yml @@ -18,7 +18,7 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==5.0.0 + pip install contentctl==${{ vars.CONTENTCTL_VERSION }} git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 46d76ececa..9cbfcabf7c 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -19,7 +19,8 @@ jobs: - name: Install Python Dependencies and ContentCTL and Atomic Red Team run: | - pip install contentctl==5.0.0 + echo "CONTENTCTL_VERSION is ${{ vars.CONTENTCTL_VERSION }}" + pip install contentctl==${{ vars.CONTENTCTL_VERSION }} git clone --depth=1 --single-branch --branch=master https://github.com/redcanaryco/atomic-red-team.git external_repos/atomic-red-team git clone --depth=1 --single-branch --branch=master https://github.com/mitre/cti external_repos/cti diff --git a/.github/workflows/unit-testing.yml b/.github/workflows/unit-testing.yml index fb10af44eb..7efa46679f 100644 --- a/.github/workflows/unit-testing.yml +++ b/.github/workflows/unit-testing.yml @@ -23,7 +23,7 @@ jobs: - name: Install Python Dependencies and ContentCTL run: | python -m pip install --upgrade pip - pip install contentctl==5.0.0 + pip install contentctl==${{ vars.CONTENTCTL_VERSION }} # Running contentctl test with a few arguments, before running the command make sure you checkout into the current branch of the pull request. This step only performs unit testing on all the changes against the target-branch. In most cases this target branch will be develop # Make sure we check out the PR, even if it actually lives in a fork