diff --git a/detections/endpoint/failed_ntlm_authentication_attempts_from_one_source_with_multiple_users.yml b/detections/endpoint/multiple_users_failing_to_authenticae_from_one_source_using_ntlm.ym similarity index 96% rename from detections/endpoint/failed_ntlm_authentication_attempts_from_one_source_with_multiple_users.yml rename to detections/endpoint/multiple_users_failing_to_authenticae_from_one_source_using_ntlm.ym index a43a92b705..e0f5ef7528 100644 --- a/detections/endpoint/failed_ntlm_authentication_attempts_from_one_source_with_multiple_users.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticae_from_one_source_using_ntlm.ym @@ -1,4 +1,4 @@ -name: Failed NTLM Authentication attempts from one source with multiple valid users +name: Multiple Valid Users Failing To Authenticate From One Source Using NTLM id: 7ed272a4-9c77-11eb-af22-acde48001122 version: 1 date: '2021-04-13' diff --git a/detections/endpoint/failed_authentication_attempts_from_one_process_with_multiple_users.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml similarity index 97% rename from detections/endpoint/failed_authentication_attempts_from_one_process_with_multiple_users.yml rename to detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml index 87624f0731..9057d05f1d 100644 --- a/detections/endpoint/failed_authentication_attempts_from_one_process_with_multiple_users.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml @@ -1,4 +1,4 @@ -name: Failed Authentication attempts from one process with multiple users +name: Multiple Users Failing To Authentication From One Process id: 9015385a-9c84-11eb-bef2-acde48001122 version: 1 date: '2021-04-13' diff --git a/detections/endpoint/failed_kerberos_authentication_attempts_from_one_source_with_multiple_users.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml similarity index 96% rename from detections/endpoint/failed_kerberos_authentication_attempts_from_one_source_with_multiple_users.yml rename to detections/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml index 0ee72692ec..2f7a6aed66 100644 --- a/detections/endpoint/failed_kerberos_authentication_attempts_from_one_source_with_multiple_users.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml @@ -1,4 +1,4 @@ -name: Failed Kerberos Authentication attempts from one source with multiple valid users +name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos id: 3a91a212-98a9-11eb-b86a-acde48001122 version: 1 date: '2021-04-08' diff --git a/detections/endpoint/failed_authentication_attempts_using_explit_credentials_with_multiple_users.yml b/detections/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.yml similarity index 68% rename from detections/endpoint/failed_authentication_attempts_using_explit_credentials_with_multiple_users.yml rename to detections/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.yml index 0edbc05a95..b66e90f1d6 100644 --- a/detections/endpoint/failed_authentication_attempts_using_explit_credentials_with_multiple_users.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.yml @@ -1,4 +1,4 @@ -name: Failed Authentication attempts using explit credentials with multiple users +name: Multiple Users Failing To Authenticate Using Explicit Credentials id: e61918fa-9ca4-11eb-836c-acde48001122 version: 1 date: '2021-04-13' @@ -11,13 +11,17 @@ This behavior could represent an adversary performing a Password Spraying attack In this logic, the number of unique users is hardcoded to '10' but can/should be customized to fit especific environments. Event 4648 is generated when a process attempts an account logon by explicitly specifying that account’s credentials. This event generates on domain controllers, member servers, and workstations. -This detection will trigger on the potenfially malicious host, perhaps conrtrolled via a trojan, from where a password spraying attack is being executed. +This detection will trigger on the potenfially malicious host, perhaps controlled via a trojan or operated by an insider threat, from where a +password spraying attack is being executed. +The analytic's returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified. search: '| UPDATE_SPL | `failed_authentication_attempts_using_explit_credentials_with_multiple_users_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: A source user failing attempting to authenticate multiple users on a host is not a common behavior for regular systems. +Some applications, however, may exhibit this behavior in which case sets of users hosts can be added to an allow list. +Possible false positive scenarios include systems where several users connect to like Mail servers, identity providers, remote desktop services, Citrix, etc. references: - https://attack.mitre.org/techniques/T1110/003/ - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4648 diff --git a/detections/endpoint/failed_remote_authentication_attemtps_from_one_source_with_multiple_users.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml similarity index 84% rename from detections/endpoint/failed_remote_authentication_attemtps_from_one_source_with_multiple_users.yml rename to detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml index fdfeeaf1d7..6dd7642c60 100644 --- a/detections/endpoint/failed_remote_authentication_attemtps_from_one_source_with_multiple_users.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml @@ -1,4 +1,4 @@ -name: Failed Remote Authentication attemtps from one source with multiple users +name: Multiple Users Remotely Failing To Authenticate From One Source id: 80f9d53e-9ca1-11eb-b0d6-acde48001122 version: 1 date: '2021-04-13' @@ -12,7 +12,7 @@ description: The following analytic identifies a source host failing to authenti Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt. - This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as member servers and workstations. + This detection will trigger on the host that is the target of the password spraying attack. This could be a domain controller as well as a member server orworkstation. The analytic's returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts. @@ -20,7 +20,8 @@ search: 'EventCode=4625 Logon_Type=3  Source_Network_Address!="-" | eval Destin stats  dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by Source_Network_Address, ComputerName | where  unique_accounts > 10' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting 'Audit Logon' within 'Logon/Logoff' needs to be enabled. -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +known_false_positives: A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. +Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. references: - https://attack.mitre.org/techniques/T1110/003/ - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625 diff --git a/tests/endpoint/failed_authentication_attempts_from_one_process_with_multiple_users.test.yml b/tests/endpoint/failed_authentication_attempts_from_one_process_with_multiple_users.test.yml deleted file mode 100644 index f8a40efba8..0000000000 --- a/tests/endpoint/failed_authentication_attempts_from_one_process_with_multiple_users.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Failed Authentication attempts from one process with multiple users Unit Test -tests: -- name: Multiple Failed Authentication attempts from one process with various users - file: detections/endpoint/multiple_failed_authentication_attempts_from_one_process_with_various_users.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/failed_authentication_attempts_using_explit_credentials_with_multiple_users.test.yml b/tests/endpoint/failed_authentication_attempts_using_explit_credentials_with_multiple_users.test.yml deleted file mode 100644 index becc643cfb..0000000000 --- a/tests/endpoint/failed_authentication_attempts_using_explit_credentials_with_multiple_users.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Failed Authentication attempts using explit credentials with multiple users Unit Test -tests: -- name: Failed Authentication attempts using explit credentials with multiple users - file: detections/endpoint/failed_authentication_attempts_using_explit_credentials_with_multiple_users.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/failed_kerberos_authentication_attempts_from_one_source_with_multiple_users.test.yml b/tests/endpoint/failed_kerberos_authentication_attempts_from_one_source_with_multiple_users.test.yml deleted file mode 100644 index 067946ba70..0000000000 --- a/tests/endpoint/failed_kerberos_authentication_attempts_from_one_source_with_multiple_users.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Failed Kerberos Authentication attempts from one source with multiple unique valid users Unit Test -tests: -- name: Multiple Failed Kerberos Authentication attempts from one source with multiple unique valid users - file: endpoint/multiple_failed_kerberos_authentication_attempts_from_one_source_with_multiple_unique_valid_users.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/failed_ntlm_authentication_attempts_from_one_source_with_multiple_users.test.yml b/tests/endpoint/failed_ntlm_authentication_attempts_from_one_source_with_multiple_users.test.yml deleted file mode 100644 index 0cad93b6e4..0000000000 --- a/tests/endpoint/failed_ntlm_authentication_attempts_from_one_source_with_multiple_users.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Failed NTLM Authentication attempts from one source with multiple valid users Unit Test -tests: -- name: Multiple Failed NTLM Authentication attempts from one source with multiple valid users - file: detections/endpoint/multiple_failed_ntlm_authentication_attempts_from_one_source_with_multiple_valid_users.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/failed_remote_authentication_attemtps_from_one_source_with_multiple_users.test.yml b/tests/endpoint/failed_remote_authentication_attemtps_from_one_source_with_multiple_users.test.yml deleted file mode 100644 index e1c0ff4aaf..0000000000 --- a/tests/endpoint/failed_remote_authentication_attemtps_from_one_source_with_multiple_users.test.yml +++ /dev/null @@ -1,12 +0,0 @@ -name: Failed Remote Authentication attemtps from one source with multiple users Unit Test -tests: -- name: Failed Remote Authentication attemtps from one source with multiple users - file: detections/endpoint/failed_remote_authentication_attemtps_from_one_source_with_multiple_users.yml - pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' - latest_time: 'now' - attack_data: - - file_name: UPDATE_FILE_NAME - data: UPDATE_DATASET_URL - source: UPDATE_SPLUNK_SOURCE - sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/multiple_users_failing_to_authenticae_from_one_source_using_ntlm.test.yml b/tests/endpoint/multiple_users_failing_to_authenticae_from_one_source_using_ntlm.test.yml new file mode 100644 index 0000000000..8489eaf392 --- /dev/null +++ b/tests/endpoint/multiple_users_failing_to_authenticae_from_one_source_using_ntlm.test.yml @@ -0,0 +1,12 @@ +name: FMultiple Valid Users Failing To Authenticate From One Source Using NTLM Unit Test +tests: +- name: Multiple Valid Users Failing To Authenticate From One Source Using NTLM + file: detections/endpoint/multiple_users_failing_to_authenticae_from_one_source_using_ntlm.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_one_process.test.yml b/tests/endpoint/multiple_users_failing_to_authenticate_from_one_process.test.yml new file mode 100644 index 0000000000..46e4b833fc --- /dev/null +++ b/tests/endpoint/multiple_users_failing_to_authenticate_from_one_process.test.yml @@ -0,0 +1,12 @@ +name: Multiple Users Failing To Authentication From One Process Unit Test +tests: +- name: Multiple Users Failing To Authentication From One Process + file: detections/endpoint/multiple_users_failing_to_authenticate_from_one_process.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.test.yml b/tests/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.test.yml new file mode 100644 index 0000000000..4c4b6b0463 --- /dev/null +++ b/tests/endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.test.yml @@ -0,0 +1,12 @@ +name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos Unit Test +tests: +- name: Multiple Valid Users Failing To Autheticate From One Source Using Kerberos + file: endpoint/multiple_users_failing_to_authenticate_from_source_using_kerberos.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.test.yml b/tests/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.test.yml new file mode 100644 index 0000000000..790252c7e6 --- /dev/null +++ b/tests/endpoint/multiple_users_failing_to_authenticate_using_explicit_credentials.test.yml @@ -0,0 +1,12 @@ +name: Multiple Users Failing To Authenticate Using Explicit Credentials Unit Test +tests: +- name: Multiple Users Failing To Authenticate Using Explicit Credentials + file: detections/endpoint/multiple_users_failing_to_authenticate_using_explict_credentials.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file diff --git a/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.test.yml b/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.test.yml new file mode 100644 index 0000000000..06f998d412 --- /dev/null +++ b/tests/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.test.yml @@ -0,0 +1,12 @@ +name: Multiple Users Remotely Failing To Authenticate From One Source Unit Test +tests: +- name: Multiple Users Remotely Failing To Authenticate From One Source + file: detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_source.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: UPDATE_FILE_NAME + data: UPDATE_DATASET_URL + source: UPDATE_SPLUNK_SOURCE + sourcetype: UPDATE_SPLUNK_SOURCETYPE \ No newline at end of file