admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

migrating detections to XML

Browse Source
This commit is contained in:
mvelazco
2022-09-23 15:45:24 -04:00
parent 56de63cff1
commit 27dad59624
16 changed files with 188 additions and 192 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml
+11 -12
View File
@@ -22,12 +22,11 @@ description: 'The following analytic identifies one source endpoint failing to a
The analytics returned fields allow analysts to investigate the event further by
providing fields like source ip and attempted user accounts.'
search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` '
search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
| bucket span=5m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
| where unique_accounts > 30
| `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
@@ -52,15 +51,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential Kerberos based password spraying attack from $Client_Address$
message: Potential Kerberos based password spraying attack from $IpAddress$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: Client_Address
- name: IpAddress
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -68,9 +67,9 @@ tags:
required_fields:
- _time
- EventCode
- Result_Code
- Account_Name
- Client_Address
- Status
- TargetUserName
- IpAddress
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml
+11 -12
View File
@@ -23,12 +23,11 @@ description: 'The following analytic identifies one source endpoint failing to a
The analytics returned fields allow analysts to investigate the event further by
providing fields like source ip and attempted user accounts.'
search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$"
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` '
search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6
| bucket span=5m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
| where unique_accounts > 30
| `windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
@@ -53,15 +52,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential Kerberos based password spraying attack from $Client_Address$
message: Potential Kerberos based password spraying attack from $IpAddress$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: Client_Address
- name: IpAddress
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -69,9 +68,9 @@ tags:
required_fields:
- _time
- EventCode
- Result_Code
- Account_Name
- Client_Address
- Status
- TargetUserName
- IpAddress
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml
+11 -12
View File
@@ -24,12 +24,11 @@ description: 'The following analytic identifies one source endpoint failing to a
The analytics returned fields allow analysts to investigate the event further by
providing fields like source workstation name and attempted user accounts.'
search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure
| bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account)
as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts)
as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `windows_multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`'
search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
| bucket span=5m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
| where unique_accounts > 30
| `windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
Validation' within `Account Logon` needs to be enabled.
@@ -55,15 +54,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential NTLM based password spraying attack from $Source_Workstation$
message: Potential NTLM based password spraying attack from $Workstation$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: Source_Workstation
- name: Workstation
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -71,9 +70,9 @@ tags:
required_fields:
- _time
- EventCode
- action
- Logon_Account
- Source_Workstation
- TargetUserName
- Workstation
- Status
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml
+10 -13
View File
@@ -22,14 +22,11 @@ description: 'The following analytic identifies a source user failing to authent
The analytics returned fields allow analysts to investigate the event further by
providing fields like source account, attempted user accounts and the endpoint were
the behavior was identified.'
search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account
= mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1)
| search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as
tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts)
as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` '
search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$
| bucket span=5m _time
| stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name
| where unique_accounts > 30
| `windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Windows Event Logs from domain controllers as well as member servers and workstations.
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
@@ -57,12 +54,12 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential password spraying attack from $ComputerName$
message: Potential password spraying attack from $Computer$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: ComputerName
- name: Computer
type: Endpoint
role:
- Victim
@@ -73,9 +70,9 @@ tags:
required_fields:
- _time
- EventCode
- Security_ID
- Account_Name
- ComputerName
- Target_User_Name
- Caller_User_Name
- Computer
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml
+11 -12
View File
@@ -22,12 +22,11 @@ description: 'The following analytic identifies one source endpoint failing to a
The analytics returned fields allow analysts to investigate the event further by
providing fields like source workstation name and attempted user accounts.'
search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure
| bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account)
as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts)
as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`'
search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A
| bucket span=5m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
| where unique_accounts > 30
| `windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
Validation` within `Account Logon` needs to be enabled.
@@ -53,15 +52,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential NTLM based password spraying attack from $Source_Workstation$
message: Potential NTLM based password spraying attack from $Workstation$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: Source_Workstation
- name: Workstation
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -69,9 +68,9 @@ tags:
required_fields:
- _time
- EventCode
- action
- Logon_Account
- Source_Workstation
- Status
- TargetUserName
- Workstation
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml
+10 -13
View File
@@ -22,14 +22,11 @@ description: 'The following analytic identifies a source process name failing to
The analytics returned fields allow analysts to investigate the event further by
providing fields like source process name, source account and attempted user accounts.'
search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-"
| bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account
= mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name)
as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName |
eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` '
search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-"
| bucket span=5m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer
| where unique_accounts > 30
| `windows_multiple_users_failed_to_authenticate_from_process_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Windows Event Logs from domain controllers aas well as member servers and workstations.
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
@@ -56,7 +53,7 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential password spraying attack from $ComputerName$
message: Potential password spraying attack from $Computer$
mitre_attack_id:
- T1110.003
- T1110
@@ -73,10 +70,10 @@ tags:
- _time
- EventCode
- Logon_Type
- Caller_Process_Name
- Security_ID
- Account_Name
- ComputerName
- ProcessName
- SubjectUserName
- TargetUserName
- Computer
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml
+11 -12
View File
@@ -21,12 +21,11 @@ description: 'The following analytic identifies one source endpoint failing to a
The analytics returned fields allow analysts to investigate the event further by
providing fields like source ip and attempted user accounts.'
search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$"
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`'
search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18
| bucket span=5m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
| where unique_accounts > 30
| `windows_multiple_users_failed_to_authenticate_using_kerberos_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
@@ -53,15 +52,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential Kerberos based password spraying attack from $Client_Address$
message: Potential Kerberos based password spraying attack from $IpAddress$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: Client_Address
- name: IpAddress
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -69,9 +68,9 @@ tags:
required_fields:
- _time
- EventCode
- Result_Code
- Account_Name
- Client_Address
- Status
- TargetUserName
- IpAddress
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml
+8 -11
View File
@@ -21,13 +21,11 @@ description: 'The following analytic identifies a source host failing to authent
The analytics returned fields allow analysts to investigate the event further by
providing fields like source process name, source account and attempted user accounts.'
search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-"
| bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats
dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts
by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts)
as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName
| eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10
and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` '
search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-"
| bucket span=5m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer
| where unique_accounts > 30
| `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Windows Event Logs from domain controllers as as well as member servers and workstations.
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
@@ -71,10 +69,9 @@ tags:
- _time
- EventCode
- Logon_Type
- Security_ID
- Account_Name
- ComputerName
- Source_Network_Address
- TargetUserName
- Computer
- IpAddress
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml
+13 -11
View File
@@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a
The analytics returned fields allow analysts to investigate the event further by
providing fields like source ip and attempted user accounts.'
search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12
| bucket span=2m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` '
| search isOutlier=1
| `windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
@@ -56,15 +58,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential Kerberos based password spraying attack from $Client_Address$
message: Potential Kerberos based password spraying attack from $IpAddress$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: Client_Address
- name: IpAddress
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -72,9 +74,9 @@ tags:
required_fields:
- _time
- EventCode
- Result_Code
- Account_Name
- Client_Address
- Status
- TargetUserName
- IpAddress
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml
+13 -11
View File
@@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a
The analytics returned fields allow analysts to investigate the event further by
providing fields like source ip and attempted user accounts.'
search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$"
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6
| bucket span=2m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` '
| search isOutlier=1
| `windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
@@ -56,15 +58,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential Kerberos based password spraying attack from $Client_Address$
message: Potential Kerberos based password spraying attack from $IpAddress$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: Client_Address
- name: IpAddress
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -72,9 +74,9 @@ tags:
required_fields:
- _time
- EventCode
- Result_Code
- Account_Name
- Client_Address
- Status
- TargetUserName
- IpAddress
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml
+12 -10
View File
@@ -27,12 +27,14 @@ description: 'The following analytic identifies one source endpoint failing to a
The analytics returned fields allow analysts to investigate the event further by
providing fields like source workstation name and attempted user accounts.'
search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure
| bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account)
as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts)
as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3)
search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064
| bucket span=2m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `windows_multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`'
| search isOutlier=1
| `windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
Validation' within `Account Logon` needs to be enabled.
@@ -63,10 +65,10 @@ tags:
- T1110.003
- T1110
observable:
- name: Source_Workstation
- name: Workstation
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -74,9 +76,9 @@ tags:
required_fields:
- _time
- EventCode
- action
- Logon_Account
- Source_Workstation
- TargetUserName
- Workstation
- Status
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml
+13 -13
View File
@@ -25,14 +25,14 @@ description: 'The following analytic identifies a source user failing to authent
The analytics returned fields allow analysts to investigate the event further by
providing fields like source account, attempted user accounts and the endpoint were
the behavior was identified.'
search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account
= mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1)
| search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$"
| stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as
tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts)
as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3)
search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$
| bucket span=2m _time
| stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Computer
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` '
| search isOutlier=1
| `windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Windows Event Logs from domain controllers as well as member servers and workstations.
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
@@ -60,15 +60,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential password spraying attack from $ComputerName$
message: Potential password spraying attack from $Computer$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: ComputerName
- name: Computer
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -76,9 +76,9 @@ tags:
required_fields:
- _time
- EventCode
- Security_ID
- Account_Name
- ComputerName
- Target_User_Name
- Caller_User_Name
- Computer
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml
+13 -11
View File
@@ -24,12 +24,14 @@ description: 'The following analytic identifies one source endpoint failing to a
The analytics returned fields allow analysts to investigate the event further by
providing fields like source ip and attempted user accounts.'
search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$"
| bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name)
as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as
comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3)
search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18
| bucket span=2m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`'
| search isOutlier=1
| `windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
@@ -56,15 +58,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential Kerberos based password spraying attack from $Client_Address$
message: Potential Kerberos based password spraying attack from $IpAddress$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: Client_Address
- name: IpAddress
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -72,9 +74,9 @@ tags:
required_fields:
- _time
- EventCode
- Result_Code
- Account_Name
- Client_Address
- Status
- TargetUserName
- IpAddress
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml
+14 -14
View File
@@ -25,14 +25,14 @@ description: 'The following analytic identifies a source process name failing to
The analytics returned fields allow analysts to investigate the event further by
providing fields like source process name, source account and attempted user accounts.'
search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-"
| bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account
= mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name)
as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName |
eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std
by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3)
search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-"
| bucket span=2m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ProcessName, SubjectUserName, Computer
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` '
| search isOutlier=1
| `windows_unusual_count_of_users_failed_to_authenticate_from_process_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Windows Event Logs from domain controllers aas well as member servers and workstations.
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
@@ -59,15 +59,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential password spraying attack from $ComputerName$
message: Potential password spraying attack from $Computer$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: ComputerName
- name: Computer
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -76,10 +76,10 @@ tags:
- _time
- EventCode
- Logon_Type
- Caller_Process_Name
- Security_ID
- Account_Name
- ComputerName
- ProcessName
- SubjectUserName
- TargetUserName
- Computer
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml
+13 -11
View File
@@ -25,12 +25,14 @@ description: 'The following analytic identifies one source endpoint failing to a
The analytics returned fields allow analysts to investigate the event further by
providing fields like source workstation name and attempted user accounts.'
search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure
| bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account)
as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts)
as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3)
search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A
| bucket span=2m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`'
| search isOutlier=1
| `windows_unusual_count_of_users_failed_to_authenticate_using_ntlm_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
Domain Controller events. The Advanced Security Audit policy setting `Audit Credential
Validation` within `Account Logon` needs to be enabled.
@@ -56,15 +58,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential NTLM based password spraying attack from $Source_Workstation$
message: Potential NTLM based password spraying attack from $Workstation$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: Source_Workstation
- name: Workstation
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -72,9 +74,9 @@ tags:
required_fields:
- _time
- EventCode
- action
- Logon_Account
- Source_Workstation
- Status
- TargetUserName
- Workstation
risk_score: 49
security_domain: endpoint
asset_type: Endpoint
detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml
+14 -14
View File
@@ -24,13 +24,14 @@ description: 'The following analytic identifies a source host failing to authent
The analytics returned fields allow analysts to investigate the event further by
providing fields like source process name, source account and attempted user accounts.'
search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-"
| bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats
dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts
by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts)
as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName
| eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10
and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` '
search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-"
| bucket span=2m _time
| stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer
| eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress, Computer
| eval upperBound=(comp_avg+comp_std*3)
| eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0)
| search isOutlier=1
| `windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter` '
how_to_implement: To successfully implement this search, you need to be ingesting
Windows Event Logs from domain controllers as as well as member servers and workstations.
The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs
@@ -57,15 +58,15 @@ tags:
impact: 70
kill_chain_phases:
- Exploitation
message: Potential password spraying attack on $ComputerName$
message: Potential password spraying attack on $Computer$
mitre_attack_id:
- T1110.003
- T1110
observable:
- name: ComputerName
- name: Computer
type: Endpoint
role:
- Victim
- Attacker
product:
- Splunk Enterprise
- Splunk Enterprise Security
@@ -74,10 +75,9 @@ tags:
- _time
- EventCode
- Logon_Type
- Security_ID
- Account_Name
- ComputerName
- Source_Network_Address
- TargetUserName
- Computer
- IpAddress
risk_score: 49
security_domain: endpoint
asset_type: Endpoint