From 27dad59624906a3e8e6995488bc7aaa718eb6f01 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 23 Sep 2022 15:45:24 -0400 Subject: [PATCH] migrating detections to XML --- ...sers_failed_to_authenticate_w_kerberos.yml | 23 ++++++++------- ...rs_fail_to_authenticate_using_kerberos.yml | 23 ++++++++------- ...sers_failed_to_authenticate_using_ntlm.yml | 23 ++++++++------- ...o_authenticate_wth_explicitcredentials.yml | 23 +++++++-------- ...d_to_authenticate_from_host_using_ntlm.yml | 23 ++++++++------- ...rs_failed_to_authenticate_from_process.yml | 23 +++++++-------- ..._failed_to_authenticate_using_kerberos.yml | 23 ++++++++------- ...otely_failed_to_authenticate_from_host.yml | 19 ++++++------- ...d_users_failed_to_authe_using_kerberos.yml | 24 ++++++++-------- ...alid_users_fail_to_auth_using_kerberos.yml | 24 ++++++++-------- ...nvalid_users_failed_to_auth_using_ntlm.yml | 22 ++++++++------- ...s_fail_to_auth_wth_explicitcredentials.yml | 26 ++++++++--------- ...of_users_failed_to_auth_using_kerberos.yml | 24 ++++++++-------- ...rs_failed_to_authenticate_from_process.yml | 28 +++++++++---------- ...sers_failed_to_authenticate_using_ntlm.yml | 24 ++++++++-------- ...sers_remotely_failed_to_auth_from_host.yml | 28 +++++++++---------- 16 files changed, 188 insertions(+), 192 deletions(-) diff --git a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml index 4cbf981c85..98ee9e880f 100644 --- a/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml +++ b/detections/endpoint/windows_multiple_disabled_users_failed_to_authenticate_w_kerberos.yml @@ -22,12 +22,11 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` ' +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | where unique_accounts > 30 + | `windows_multiple_disabled_users_failed_to_authenticate_wth_kerberos_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -52,15 +51,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -68,9 +67,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml index 872842890f..a6135f6d0d 100644 --- a/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_invalid_users_fail_to_authenticate_using_kerberos.yml @@ -23,12 +23,11 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` ' +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | where unique_accounts > 30 + | `windows_multiple_invalid_users_fail_to_authenticate_using_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -53,15 +52,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -69,9 +68,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml index 4ef8dc5bd9..560aa11bf0 100644 --- a/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_invalid_users_failed_to_authenticate_using_ntlm.yml @@ -24,12 +24,11 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure - | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) - as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | where unique_accounts > 30 + | `windows_multiple_invalid_users_failed_to_authenticate_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. @@ -55,15 +54,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential NTLM based password spraying attack from $Source_Workstation$ + message: Potential NTLM based password spraying attack from $Workstation$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Source_Workstation + - name: Workstation type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -71,9 +70,9 @@ tags: required_fields: - _time - EventCode - - action - - Logon_Account - - Source_Workstation + - TargetUserName + - Workstation + - Status risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml index 2d08404dff..d3b6758dd4 100644 --- a/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml +++ b/detections/endpoint/windows_multiple_users_fail_to_authenticate_wth_explicitcredentials.yml @@ -22,14 +22,11 @@ description: 'The following analytic identifies a source user failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.' -search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account - = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) - | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" - | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as - tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` ' +search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$ + | bucket span=5m _time + | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name + | where unique_accounts > 30 + | `windows_multiple_users_fail_to_authenticate_wth_explicitcredentials_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -57,12 +54,12 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack from $ComputerName$ + message: Potential password spraying attack from $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - Victim @@ -73,9 +70,9 @@ tags: required_fields: - _time - EventCode - - Security_ID - - Account_Name - - ComputerName + - Target_User_Name + - Caller_User_Name + - Computer risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml index afcaaaf69e..e01ff2279a 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_host_using_ntlm.yml @@ -22,12 +22,11 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure - | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) - as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`' +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | where unique_accounts > 30 + | `windows_multiple_users_failed_to_authenticate_from_host_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. @@ -53,15 +52,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential NTLM based password spraying attack from $Source_Workstation$ + message: Potential NTLM based password spraying attack from $Workstation$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Source_Workstation + - name: Workstation type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -69,9 +68,9 @@ tags: required_fields: - _time - EventCode - - action - - Logon_Account - - Source_Workstation + - Status + - TargetUserName + - Workstation risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml index 0a88aee126..3e8d59cb2e 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_from_process.yml @@ -22,14 +22,11 @@ description: 'The following analytic identifies a source process name failing to The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" - | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account - = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName | - eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std - by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` ' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-" + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer + | where unique_accounts > 30 + | `windows_multiple_users_failed_to_authenticate_from_process_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -56,7 +53,7 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack from $ComputerName$ + message: Potential password spraying attack from $Computer$ mitre_attack_id: - T1110.003 - T1110 @@ -73,10 +70,10 @@ tags: - _time - EventCode - Logon_Type - - Caller_Process_Name - - Security_ID - - Account_Name - - ComputerName + - ProcessName + - SubjectUserName + - TargetUserName + - Computer risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml index 7ddcb0e365..9a155c03dd 100644 --- a/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml +++ b/detections/endpoint/windows_multiple_users_failed_to_authenticate_using_kerberos.yml @@ -21,12 +21,11 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) - | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`' +search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18 + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | where unique_accounts > 30 + | `windows_multiple_users_failed_to_authenticate_using_kerberos_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -53,15 +52,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -69,9 +68,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml index 7a3307ce62..32c66a3180 100644 --- a/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml +++ b/detections/endpoint/windows_multiple_users_remotely_failed_to_authenticate_from_host.yml @@ -21,13 +21,11 @@ description: 'The following analytic identifies a source host failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" - | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats - dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts - by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName - | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 - and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" + | bucket span=5m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer + | where unique_accounts > 30 + | `windows_multiple_users_remotely_failed_to_authenticate_from_host_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -71,10 +69,9 @@ tags: - _time - EventCode - Logon_Type - - Security_ID - - Account_Name - - ComputerName - - Source_Network_Address + - TargetUserName + - Computer + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml index f98fdbdc96..f8362b4938 100644 --- a/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos.yml @@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Account_Name!="*$" Result_Code=0x12 - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x12 + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_disabled_users_failing_to_authenticate_kerberos_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_disabled_users_failed_to_authe_using_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -56,15 +58,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml index 8b05e3f278..8c9df0b4dd 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos.yml @@ -26,12 +26,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4768 Result_Code=0x6 Account_Name!="*$" - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) +search: '`wineventlog_security` EventCode=4768 TargetUserName!=*$ Status=0x6 + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_invalid_users_failed_authentication_via_kerberos_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_invalid_users_fail_to_auth_using_kerberos_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -56,15 +58,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml index fdd53fc4dd..7da39eaf34 100644 --- a/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm.yml @@ -27,12 +27,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC0000064 action=failure - | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) - as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xc0000064 + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm_filter`' + | search isOutlier=1 + | `windows_unusual_count_of_invalid_users_failed_to_auth_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation' within `Account Logon` needs to be enabled. @@ -63,10 +65,10 @@ tags: - T1110.003 - T1110 observable: - - name: Source_Workstation + - name: Workstation type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -74,9 +76,9 @@ tags: required_fields: - _time - EventCode - - action - - Logon_Account - - Source_Workstation + - TargetUserName + - Workstation + - Status risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml index 88d02656db..a9c5fb5870 100644 --- a/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml +++ b/detections/endpoint/windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials.yml @@ -25,14 +25,14 @@ description: 'The following analytic identifies a source user failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source account, attempted user accounts and the endpoint were the behavior was identified.' -search: ' `wineventlog_security` EventCode=4648 | bucket span=2m _time | eval Source_Account - = mvindex(Account_Name, 0) | eval Destination_Account = mvindex(Account_Name, 1) - | search Source_Account != "*$" Source_Account !="-" Destination_Account !="*$" - | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as - tried_account by _time, ComputerName, Source_Account | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by ComputerName | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4648 Caller_User_Name!=*$ Target_User_Name!=*$ + | bucket span=2m _time + | stats dc(Target_User_Name) AS unique_accounts values(Target_User_Name) as tried_account by _time, Computer, Caller_User_Name + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Computer + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `windows_users_authenticate_using_explicit_credentials_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_users_fail_to_auth_wth_explicitcredentials_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -60,15 +60,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack from $ComputerName$ + message: Potential password spraying attack from $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -76,9 +76,9 @@ tags: required_fields: - _time - EventCode - - Security_ID - - Account_Name - - ComputerName + - Target_User_Name + - Caller_User_Name + - Computer risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml index 74a7c86c14..9dc129d004 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_auth_using_kerberos.yml @@ -24,12 +24,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source ip and attempted user accounts.' -search: '`wineventlog_security` EventCode=4771 Failure_Code=0x18 Account_Name!="*$" - | bucket span=2m _time | stats dc(Account_Name) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Client_Address | eventstats avg(unique_accounts) as - comp_avg , stdev(unique_accounts) as comp_std by Client_Address | eval upperBound=(comp_avg+comp_std*3) +search: '`wineventlog_security` EventCode=4771 TargetUserName!="*$" Status=0x18 + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_kerberos_filter`' + | search isOutlier=1 + | `windows_unusual_count_of_users_failed_to_auth_using_kerberos_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller and Kerberos events. The Advanced Security Audit policy setting `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. @@ -56,15 +58,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential Kerberos based password spraying attack from $Client_Address$ + message: Potential Kerberos based password spraying attack from $IpAddress$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Client_Address + - name: IpAddress type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - Result_Code - - Account_Name - - Client_Address + - Status + - TargetUserName + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml index 2e85c0dfb6..6c0734ccca 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_from_process.yml @@ -25,14 +25,14 @@ description: 'The following analytic identifies a source process name failing to The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 Caller_Process_Name!="-" - | bucket span=2m _time | eval Source_Account = mvindex(Account_Name, 0) | eval Destination_Account - = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Account_Name) - as tried_accounts by _time, Caller_Process_Name, Source_Account, ComputerName | - eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std - by Caller_Process_Name, Source_Account, ComputerName | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4625 Logon_Type=2 ProcessName!="-" + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, ProcessName, SubjectUserName, Computer + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by ProcessName, SubjectUserName, Computer + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_process_filter` ' + | search isOutlier=1 + | `windows_unusual_count_of_users_failed_to_authenticate_from_process_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers aas well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -59,15 +59,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack from $ComputerName$ + message: Potential password spraying attack from $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -76,10 +76,10 @@ tags: - _time - EventCode - Logon_Type - - Caller_Process_Name - - Security_ID - - Account_Name - - ComputerName + - ProcessName + - SubjectUserName + - TargetUserName + - Computer risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml index 3e49a28f17..acf144f72f 100644 --- a/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml +++ b/detections/endpoint/windows_unusual_count_of_users_failed_to_authenticate_using_ntlm.yml @@ -25,12 +25,14 @@ description: 'The following analytic identifies one source endpoint failing to a The analytics returned fields allow analysts to investigate the event further by providing fields like source workstation name and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4776 Logon_Account!="*$" 0xC000006A action=failure - | bucket span=2m _time | stats dc(Logon_Account) AS unique_accounts values(Logon_Account) - as tried_accounts by _time, Source_Workstation | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Workstation | eval upperBound=(comp_avg+comp_std*3) +search: ' `wineventlog_security` EventCode=4776 TargetUserName!=*$ Status=0xC000006A + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, Workstation + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Workstation + | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) - | search isOutlier=1 | `multiple_users_failing_to_authenticate_from_host_using_ntlm_filter`' + | search isOutlier=1 + | `windows_unusual_count_of_users_failed_to_authenticate_using_ntlm_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Domain Controller events. The Advanced Security Audit policy setting `Audit Credential Validation` within `Account Logon` needs to be enabled. @@ -56,15 +58,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential NTLM based password spraying attack from $Source_Workstation$ + message: Potential NTLM based password spraying attack from $Workstation$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: Source_Workstation + - name: Workstation type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -72,9 +74,9 @@ tags: required_fields: - _time - EventCode - - action - - Logon_Account - - Source_Workstation + - Status + - TargetUserName + - Workstation risk_score: 49 security_domain: endpoint asset_type: Endpoint diff --git a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml index 6917673182..ed6b3d32e2 100644 --- a/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml +++ b/detections/endpoint/windows_unusual_count_of_users_remotely_failed_to_auth_from_host.yml @@ -24,13 +24,14 @@ description: 'The following analytic identifies a source host failing to authent The analytics returned fields allow analysts to investigate the event further by providing fields like source process name, source account and attempted user accounts.' -search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" - | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats - dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts - by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts) - as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName - | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 - and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` ' +search: ' `wineventlog_security` EventCode=4625 Logon_Type=3 IpAddress!="-" + | bucket span=2m _time + | stats dc(TargetUserName) AS unique_accounts values(TargetUserName) as tried_accounts by _time, IpAddress, Computer + | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by IpAddress, Computer + | eval upperBound=(comp_avg+comp_std*3) + | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) + | search isOutlier=1 + | `windows_unusual_count_of_users_remotely_failed_to_auth_from_host_filter` ' how_to_implement: To successfully implement this search, you need to be ingesting Windows Event Logs from domain controllers as as well as member servers and workstations. The Advanced Security Audit policy setting `Audit Logon` within `Logon/Logoff` needs @@ -57,15 +58,15 @@ tags: impact: 70 kill_chain_phases: - Exploitation - message: Potential password spraying attack on $ComputerName$ + message: Potential password spraying attack on $Computer$ mitre_attack_id: - T1110.003 - T1110 observable: - - name: ComputerName + - name: Computer type: Endpoint role: - - Victim + - Attacker product: - Splunk Enterprise - Splunk Enterprise Security @@ -74,10 +75,9 @@ tags: - _time - EventCode - Logon_Type - - Security_ID - - Account_Name - - ComputerName - - Source_Network_Address + - TargetUserName + - Computer + - IpAddress risk_score: 49 security_domain: endpoint asset_type: Endpoint