diff --git a/detections/endpoint/write_executable_in_smb_share.yml b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml similarity index 60% rename from detections/endpoint/write_executable_in_smb_share.yml rename to detections/endpoint/executable_file_written_in_administrative_smb_share.yml index 16363956c9..cea14e9c2d 100644 --- a/detections/endpoint/write_executable_in_smb_share.yml +++ b/detections/endpoint/executable_file_written_in_administrative_smb_share.yml @@ -1,29 +1,37 @@ -name: Write Executable in SMB Share +name: Executable File Written in Administrative SMB Share id: f63c34fe-a435-11eb-935a-acde48001122 -version: 1 -date: '2021-04-23' -author: Teoderick Contreras, Splunk +version: 2 +date: '2021-11-18' +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect suspicious dropping or creating an executable - file in known sensitive SMB share. This technique is commonly used for lateral movement - like how trickbot try to infect other machine in the infected network. This detection - catch the access event (FILE WRITE) access to a share. +description: The following analytic identifies executable files (.exe or .dll) being + written to Windows administrative SMB shares (Admin$, IPC$, C$). This represents + suspicious behavior as its commonly user by tools like like PsExec/PaExec and others + to stage service binaries before creating and starting a Windows service on remote + endpoints. Red Teams and adversaries alike may abuse administrative shares for lateral + movement and remote code execution. The Trickbot malware family also implements + this behavior to try to infect other machines in the infected network. search: '`wineventlog_security` EventCode=5145 Relative_Target_Name IN ("*.exe","*.dll") Object_Type=File Share_Name IN ("\\\\*\\C$","\\\\*\\IPC$","\\\\*\\admin$") Access_Mask= "0x2" | stats min(_time) as firstTime max(_time) as lastTime count by EventCode Share_Name Relative_Target_Name Object_Type Access_Mask user src_port Source_Address - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `write_executable_in_smb_share_filter`' + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `executable_file_written_in_administrative_smb_share_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event Logs with 5145 EventCode enabled. The Windows TA is also required. Also enable the object Audit access success/failure in your group policy. -known_false_positives: unknown +known_false_positives: System Administrators may use looks like PsExec for troubleshooting + or administrations tasks. However, this will typically come only from certain users + and certain systems that can be added to an allow list. references: +- https://attack.mitre.org/techniques/T1021/002/ +- https://www.rapid7.com/blog/post/2013/03/09/psexec-demystified/ - https://labs.vipre.com/trickbot-and-its-modules/ - https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html tags: analytic_story: + - Lateral Movement - Trickbot automated_detection_testing: passed confidence: 100 diff --git a/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml new file mode 100644 index 0000000000..58d8c2ef3c --- /dev/null +++ b/detections/endpoint/interactive_session_on_remote_endpoint_with_powershell.yml @@ -0,0 +1,56 @@ +name: Interactive Session on Remote Endpoint with PowerShell +id: a4e8f3a4-48b2-11ec-bcfc-3e22fbd008af +version: 1 +date: '2021-11-18' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the usage of the `Enter-PSSession`. This commandlet can be used to open + an interactive session on a remote endpoint leveraging the WinRM protocol. + Red Teams and adversaries alike may abuse WinRM and `Enter-PSSession` for lateral movement and remote code execution. +search: 'powershell` EventCode=4104 (Message="*Enter-PSSession*" AND Message="*-ComputerName*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `interactive_session_on_remote_endpoint_with_powershell_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup instructions + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators may leverage WinRM and `Enter-PSSession` for administrative and troubleshooting tasks. + This activity is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible. +references: +- https://attack.mitre.org/techniques/T1021/006/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/enter-pssession?view=powershell-7.2 +tags: + analytic_story: + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021 + - T1021.006 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 90 + confidence: 50 + risk_score: 45 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: An interactive session was opened on a remote endpoint from $ComputerName + observable: + - name: ComputerName + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 16e0546134..70038db580 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -20,7 +20,7 @@ references: - https://www.trimarcsecurity.com/post/trimarcresearch-detecting-kerberoasting-activity tags: analytic_story: - - Lateral Movement + - Windows Privilege Escalation asset_type: Endpoint automated_detection_testing: passed cis20: @@ -34,7 +34,7 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log impact: 90 kill_chain_phases: - - Actions on Objectives + - Privilege Escalation message: Potential kerberoasting attack via service principal name requests detected on $dest$ mitre_attack_id: diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml new file mode 100644 index 0000000000..e2661b19df --- /dev/null +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -0,0 +1,69 @@ +name: Remote Process Instantiation via DCOM and PowerShell +id: d4f42098-4680-11ec-ad07-3e22fbd008af +version: 1 +date: '2021-11-15' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `powershell.exe` with arguments + utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, + this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams + and adversaries alike may abuse DCOM and `powershell.exe` for lateral movement and + remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Document.ActiveView.ExecuteShellCommand*" + OR Processes.process="*Document.Application.ShellExecute*") by Processes.dest Processes.user + Processes.parent_process_name Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| + `security_content_ctime(lastTime)` | `remote_process_instantiation_via_dcom_and_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may leverage DCOM to start a process on remote + systems, but this activity is usually limited to a small set of hosts or users. +references: +- https://attack.mitre.org/techniques/T1021/003/ +- https://www.cybereason.com/blog/dcom-lateral-movement-techniques +tags: + analytic_story: + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021 + - T1021.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 70 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A process was started on a remote endpoint from $dest by abusing DCOM using + PowerShell.exe + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml new file mode 100644 index 0000000000..488ddda2f7 --- /dev/null +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml @@ -0,0 +1,60 @@ +name: Remote Process Instantiation via DCOM and PowerShell Script Block +id: fa1c3040-4680-11ec-a618-3e22fbd008af +version: 1 +date: '2021-11-15' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of PowerShell with arguments utilized to start a process + on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks + for the abuse of ShellExecute and ExecuteShellCommand. Red Teams and adversaries + alike may abuse DCOM for lateral movement and remote code execution. +search: '`powershell` EventCode=4104 (Message="*Document.Application.ShellExecute*" + OR Message="*Document.ActiveView.ExecuteShellCommand*") | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `remote_process_instantiation_via_dcom_and_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup instructions + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators may leverage DCOM to start a process on remote + systems, but this activity is usually limited to a small set of hosts or users. +references: +- https://attack.mitre.org/techniques/T1021/003/ +- https://www.cybereason.com/blog/dcom-lateral-movement-techniques +tags: + analytic_story: + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-powershell.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021 + - T1021.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 90 + confidence: 70 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A process was started on a remote endpoint from $ComputerName by abusing + WMI using PowerShell.exe + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml new file mode 100644 index 0000000000..9aeb221ca4 --- /dev/null +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -0,0 +1,70 @@ +name: Remote Process Instantiation via WinRM and PowerShell +id: ba24cda8-4716-11ec-8009-3e22fbd008af +version: 1 +date: '2021-11-16' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `powershell.exe` with arguments + utilized to start a process on a remote endpoint by abusing the WinRM protocol. + Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. + Red Teams and adversaries alike may abuse WinRM and `powershell.exe` for lateral + movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-Command*" + AND Processes.process="*-ComputerName*") by Processes.dest Processes.user Processes.parent_process_name + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `remote_process_instantiation_via_winrm_and_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start + a process on remote systems for system administration or automation use cases. However, + this activity is usually limited to a small set of hosts or users. +references: +- https://attack.mitre.org/techniques/T1021/006/ +- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ +tags: + analytic_story: + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021 + - T1021.006 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 50 + risk_score: 45 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A process was started on a remote endpoint from $dest by abusing WinRM + using PowerShell.exe + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml new file mode 100644 index 0000000000..56aa9292c0 --- /dev/null +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml @@ -0,0 +1,60 @@ +name: Remote Process Instantiation via WinRM and PowerShell Script Block +id: 7d4c618e-4716-11ec-951c-3e22fbd008af +version: 1 +date: '2021-11-16' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of PowerShell with arguments utilized to start a process + on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks + for the abuse of the `Invoke-Command` commandlet. Red Teams and adversaries alike + may abuse WinRM for lateral movement and remote code execution. +search: '`powershell` EventCode=4104 (Message="*Invoke-Command*" AND Message="*-ComputerName*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_winrm_and_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup instructions + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators may leverage WinRM and `Invoke-Command` to start + a process on remote systems for system administration or automation use cases. This activity + is usually limited to a small set of hosts or users. In certain environments, tuning may not be possible. +references: +- https://attack.mitre.org/techniques/T1021/006/ +- https://pentestlab.blog/2018/05/15/lateral-movement-winrm/ +tags: + analytic_story: + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1021 + - T1021.006 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 90 + confidence: 50 + risk_score: 45 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A process was started on a remote endpoint from $ComputerName by abusing + WinRM using PowerShell.exe + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml new file mode 100644 index 0000000000..5afc5c14fd --- /dev/null +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -0,0 +1,68 @@ +name: Remote Process Instantiation via WMI and PowerShell +id: 112638b4-4634-11ec-b9ab-3e22fbd008af +version: 1 +date: '2021-11-15' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `powershell.exe` leveraging + the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start + a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may + abuse WMI and `powershell.exe` for lateral movement and remote code execution. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process="*Invoke-WmiMethod*" + AND Processes.process="*-CN*" AND Processes.process="*-Class Win32_Process*" AND Processes.process="*-Name + create*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `remote_process_instantiation_via_wmi_and_powershell_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. +known_false_positives: Administrators may leverage WWMI and powershell.exe to start + a process on remote systems, but this activity is usually limited to a small set + of hosts or users. +references: +- https://attack.mitre.org/techniques/T1047/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 +tags: + analytic_story: + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1047 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + security_domain: endpoint + impact: 90 + confidence: 70 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A process was started on a remote endpoint from $dest by abusing WMI using + PowerShell.exe + observable: + - name: dest + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml new file mode 100644 index 0000000000..7307c4ff74 --- /dev/null +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml @@ -0,0 +1,59 @@ +name: Remote Process Instantiation via WMI and PowerShell Script Block +id: 2a048c14-4634-11ec-a618-3e22fbd008af +version: 1 +date: '2021-11-15' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Invoke-WmiMethod` commandlet with arguments utilized + to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries + alike may abuse WMI and this commandlet for lateral movement and remote code execution. +search: '`powershell` EventCode=4104 (Message="*Invoke-WmiMethod*" AND Message="*-CN*" + AND Message="*-Class Win32_Process*" AND Message="*-Name create*") | stats count + min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName + User | `security_content_ctime(firstTime)` | `remote_process_instantiation_via_wmi_and_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup instructions + can be found https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators may leverage WWMI and powershell.exe to start + a process on remote systems, but this activity is usually limited to a small set + of hosts or users. +references: +- https://attack.mitre.org/techniques/T1047/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/invoke-wmimethod?view=powershell-5.1 +tags: + analytic_story: + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log + kill_chain_phases: + - Lateral Movement + mitre_attack_id: + - T1047 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + impact: 90 + confidence: 70 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: A process was started on a remote endpoint from $ComputerName by abusing + WMI using PowerShell.exe + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml index 4b5df4d8ce..6430c8a73b 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml @@ -49,7 +49,6 @@ references: tags: analytic_story: - Active Directory Discovery - - Lateral Movement automated_detection_testing: passed confidence: 100 context: @@ -59,7 +58,7 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-powershell_kerberos.log impact: 80 kill_chain_phases: - - Lateral Movement + - Privilege Escalation message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. mitre_attack_id: diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index ef17a5ca2a..2f456df538 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -56,7 +56,6 @@ references: tags: analytic_story: - Active Directory Discovery - - Lateral Movement automated_detection_testing: passed confidence: 100 context: @@ -66,7 +65,7 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-sysmon_setspn.log impact: 80 kill_chain_phases: - - Lateral Movement + - Privilege Escalation message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to identify service principle names. mitre_attack_id: diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index b34070f242..0091f8b44b 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -47,6 +47,7 @@ tags: - Ransomware - Ryuk Ransomware - IcedID + - Lateral Movement automated_detection_testing: passed confidence: 100 context: diff --git a/tests/endpoint/write_executable_in_smb_share.test.yml b/tests/endpoint/executable_file_written_in_administrative_smb_share.test.yml similarity index 63% rename from tests/endpoint/write_executable_in_smb_share.test.yml rename to tests/endpoint/executable_file_written_in_administrative_smb_share.test.yml index 83a55cd08a..0f5150c79a 100644 --- a/tests/endpoint/write_executable_in_smb_share.test.yml +++ b/tests/endpoint/executable_file_written_in_administrative_smb_share.test.yml @@ -1,7 +1,7 @@ -name: Write Executable in SMB Share Unit Test +name: Executable File Written in Administrative SMB Share Unit Test tests: -- name: Write Executable in SMB Share - file: endpoint/write_executable_in_smb_share.yml +- name: Executable File Written in Administrative SMB Share + file: endpoint/executable_file_written_in_administrative_smb_share.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' diff --git a/tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml b/tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml new file mode 100644 index 0000000000..a4be81cd7e --- /dev/null +++ b/tests/endpoint/interactive_session_on_remote_endpoint_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: Interactive Session on Remote Endpoint with PowerShell Unit Test +tests: +- name: Interactive Session on Remote Endpoint with PowerShell + file: endpoint/interactive_session_on_remote_endpoint_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_pssession/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file diff --git a/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell.test.yml b/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell.test.yml new file mode 100644 index 0000000000..c10e1ed666 --- /dev/null +++ b/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell.test.yml @@ -0,0 +1,12 @@ +name: Remote Process Instantiation via DCOM and PowerShell Unit Test +tests: +- name: Remote Process Instantiation via DCOM and PowerShell + file: endpoint/remote_process_instantiation_via_dcom_and_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.test.yml b/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.test.yml new file mode 100644 index 0000000000..6e140c5b77 --- /dev/null +++ b/tests/endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Remote Process Instantiation via DCOM and PowerShell Script Block Unit Test +tests: +- name: Remote Process Instantiation via DCOM and PowerShell Script Block + file: endpoint/remote_process_instantiation_via_dcom_and_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.003/lateral_movement/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file diff --git a/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell.test.yml b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell.test.yml new file mode 100644 index 0000000000..192a625346 --- /dev/null +++ b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell.test.yml @@ -0,0 +1,12 @@ +name: Remote Process Instantiation via WinRM and PowerShell Unit Test +tests: +- name: Remote Process Instantiation via WinRM and PowerShell + file: endpoint/remote_process_instantiation_via_winrm_and_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml new file mode 100644 index 0000000000..f49a35b3b0 --- /dev/null +++ b/tests/endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Remote Process Instantiation via WinRM and PowerShell Script Block Unit Test +tests: +- name: Remote Process Instantiation via WinRM and PowerShell Script Block + file: endpoint/remote_process_instantiation_via_winrm_and_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021.006/lateral_movement_psh/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file diff --git a/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell.test.yml b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell.test.yml new file mode 100644 index 0000000000..da44fe9229 --- /dev/null +++ b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell.test.yml @@ -0,0 +1,12 @@ +name: Remote Process Instantiation via WMI and PowerShell Unit Test +tests: +- name: Remote Process Instantiation via WMI and PowerShell + file: endpoint/remote_process_instantiation_via_wmi_and_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml new file mode 100644 index 0000000000..f81f9a9953 --- /dev/null +++ b/tests/endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: Remote Process Instantiation via WMI and PowerShell Script Block Unit Test +tests: +- name: Remote Process Instantiation via WMI and PowerShell Script Block + file: endpoint/remote_process_instantiation_via_wmi_and_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1047/lateral_movement/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file