From c91fa6e5c5ad1f2fe4672c0ac1cccb67057c8a7f Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 26 Aug 2021 15:45:47 -0400 Subject: [PATCH 01/22] adding first four --- .../domain_group_discovery_with_net.yml | 51 +++++++++++++++++ .../domain_group_discovery_with_wmic.yml | 52 ++++++++++++++++++ .../elevated_group_discovery_with_net.yml | 55 +++++++++++++++++++ .../elevated_group_discovery_with_wmic.yml | 55 +++++++++++++++++++ .../domain_group_discovery_with_net.test.yml | 12 ++++ .../domain_group_discovery_with_wmic.test.yml | 12 ++++ ...elevated_group_discovery_with_net.test.yml | 12 ++++ ...levated_group_discovery_with_wmic.test.yml | 12 ++++ 8 files changed, 261 insertions(+) create mode 100644 detections/endpoint/domain_group_discovery_with_net.yml create mode 100644 detections/endpoint/domain_group_discovery_with_wmic.yml create mode 100644 detections/endpoint/elevated_group_discovery_with_net.yml create mode 100644 detections/endpoint/elevated_group_discovery_with_wmic.yml create mode 100644 tests/endpoint/domain_group_discovery_with_net.test.yml create mode 100644 tests/endpoint/domain_group_discovery_with_wmic.test.yml create mode 100644 tests/endpoint/elevated_group_discovery_with_net.test.yml create mode 100644 tests/endpoint/elevated_group_discovery_with_wmic.test.yml diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml new file mode 100644 index 0000000000..ab985e9a06 --- /dev/null +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -0,0 +1,51 @@ +name: Domain Group Discovery With Net +id: f2f14ac7-fa81-471a-80d5-7eb65c3c7349 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic looks for the execution of `net.exe` with command-line + arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. + Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") + (Processes.process=*group* AND Processes.process=*/do*) by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_net_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml new file mode 100644 index 0000000000..29f9666da5 --- /dev/null +++ b/detections/endpoint/domain_group_discovery_with_wmic.yml @@ -0,0 +1,52 @@ +name: Domain Group Discovery With Wmic +id: a87736a6-95cd-4728-8689-3c64d5026b3e +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic looks for the execution of `wmic.exe` with command-line + arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. + Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") + (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_group* AND Processes.process="*GET ds_samaccountname*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml new file mode 100644 index 0000000000..aed55cc55a --- /dev/null +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -0,0 +1,55 @@ +name: Elevated Group Discovery With Net +id: a23a0e20-0b1b-4a07-82e5-ec5f70811e7a +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line + arguments utilized to query for specific elevated domain groups. + Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") + (Processes.process="*group*" AND Processes.process="*/do*") (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" + OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns Admins*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_net_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://adsecurity.org/?p=3658 +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 70 + risk_score: 21 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Elevated domain group discovery enumeration on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml new file mode 100644 index 0000000000..f7928e4885 --- /dev/null +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -0,0 +1,55 @@ +name: Elevated Group Discovery With Wmic +id: 3f6bbf22-093e-4cb4-9641-83f47b8444b6 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `wmic.exe` with command-line + arguments utilized to query for specific domain groups. + Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") + (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap*) (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema Admins*" + OR Processes.process="*Account Operators*" OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns Admins*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_wmic_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://adsecurity.org/?p=3658 +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 70 + risk_score: 21 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Elevated domain group discovery enumeration on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/domain_group_discovery_with_net.test.yml b/tests/endpoint/domain_group_discovery_with_net.test.yml new file mode 100644 index 0000000000..c74501e388 --- /dev/null +++ b/tests/endpoint/domain_group_discovery_with_net.test.yml @@ -0,0 +1,12 @@ +name: Domain Group Discovery With Net Unit Test +tests: +- name: Domain Group Discovery With Net + file: endpoint/domain_group_discovery_with_net.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/domain_group_discovery_with_wmic.test.yml b/tests/endpoint/domain_group_discovery_with_wmic.test.yml new file mode 100644 index 0000000000..a7f8f7f998 --- /dev/null +++ b/tests/endpoint/domain_group_discovery_with_wmic.test.yml @@ -0,0 +1,12 @@ +name: Domain Group Discovery With Wmic Unit Test +tests: +- name: Domain Group Discovery With Wmic + file: endpoint/domain_group_discovery_with_wmic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/elevated_group_discovery_with_net.test.yml b/tests/endpoint/elevated_group_discovery_with_net.test.yml new file mode 100644 index 0000000000..c57ff3e2d5 --- /dev/null +++ b/tests/endpoint/elevated_group_discovery_with_net.test.yml @@ -0,0 +1,12 @@ +name: Elevated Group Discovery With Net Unit Test +tests: +- name: Elevated Group Discovery With Net + file: endpoint/elevated_group_discovery_with_net.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/elevated_group_discovery_with_wmic.test.yml b/tests/endpoint/elevated_group_discovery_with_wmic.test.yml new file mode 100644 index 0000000000..91c6617160 --- /dev/null +++ b/tests/endpoint/elevated_group_discovery_with_wmic.test.yml @@ -0,0 +1,12 @@ +name: Elevated Group Discovery With WmicUnit Test +tests: +- name: Elevated Group Discovery With Wmic + file: endpoint/elevated_group_discovery_with_wmic.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1060.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From d963b2a6bc3f3b4629cdfbdaa3e90adf55beddeb Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 27 Aug 2021 11:54:37 -0400 Subject: [PATCH 02/22] adding 3 detections --- ...main_group_discovery_with_adsisearcher.yml | 50 +++++++++++++++++++ ...etadgroup_with_powershell_script_block.yml | 50 +++++++++++++++++++ ..._ds_group_with_powershell_script_block.yml | 50 +++++++++++++++++++ ...group_discovery_with_adsisearcher.test.yml | 12 +++++ ...roup_with_powershell_script_block.test.yml | 12 +++++ ...roup_with_powershell_script_block.test.yml | 12 +++++ 6 files changed, 186 insertions(+) create mode 100644 detections/endpoint/domain_group_discovery_with_adsisearcher.yml create mode 100644 detections/endpoint/getadgroup_with_powershell_script_block.yml create mode 100644 detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml create mode 100644 tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml create mode 100644 tests/endpoint/getadgroup_with_powershell_script_block.test.yml create mode 100644 tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml new file mode 100644 index 0000000000..9fa1f3abf9 --- /dev/null +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -0,0 +1,50 @@ +name: Domain Group Discovery with Adsisearcher +id: 089c862f-5f83-49b5-b1c8-7e4ff66560c7 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. + Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*(objectcategory=group)*" AND Message = "*findAll()*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `domain_group_discovery_with_adsisearcher_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 60 + risk_score: 18 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml new file mode 100644 index 0000000000..d8cc186336 --- /dev/null +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -0,0 +1,50 @@ +name: GetAdGroup with PowerShell Script Block +id: e4c73d68-794b-468d-b4d0-dac1772bbae7 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. + Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message = "*Get-ADGroup*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `getadgroup_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml new file mode 100644 index 0000000000..f726fdf176 --- /dev/null +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -0,0 +1,50 @@ +name: GetWmiObject Ds Group with PowerShell Script Block +id: 67740bd3-1506-469c-b91d-effc322cc6e5 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. + Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_group"*) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration using PowerShell on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml b/tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml new file mode 100644 index 0000000000..1a7c735731 --- /dev/null +++ b/tests/endpoint/domain_group_discovery_with_adsisearcher.test.yml @@ -0,0 +1,12 @@ +name: Domain Group Discovery with Adsisearcher Unit Test +tests: +- name: Domain Group Discovery with Adsisearcher + file: endpoint/domain_group_discovery_with_adsisearcher.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file diff --git a/tests/endpoint/getadgroup_with_powershell_script_block.test.yml b/tests/endpoint/getadgroup_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..0a44e078a7 --- /dev/null +++ b/tests/endpoint/getadgroup_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: GetAdGroup with PowerShell Script Block Unit Test +tests: +- name: GetAdGroup with PowerShell Script Block + file: endpoint/getadgroup_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file diff --git a/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml b/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..0e862eae33 --- /dev/null +++ b/tests/endpoint/getwmiobject_ds_group_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: GetWmiObject Ds Group with PowerShell Script Block Unit Test +tests: +- name: GetWmiObject Ds Group with PowerShell Script Block + file: endpoint/getwmiobject_ds_group_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file From 8467864cffd7cf23f92b0f6431d08910bc72f159 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 27 Aug 2021 13:51:42 -0400 Subject: [PATCH 03/22] adding 2 detections --- ...levated_group_discovery_with_powerview.yml | 54 +++++++++++++++++++ ...maingroup_with_powershell_script_block.yml | 51 ++++++++++++++++++ ...ed_group_discovery_with_powerview.test.yml | 12 +++++ ...roup_with_powershell_script_block.test.yml | 12 +++++ 4 files changed, 129 insertions(+) create mode 100644 detections/endpoint/elevated_group_discovery_with_powerview.yml create mode 100644 detections/endpoint/getdomaingroup_with_powershell_script_block.yml create mode 100644 tests/endpoint/elevated_group_discovery_with_powerview.test.yml create mode 100644 tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml new file mode 100644 index 0000000000..d37a7eeafc --- /dev/null +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -0,0 +1,54 @@ +name: Elevated Group Discovery with PowerView +id: 10d62950-0de5-4199-a710-cff9ea79b413 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. + As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. + Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMemeber*") + AND Message IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `elevated_group_discovery_with_powerview_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerView for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroupMember/ +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://attack.mitre.org/techniques/T1069/002/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 70 + risk_score: 21 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Elevated group discovery using PowerView on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml new file mode 100644 index 0000000000..8500094cf3 --- /dev/null +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -0,0 +1,51 @@ +name: GetDomainGroup with PowerShell Script Block +id: 09725404-a44f-4ed3-9efa-8ed5d69e4c53 +version: 1 +date: '2021-08-26' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. + As the name suggests, `Get-DomainGroup` is used to query domain groups. + Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroup*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: Administrators or power users may use this PowerView functions for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration using PowerView on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/elevated_group_discovery_with_powerview.test.yml b/tests/endpoint/elevated_group_discovery_with_powerview.test.yml new file mode 100644 index 0000000000..afa8c5cfae --- /dev/null +++ b/tests/endpoint/elevated_group_discovery_with_powerview.test.yml @@ -0,0 +1,12 @@ +name: Elevated Group Discovery with PowerViewUnit Test +tests: +- name: Elevated Group Discovery with PowerView + file: endpoint/elevated_group_discovery_with_powerview.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file diff --git a/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml b/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml new file mode 100644 index 0000000000..569c34fb55 --- /dev/null +++ b/tests/endpoint/getdomaingroup_with_powershell_script_block.test.yml @@ -0,0 +1,12 @@ +name: GetDomainGroup with PowerShell Script Block Unit Test +tests: +- name: GetDomainGroup with PowerShell Script Block + file: endpoint/getdomaingroup_with_powershell_script_block.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: wineventlog \ No newline at end of file From 411f4c9950cf69b00d6b53e078c659b39c2a4a1d Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 30 Aug 2021 16:39:15 -0400 Subject: [PATCH 04/22] adding 3 more detections --- .../endpoint/getadgroup_with_powershell.yml | 52 ++++++++++++++++++ .../getdomaingroup_with_powershell.yml | 52 ++++++++++++++++++ .../getwmiobject_ds_group_with_powershell.yml | 54 +++++++++++++++++++ .../getadgroup_with_powershell.test.yml | 12 +++++ .../getdomaingroup_with_powershell.test.yml | 12 +++++ ...miobject_ds_group_with_powershell.test.yml | 12 +++++ 6 files changed, 194 insertions(+) create mode 100644 detections/endpoint/getadgroup_with_powershell.yml create mode 100644 detections/endpoint/getdomaingroup_with_powershell.yml create mode 100644 detections/endpoint/getwmiobject_ds_group_with_powershell.yml create mode 100644 tests/endpoint/getadgroup_with_powershell.test.yml create mode 100644 tests/endpoint/getdomaingroup_with_powershell.test.yml create mode 100644 tests/endpoint/getwmiobject_ds_group_with_powershell.test.yml diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml new file mode 100644 index 0000000000..ba5f5d1d4b --- /dev/null +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -0,0 +1,52 @@ +name: GetAdGroup with PowerShell +id: 872e3063-0fc4-4e68-b2f3-f2b99184a708 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic looks for the execution of `powershell.exe` with command-line + arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. + Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") + (Processes.process=*Get-AdGroup*) by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadgroup_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml new file mode 100644 index 0000000000..7dde3fd22f --- /dev/null +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -0,0 +1,52 @@ +name: GetDomainGroup with PowerShell +id: 93c94be3-bead-4a60-860f-77ca3fe59903 +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `powershell.exe` with command-line + arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. + Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") + (Processes.process=*Get-DomainGroup*) by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaingroup_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery with PowerView on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml new file mode 100644 index 0000000000..7e39a0b3a5 --- /dev/null +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -0,0 +1,54 @@ +name: GetWmiObject Ds Group with PowerShell +id: df275a44-4527-443b-b884-7600e066e3eb +version: 1 +date: '2021-08-25' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: This analytic looks for the execution of `powershell.exe` with command-line + arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. + Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") + (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*" AND Processes.process="*class ds_group*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_group_with_powershell_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 + +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/getadgroup_with_powershell.test.yml b/tests/endpoint/getadgroup_with_powershell.test.yml new file mode 100644 index 0000000000..460b02ca32 --- /dev/null +++ b/tests/endpoint/getadgroup_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: GetAdGroup with PowerShell Unit Test +tests: +- name: GetAdGroup with PowerShell + file: endpoint/getadgroup_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/getdomaingroup_with_powershell.test.yml b/tests/endpoint/getdomaingroup_with_powershell.test.yml new file mode 100644 index 0000000000..303ec60e3d --- /dev/null +++ b/tests/endpoint/getdomaingroup_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: GetDomainGroup with PowerShell Unit Test +tests: +- name: GetDomainGroup with PowerShell + file: endpoint/getdomaingroup_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/getwmiobject_ds_group_with_powershell.test.yml b/tests/endpoint/getwmiobject_ds_group_with_powershell.test.yml new file mode 100644 index 0000000000..24225be9c0 --- /dev/null +++ b/tests/endpoint/getwmiobject_ds_group_with_powershell.test.yml @@ -0,0 +1,12 @@ +name: GetWmiObject Ds Group with PowerShell Unit Test +tests: +- name: GetWmiObject Ds Group with PowerShell + file: endpoint/getwmiobject_ds_group_with_powershell.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 503ce68ee18331e63852257aaf47701b0a1aa3c1 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Wed, 1 Sep 2021 16:24:04 -0400 Subject: [PATCH 05/22] adding an extra detections --- .../domain_group_discovery_with_dsquery.yml | 52 +++++++++++++++++++ ...main_group_discovery_with_dsquery.test.yml | 12 +++++ 2 files changed, 64 insertions(+) create mode 100644 detections/endpoint/domain_group_discovery_with_dsquery.yml create mode 100644 tests/endpoint/domain_group_discovery_with_dsquery.test.yml diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml new file mode 100644 index 0000000000..287f8d82fb --- /dev/null +++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml @@ -0,0 +1,52 @@ +name: Domain Group Discovery With Dsquery +id: f0c9d62f-a232-4edd-b17e-bc409fb133d4 +version: 1 +date: '2021-09-01' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: This analytic looks for the execution of `dsquery.exe` with command-line + arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. + Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe") + (Processes.process="*group*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_dsquery_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Administrators or power users may use this command for troubleshooting. +references: +- https://attack.mitre.org/techniques/T1069/002/ +tags: + analytic_story: + - Active Directory Discovery + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1069.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + security_domain: endpoint + impact: 30 + confidence: 50 + risk_score: 15 + context: + - Source:Endpoint + - Stage:Discovery + - Stage:Recon + message: Domain group discovery enumeration on $dest$ by $user$ + observable: + - name: dest + type: Endpoint + role: + - Victim \ No newline at end of file diff --git a/tests/endpoint/domain_group_discovery_with_dsquery.test.yml b/tests/endpoint/domain_group_discovery_with_dsquery.test.yml new file mode 100644 index 0000000000..befd87f9f1 --- /dev/null +++ b/tests/endpoint/domain_group_discovery_with_dsquery.test.yml @@ -0,0 +1,12 @@ +name: Domain Group Discovery With Dsquery Unit Test +tests: +- name: Domain Group Discovery With Dsquery + file: endpoint/domain_group_discovery_with_dsquery.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file From 93c7166e8caedd24e84ec50fa238c3e259de8059 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 00:34:04 +0000 Subject: [PATCH 06/22] Added detection testing service results inDomain Group Discovery with Adsisearcher --- ...domain_group_discovery_with_adsisearcher.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index 9fa1f3abf9..c3fbfb909f 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -7,18 +7,20 @@ type: TTP datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the `[Adsisearcher]` type accelerator being used to query Active Directory for domain groups. - Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate domain groups for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*(objectcategory=group)*" AND Message = "*findAll()*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `domain_group_discovery_with_adsisearcher_filter`' + to identify the `[Adsisearcher]` type accelerator being used to query Active Directory + for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate + domain groups for situational awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message = "*[adsisearcher]*" AND Message = "*(objectcategory=group)*" + AND Message = "*findAll()*") | stats count min(_time) as firstTime max(_time) as + lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `domain_group_discovery_with_adsisearcher_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. known_false_positives: Administrators or power users may use Adsisearcher for troubleshooting. references: - https://attack.mitre.org/techniques/T1069/002/ -- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ +- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ tags: analytic_story: - Active Directory Discovery @@ -47,4 +49,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From fe8287f7d4722514e8f9171c619dbc52e9b11e09 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 01:40:32 +0000 Subject: [PATCH 07/22] Added detection testing service results inDomain Group Discovery with Adsisearcher From 2d60937410ce44e923baf9eaeb54dd125c7c050b Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 10 Sep 2021 09:32:18 -0400 Subject: [PATCH 08/22] fixing detection --- detections/endpoint/elevated_group_discovery_with_powerview.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml index d37a7eeafc..4ae7bdc49b 100644 --- a/detections/endpoint/elevated_group_discovery_with_powerview.yml +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -10,7 +10,7 @@ description: The following analytic utilizes PowerShell Script Block Logging (Ev to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. -search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMemeber*") +search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `elevated_group_discovery_with_powerview_filter`' From 937fb3ebd3b7288e2bf078ac129f4802a3438f39 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 14:30:29 +0000 Subject: [PATCH 09/22] Added detection testing service results inDomain Group Discovery With Dsquery --- .../domain_group_discovery_with_dsquery.yml | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml index 287f8d82fb..9edaf59de2 100644 --- a/detections/endpoint/domain_group_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml @@ -7,14 +7,15 @@ type: Hunting datamodel: - Endpoint description: This analytic looks for the execution of `dsquery.exe` with command-line - arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. - Red Teams and adversaries alike use may leverage dsquery.exe to enumerate domain groups for situational awareness and Active Directory Discovery. + arguments utilized to query for domain groups. The argument `group`, returns a list + of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe + to enumerate domain groups for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe") - (Processes.process="*group*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_dsquery_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="dsquery.exe") + (Processes.process="*group*") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `domain_group_discovery_with_dsquery_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -49,4 +50,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From eebd1ac1ccfb767e4722c36cb29c4931950e4a91 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 14:53:07 +0000 Subject: [PATCH 10/22] Added detection testing service results inDomain Group Discovery With Net --- .../endpoint/domain_group_discovery_with_net.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index ab985e9a06..a42b221cc1 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -7,11 +7,13 @@ type: Hunting datamodel: - Endpoint description: This analytic looks for the execution of `net.exe` with command-line - arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. - Red Teams and adversaries alike use net.exe to enumerate domain groups for situational awareness and Active Directory Discovery. + arguments utilized to query for domain groups. The argument `group /domain`, returns + a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate + domain groups for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") - (Processes.process=*group* AND Processes.process=*/do*) by Processes.dest Processes.user Processes.parent_process Processes.process_name + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" + OR Processes.process_name="net1.exe") (Processes.process=*group* AND Processes.process=*/do*) + by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_net_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -48,4 +50,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 5bddb9ef4ec137651e0cb25c853ada31977c2898 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 15:18:41 +0000 Subject: [PATCH 11/22] Added detection testing service results inDomain Group Discovery With Wmic --- .../domain_group_discovery_with_wmic.yml | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml index 29f9666da5..4ad12c55bf 100644 --- a/detections/endpoint/domain_group_discovery_with_wmic.yml +++ b/detections/endpoint/domain_group_discovery_with_wmic.yml @@ -7,14 +7,16 @@ type: Hunting datamodel: - Endpoint description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. - Red Teams and adversaries alike use wmic.exe to enumerate domain groups for situational awareness and Active Directory Discovery. + arguments utilized to query for domain groups. The arguments utilized in this command + return a list of all domain groups. Red Teams and adversaries alike use wmic.exe + to enumerate domain groups for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") - (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_group* AND Processes.process="*GET ds_samaccountname*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") + (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap* AND Processes.process=*ds_group* + AND Processes.process="*GET ds_samaccountname*") by Processes.dest Processes.user + Processes.parent_process Processes.process_name Processes.process Processes.process_id + Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `domain_group_discovery_with_wmic_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -49,4 +51,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 20ab50e311cc17db79ed035fb5f30c6f0149bb07 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 15:36:08 +0000 Subject: [PATCH 12/22] Added detection testing service results inElevated Group Discovery With Net --- .../elevated_group_discovery_with_net.yml | 28 +++++++++++-------- 1 file changed, 17 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml index aed55cc55a..8f9be7353e 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -6,23 +6,28 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line - arguments utilized to query for specific elevated domain groups. - Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. +description: This analytic looks for the execution of `net.exe` or `net1.exe` with + command-line arguments utilized to query for specific elevated domain groups. Red + Teams and adversaries alike use net.exe to enumerate elevated domain groups for + situational awareness and Active Directory Discovery to identify high privileged + users. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") - (Processes.process="*group*" AND Processes.process="*/do*") (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" - OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns Admins*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_net_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" + OR Processes.process_name="net1.exe") (Processes.process="*group*" AND Processes.process="*/do*") + (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise Admins*" + OR Processes.process="*Schema Admins*" OR Processes.process="*Account Operators*" + OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" + OR Processes.process="*Dns Admins*") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `elevated_group_discovery_with_net_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory - https://adsecurity.org/?p=3658 tags: analytic_story: @@ -52,4 +57,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From cb381af6bae7fa56a5fdc9d7caa445ee3012dcfe Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 16:00:25 +0000 Subject: [PATCH 13/22] Added detection testing service results inElevated Group Discovery with PowerView --- ...levated_group_discovery_with_powerview.yml | 23 +++++++++++-------- 1 file changed, 14 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml index 4ae7bdc49b..768c73b799 100644 --- a/detections/endpoint/elevated_group_discovery_with_powerview.yml +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -7,13 +7,17 @@ type: Hunting datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. - As the name suggests, `Get-DomainGroupMember` is used to list the members of an specific domain group. - Red Teams and adversaries alike use PowerView to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. -search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") - AND Message IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" , "*Server Operators*", "*Protected Users*", "*Dns Admins*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `elevated_group_discovery_with_powerview_filter`' + to identify the execution of the `Get-DomainGroupMember` commandlet. `Get-DomainGroupMember` + is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. + As the name suggests, `Get-DomainGroupMember` is used to list the members of an + specific domain group. Red Teams and adversaries alike use PowerView to enumerate + elevated domain groups for situational awareness and Active Directory Discovery + to identify high privileged users. +search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroupMember*") AND Message + IN ("*Domain Admins*","*Enterprise Admins*", "*Schema Admins*", "*Account Operators*" + , "*Server Operators*", "*Protected Users*", "*Dns Admins*") | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `elevated_group_discovery_with_powerview_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -22,7 +26,7 @@ references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroupMember/ - https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory -- https://attack.mitre.org/techniques/T1069/002/ +- https://attack.mitre.org/techniques/T1069/002/ tags: analytic_story: - Active Directory Discovery @@ -51,4 +55,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 3fcdb20c519e4600629bed22f91b6caaedc3a16a Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 10 Sep 2021 12:34:18 -0400 Subject: [PATCH 14/22] fixing minor issue with dataset URL --- tests/endpoint/elevated_group_discovery_with_wmic.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/elevated_group_discovery_with_wmic.test.yml b/tests/endpoint/elevated_group_discovery_with_wmic.test.yml index 91c6617160..77b45b227d 100644 --- a/tests/endpoint/elevated_group_discovery_with_wmic.test.yml +++ b/tests/endpoint/elevated_group_discovery_with_wmic.test.yml @@ -7,6 +7,6 @@ tests: latest_time: 'now' attack_data: - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1060.002/AD_discovery/windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1069.002/AD_discovery/windows-sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog \ No newline at end of file From a656d3e187a9d44a5f692e628a3b149bf91099c2 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 16:50:32 +0000 Subject: [PATCH 15/22] Added detection testing service results inGetAdGroup with PowerShell Script Block --- ...getadgroup_with_powershell_script_block.yml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index d8cc186336..fd766155a8 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -7,15 +7,18 @@ type: Hunting datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet is used to return a list of all domain groups. - Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message = "*Get-ADGroup*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `getadgroup_with_powershell_script_block_filter`' + to identify the execution of the `Get-AdGroup` commandlet. The `Get-AdGroup` commandlet + is used to return a list of all domain groups. Red Teams and adversaries may leverage + this commandlet to enumerate domain groups for situational awareness and Active + Directory Discovery. +search: '`powershell` EventCode=4104 (Message = "*Get-ADGroup*") | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `getadgroup_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. references: - https://attack.mitre.org/techniques/T1069/002/ - https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps @@ -47,4 +50,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From e9ca2c0a77cb46ebf01922bffa8ab1cf631d453c Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 16:52:07 +0000 Subject: [PATCH 16/22] Added detection testing service results inElevated Group Discovery With Wmic --- .../elevated_group_discovery_with_wmic.yml | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml index f7928e4885..e45685e70c 100644 --- a/detections/endpoint/elevated_group_discovery_with_wmic.yml +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -7,13 +7,16 @@ type: TTP datamodel: - Endpoint description: This analytic looks for the execution of `wmic.exe` with command-line - arguments utilized to query for specific domain groups. - Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness and Active Directory Discovery to identify high privileged users. + arguments utilized to query for specific domain groups. Red Teams and adversaries + alike use net.exe to enumerate elevated domain groups for situational awareness + and Active Directory Discovery to identify high privileged users. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") - (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap*) (Processes.process="*Domain Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema Admins*" - OR Processes.process="*Account Operators*" OR Processes.process="*Server Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns Admins*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="wmic.exe") + (Processes.process=*/NAMESPACE:\\\\root\\directory\\ldap*) (Processes.process="*Domain + Admins*" OR Processes.process="*Enterprise Admins*" OR Processes.process="*Schema + Admins*" OR Processes.process="*Account Operators*" OR Processes.process="*Server + Operators*" OR Processes.process="*Protected Users*" OR Processes.process="*Dns + Admins*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `elevated_group_discovery_with_wmic_filter`' how_to_implement: To successfully implement this search you need to be ingesting information @@ -22,7 +25,7 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory +- https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/appendix-b--privileged-accounts-and-groups-in-active-directory - https://adsecurity.org/?p=3658 tags: analytic_story: @@ -52,4 +55,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From ff3b66af5348239971c64103a6fd5ae95f98a784 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 16:53:02 +0000 Subject: [PATCH 17/22] Added detection testing service results inGetDomainGroup with PowerShell --- .../getdomaingroup_with_powershell.yml | 18 +++++++++++------- 1 file changed, 11 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index 7dde3fd22f..be8447a7d9 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -7,13 +7,16 @@ type: TTP datamodel: - Endpoint description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. - Red Teams and adversaries alike may leverage PowerView to enumerate domain groups for situational awareness and Active Directory Discovery. + arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, + a PowerShell tool used to perform enumeration on Windows domains. Red Teams and + adversaries alike may leverage PowerView to enumerate domain groups for situational + awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") - (Processes.process=*Get-DomainGroup*) by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getdomaingroup_with_powershell_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") + (Processes.process=*Get-DomainGroup*) by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `getdomaingroup_with_powershell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -49,4 +52,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From e6b5c603b8faa9f3758d736215c4d0a1b218ebad Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 16:57:11 +0000 Subject: [PATCH 18/22] Added detection testing service results inGetAdGroup with PowerShell --- .../endpoint/getadgroup_with_powershell.yml | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index ba5f5d1d4b..a6520b1b91 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -7,20 +7,23 @@ type: Hunting datamodel: - Endpoint description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. - Red Teams and adversaries alike may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. + arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is + used to return a list of all groups available in a Windows Domain. Red Teams and + adversaries alike may leverage this commandlet to enumerate domain groups for situational + awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") - (Processes.process=*Get-AdGroup*) by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getadgroup_with_powershell_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") + (Processes.process=*Get-AdGroup*) by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `getadgroup_with_powershell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-adgroup?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery @@ -49,4 +52,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 4b038ff4df1aed9269bbf9209d15a4887172a1bb Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 17:14:02 +0000 Subject: [PATCH 19/22] Added detection testing service results inGetWmiObject Ds Group with PowerShell --- .../getwmiobject_ds_group_with_powershell.yml | 22 +++++++++++-------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml index 7e39a0b3a5..a25dd46e02 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -7,14 +7,18 @@ type: TTP datamodel: - Endpoint description: This analytic looks for the execution of `powershell.exe` with command-line - arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups in a Windows domain. - Red Teams and adversaries alike may leverage WMI in this case, using PowerShell, to enumerate domain groups for situational awareness and Active Directory Discovery. + arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined + with the `-class ds_group` parameter can be used to return the full list of groups + in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, + using PowerShell, to enumerate domain groups for situational awareness and Active + Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") - (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*" AND Processes.process="*class ds_group*") - by Processes.dest Processes.user Processes.parent_process Processes.process_name - Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `getwmiobject_ds_group_with_powershell_filter`' + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="powershell.exe") + (Processes.process=*Get-WmiObject* AND Processes.process="*namespace root\\directory\\ldap*" + AND Processes.process="*class ds_group*") by Processes.dest Processes.user Processes.parent_process + Processes.process_name Processes.process Processes.process_id Processes.parent_process_id + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `getwmiobject_ds_group_with_powershell_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -22,7 +26,6 @@ known_false_positives: Administrators or power users may use this command for tr references: - https://attack.mitre.org/techniques/T1069/002/ - https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 - tags: analytic_story: - Active Directory Discovery @@ -51,4 +54,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 56b8a29465dc2901fc64f49e2a9a7cc38b5a8fce Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 17:14:08 +0000 Subject: [PATCH 20/22] Added detection testing service results inGetDomainGroup with PowerShell Script Block --- ...maingroup_with_powershell_script_block.yml | 20 +++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index 8500094cf3..8e66d86efc 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -7,16 +7,19 @@ type: TTP datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. - As the name suggests, `Get-DomainGroup` is used to query domain groups. - Red Teams and adversaries may leverage this function to enumerate domain groups for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroup*") - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`' + to identify the execution of the `Get-DomainGroup` commandlet. `Get-DomainGroup` + is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. + As the name suggests, `Get-DomainGroup` is used to query domain groups. Red Teams + and adversaries may leverage this function to enumerate domain groups for situational + awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message = "*Get-DomainGroup*") | stats count + min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName + User | `security_content_ctime(firstTime)` | `getdomaingroup_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators or power users may use this PowerView functions for troubleshooting. +known_false_positives: Administrators or power users may use this PowerView functions + for troubleshooting. references: - https://attack.mitre.org/techniques/T1069/002/ - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainGroup/ @@ -48,4 +51,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 2ff8e068bcd2e4d7756e1a8f94d9277cc0a29d13 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 10 Sep 2021 17:14:50 +0000 Subject: [PATCH 21/22] Added detection testing service results inGetWmiObject Ds Group with PowerShell Script Block --- ..._ds_group_with_powershell_script_block.yml | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml index f726fdf176..d39a7633df 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -7,18 +7,22 @@ type: TTP datamodel: - Endpoint description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) - to identify the execution of the `Get-WmiObject` commandlet used with specific parameters . The `DS_Group` parameter leverages WMI to query for all domain groups. - Red Teams and adversaries may leverage this commandlet to enumerate domain groups for situational awareness and Active Directory Discovery. -search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace root\\directory\\ldap"* AND Message=*"class ds_group"*) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message - ComputerName User | `security_content_ctime(firstTime)` | `getwmiobject_ds_group_with_powershell_script_block_filter`' + to identify the execution of the `Get-WmiObject` commandlet used with specific parameters + . The `DS_Group` parameter leverages WMI to query for all domain groups. Red Teams + and adversaries may leverage this commandlet to enumerate domain groups for situational + awareness and Active Directory Discovery. +search: '`powershell` EventCode=4104 (Message=*Get-WmiObject* AND Message=*"namespace + root\\directory\\ldap"* AND Message=*"class ds_group"*) | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `getwmiobject_ds_group_with_powershell_script_block_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -known_false_positives: Administrators or power users may use this PowerShell commandlet for troubleshooting. +known_false_positives: Administrators or power users may use this PowerShell commandlet + for troubleshooting. references: - https://attack.mitre.org/techniques/T1069/002/ -- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 +- https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.management/get-wmiobject?view=powershell-5.1 tags: analytic_story: - Active Directory Discovery @@ -47,4 +51,5 @@ tags: - name: dest type: Endpoint role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed From 12a4e2220b644844f3af9f22884000c98d86674d Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 10 Sep 2021 13:17:48 -0400 Subject: [PATCH 22/22] adding required fields --- .../domain_group_discovery_with_adsisearcher.yml | 4 ++++ .../endpoint/domain_group_discovery_with_dsquery.yml | 12 +++++++++++- .../endpoint/domain_group_discovery_with_net.yml | 12 +++++++++++- .../endpoint/domain_group_discovery_with_wmic.yml | 12 +++++++++++- .../endpoint/elevated_group_discovery_with_net.yml | 12 +++++++++++- .../elevated_group_discovery_with_powerview.yml | 4 ++++ .../endpoint/elevated_group_discovery_with_wmic.yml | 12 +++++++++++- detections/endpoint/getadgroup_with_powershell.yml | 12 +++++++++++- .../getadgroup_with_powershell_script_block.yml | 4 ++++ .../endpoint/getdomaingroup_with_powershell.yml | 12 +++++++++++- .../getdomaingroup_with_powershell_script_block.yml | 4 ++++ .../getwmiobject_ds_group_with_powershell.yml | 12 +++++++++++- ...iobject_ds_group_with_powershell_script_block.yml | 4 ++++ 13 files changed, 108 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml index c3fbfb909f..6c3fa10a08 100644 --- a/detections/endpoint/domain_group_discovery_with_adsisearcher.yml +++ b/detections/endpoint/domain_group_discovery_with_adsisearcher.yml @@ -36,6 +36,10 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - Message + - ComputerName + - User security_domain: endpoint impact: 30 confidence: 60 diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml index 9edaf59de2..4f5a86b765 100644 --- a/detections/endpoint/domain_group_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml @@ -36,7 +36,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 30 confidence: 50 diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index a42b221cc1..16bb9fa8ad 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -36,7 +36,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 30 confidence: 50 diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml index 4ad12c55bf..1448fc937c 100644 --- a/detections/endpoint/domain_group_discovery_with_wmic.yml +++ b/detections/endpoint/domain_group_discovery_with_wmic.yml @@ -37,7 +37,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 30 confidence: 50 diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml index 8f9be7353e..e09d41afb0 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -43,7 +43,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 30 confidence: 70 diff --git a/detections/endpoint/elevated_group_discovery_with_powerview.yml b/detections/endpoint/elevated_group_discovery_with_powerview.yml index 768c73b799..c770235243 100644 --- a/detections/endpoint/elevated_group_discovery_with_powerview.yml +++ b/detections/endpoint/elevated_group_discovery_with_powerview.yml @@ -42,6 +42,10 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - Message + - ComputerName + - User security_domain: endpoint impact: 30 confidence: 70 diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml index e45685e70c..5e057e4d6c 100644 --- a/detections/endpoint/elevated_group_discovery_with_wmic.yml +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -41,7 +41,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 30 confidence: 70 diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index a6520b1b91..1e2294f765 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -38,7 +38,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 30 confidence: 50 diff --git a/detections/endpoint/getadgroup_with_powershell_script_block.yml b/detections/endpoint/getadgroup_with_powershell_script_block.yml index fd766155a8..3cda8f2184 100644 --- a/detections/endpoint/getadgroup_with_powershell_script_block.yml +++ b/detections/endpoint/getadgroup_with_powershell_script_block.yml @@ -37,6 +37,10 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - Message + - ComputerName + - User security_domain: endpoint impact: 30 confidence: 50 diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index be8447a7d9..cd0a9f0339 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -38,7 +38,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 30 confidence: 50 diff --git a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml index 8500094cf3..df5a0e8a12 100644 --- a/detections/endpoint/getdomaingroup_with_powershell_script_block.yml +++ b/detections/endpoint/getdomaingroup_with_powershell_script_block.yml @@ -35,6 +35,10 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - Message + - ComputerName + - User security_domain: endpoint impact: 30 confidence: 50 diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml index 7e39a0b3a5..a250517f96 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -37,7 +37,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name #parent process name + - Processes.parent_process #parent cmdline + - Processes.original_file_name + - Processes.process_name #process name + - Processes.process #process cmdline + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id security_domain: endpoint impact: 30 confidence: 50 diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml index f726fdf176..7e7549176a 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell_script_block.yml @@ -34,6 +34,10 @@ tags: - Splunk Cloud required_fields: - _time + - EventCode + - Message + - ComputerName + - User security_domain: endpoint impact: 30 confidence: 50