admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into sysmon_to_endpoint

Browse Source
This commit is contained in:
bpatel
2019-03-05 11:35:37 -08:00
parent 938603ed73 564b40acb3
commit 2d5eb18add
13 changed files with 3054 additions and 2822 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.circleci/config.yml
+7 -7
View File
@@ -51,19 +51,19 @@ jobs:
command: |
cd security-content
source venv/bin/activate
python bin/validate_manifests.py
python bin/validate_manifests.py --path .
- run:
name: run manifest to escu
command: |
cd security-content
source venv/bin/activate
python bin/manifest_to_escu.py
python bin/manifest_to_escu.py --path . --output src/default/
- run:
name: run manifest to usecase library
command: |
cd security-content
source venv/bin/activate
python bin/manifest_to_usecaselibrary.py
python bin/manifest_to_usecaselibrary.py --path . --output src/default/
- persist_to_workspace:
root: security-content/src/default
paths:
@@ -87,7 +87,7 @@ jobs:
fi
- attach_workspace:
# Must be absolute path or relative path from working_directory
at: ~/repo/updated
at: ~/repo/updated
- run:
name: store updated analyticstories.conf
command: |
@@ -101,7 +101,7 @@ jobs:
git commit --allow-empty -m "updating src files [ci skip]"
# Push quietly to prevent showing the token in log
git push https://${GITHUB_TOKEN}@github.com/splunk/security-content.git ${CIRCLE_BRANCH}
tar -czvf content-pack.tar.gz src/*
tar -czvf content-pack.tar.gz src/*
- persist_to_workspace:
root: security-content/
paths:
@@ -111,7 +111,7 @@ jobs:
- image: cibuilds/github:0.10
steps:
- attach_workspace:
at: ~/repo/updated
at: ~/repo/updated
- run:
name: publish release on github
command: |
@@ -143,4 +143,4 @@ workflows:
ignore: /.*/
bin/manifest_to_escu.py
+15 -3
View File
@@ -1,15 +1,14 @@
# Take the manifest files and build files for Enterprise Security Content Updates with markdown syntax
import datetime
import glob
import json
import os
import argparse
ALL_UUIDS = []
MANIFEST_DIRECTORY = "."
OUTPUT_DIRECTORY = 'src/default/'
def markdown(x):
markdown = str(x)
@@ -368,4 +367,17 @@ def main():
if __name__ == "__main__":
# grab arguments
parser = argparse.ArgumentParser(description="converts security-content manifests to source files", epilog="""
This tool converts manifests to the source files to be used by products, specfically Splunk's.
It generates the savesearches.conf, analyticsstories.conf files for ES.""")
parser.add_argument("-p", "--path", required=True, help="path to security-security content repo")
parser.add_argument("-o", "--output", required=True, help="path to the output directory")
# parse them
args = parser.parse_args()
MANIFEST_DIRECTORY = args.path
OUTPUT_DIRECTORY = args.output
main()
bin/spell_check_manifests.py
+16 -7
View File
@@ -4,20 +4,18 @@ Take the manifest files and build files for Enterprise Security
import glob
import os.path
import json
import sys
import traceback
import argparse
# HIGH Level Fields
MANIFEST_DIRECTORY = "../manifests"
#Add these lines:
# Add these lines:
import nltk
from nltk.corpus import wordnet as WN
from nltk.corpus import stopwords
stop_words_en = set(stopwords.words('english'))
import enchant
import grammar_check
stop_words_en = set(stopwords.words('english'))
def check_spelling(sentences):
errors = []
sp = enchant.Dict("en_US")
@@ -47,6 +45,7 @@ def check_grammar(sentences):
return errors
def spell_check_search_manifest(search):
''' Validate that the search has the required fields for savedsearches.conf '''
errors = []
@@ -103,6 +102,7 @@ def spell_check_story_manifest(story):
errors.extend(spelling_errors)
errors.extend(grammar_errors)
def main():
''' Open manifest file, validate required fields '''
@@ -149,5 +149,14 @@ def main():
if not errors:
print "No errors found"
if __name__ == "__main__":
# grab arguments
parser = argparse.ArgumentParser(description="spell checks the security-contents manifests")
parser.add_argument("-p", "--path", required=True, help="path to security-security content repo")
# parse them
args = parser.parse_args()
MANIFEST_DIRECTORY = args.path
main()
bin/validate_manifests.py
+12 -7
View File
@@ -3,18 +3,13 @@
Take the manifest files and build files for Enterprise Security
'''
import glob
from os import path, environ
import json
import jsonschema
import sys
import argparse
from os import path
# HIGH Level Fields
MANIFEST_DIRECTORY = str(environ["CIRCLE_WORKING_DIRECTORY"] +
"/security-content")
print MANIFEST_DIRECTORY
STORY_CATEGORIES = [
"Abuse", "Adversary Tactics", "Best Practices",
"Cloud Security", "Malware", "Vulnerability"
@@ -30,6 +25,8 @@ VALID_DATA_MODELS = [
"Authentication",
"Certificates",
"Change_Analysis",
"Change",
"Malware",
"Email",
"Identity_Management",
"Network_Resolution",
@@ -577,4 +574,12 @@ def main():
if __name__ == "__main__":
# grab arguments
parser = argparse.ArgumentParser(description="validates security content manifests", epilog="""
Validates security manifest for correctness, adhering to spec and other common items.""")
parser.add_argument("-p", "--path", required=True, help="path to security-security content repo")
# parse them
args = parser.parse_args()
MANIFEST_DIRECTORY = args.path
main()
escu/searches/contextual_get_risk_for_endpoint.json
+1 -1
View File
@@ -32,7 +32,7 @@
}
],
"search": "| from datamodel:Risk.All_Risk | search risk_object_type=system risk_object={dest} | stats count sum(risk_score) as risk_score values(search_name) min(_time) as firstTime max(_time) as lastTime by risk_object | `ctime(firstTime)` | `ctime(lastTime)`",
"search_description": "For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk_scores, names of the correlation searches that contributed to create a risk score for a specific endpoint(machine_name) ",
"search_description": "For the last 7 days, the search will query the Risk data model in Splunk Enterprise Security and calculate the count, sum of the risk\\_scores, names of the correlation searches that contributed to create a risk score for a specific endpoint(machine\\_name) ",
"search_id": "fdcfb369-1725-4c24-824a-22972d7f0d65",
"search_name": "Get Risk Modifiers For Endpoint",
"search_type": "contextual",
escu/searches/detection_dns_record_changed.json
+13 -3
View File
@@ -33,8 +33,8 @@
"Bro"
]
},
"eli5": "Using a lookup discover_dns_records generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.",
"how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the Network_Resolution data model. It also requires that the discover_dns_record lookup table be populated by the included support search \"Discover DNS record\".",
"eli5": "Using a lookup `discover_dns_records` generated by support search \"Discover DNS records\" we check previous network traffic and make sure the responses have not changed.",
"how_to_implement": "To successfully implement this search you will need to ensure that DNS data is populating the `Network_Resolution` data model. It also requires that the `discover_dns_record` lookup table be populated by the included support search \"Discover DNS record\". <br></br> <b>Splunk>Phantom Playbook Integration</b><br></br>If Splunk>Phantom is also configured in your environment, a Playbook called \"DNS Hijack Investigation\" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk <code>https://splunkbase.splunk.com/app/3411/</code>, add the correct hostname to the \"Phantom Instance\" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. <br/>(Playbook Link:<code>https://my.phantom.us/4.1/playbook/dns-hijack-investigation/</code>).<br></br>",
"known_false_positives": "Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate.",
"maintainers": [
{
@@ -75,12 +75,22 @@
"name": "Jose Hernandez"
}
],
"phantom_playbooks": [
{
"phantom_server": "automation (hostname)",
"playbook_display_name": "DNS record change investigation",
"playbook_name": "community/dns_hijack_investigation",
"playbook_url": "https://my.phantom.us/4.1/playbook/dns-hijack-investigation/",
"sensitivity": "green",
"severity": "medium"
}
],
"scheduling": {
"cron_schedule": "0 * * * *",
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?<domain>\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | where current_answer!=discovered_answer",
"search": "| inputlookup discovered_dns_records.csv | rename answer as discovered_answer | join domain[|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?<domain>\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n)",
"search_description": "The search takes the DNS records and their answers results of the discovered_dns_records lookup and finds if any records have changed by searching DNS response from the Network_Resolution datamodel across the last day.",
"search_id": "44d3a43e-dcd5-49f7-8356-5209bb369065",
"search_name": "DNS record changed",
escu/searches/detection_dyn_dns_queries.json
+1 -1
View File
@@ -33,7 +33,7 @@
"Bro"
]
},
"eli5": "The search is querying an accelerated Network_Resolution data model to count and list the values of resolved domains for each DNS query and checks that against the list of Dynamic DNS providers (lookup - dynamic_dns_providers) by each host (DNS.src)",
"eli5": "The search is querying an accelerated `Network_Resolution` data model to count and list the values of resolved domains for each DNS query and checks that against the list of Dynamic DNS providers (lookup - `dynamic_dns_providers`) by each host (DNS.src)",
"how_to_implement": "First, you'll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data collected passively by Splunk Stream or similar solutions. Specifically, data that contains the domain that is being queried and the IP of the host originating the request must be populating the Network_Resolution data model. This search also leverages a lookup file, <code>dynamic_dns_providers_default.csv</code>, which contains a non-exhaustive list of Dynamic DNS providers. Please consider updating the local lookup periodically by adding new domains to the list of <code>dynamic_dns_providers_local.csv</code>.",
"known_false_positives": "Some users and applications may leverage Dynamic DNS to reach out to some domains on the Internet since dynamic DNS by itself is not malicious, however this activity must be verified.",
"maintainers": [
escu/searches/investigative_get_emails_from_source.json
+45
View File
@@ -0,0 +1,45 @@
{
"channel": "ESCU",
"creation_date": "2019-02-21",
"data_metadata": {
"data_models": [
"Email"
],
"data_source": [
"Email"
],
"providing_technologies": [
"Microsoft Exchange"
]
},
"fields_required": [
"src"
],
"how_to_implement": "To successfully implement this search you must ingest your email logs or capture unencrypted email communications within network traffic, and populate the Email data model.",
"maintainers": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"modification_date": "2019-02-21",
"original_authors": [
{
"company": "Splunk",
"email": "rvaldez@splunk.com",
"name": "Rico Valdez"
}
],
"search": "|tstats `summariesonly` values(All_Email.dest) as dest values(All_Email.recipient) as recepient min(_time) as firstTime max(_time) as lastTime count from datamodel=Email.All_Email by All_Email.src |`drop_dm_object_name(All_Email)` | `ctime(firstTime)` | `ctime(lastTime)`",
"search_description": "This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each source.",
"search_id": "ddc7af28-c34d-4392-af93-7f29a4e8806c",
"search_name": "Get History Of Email Sources",
"search_type": "investigative",
"search_window": {
"earliest_time_offset": 172800,
"latest_time_offset": 86400
},
"spec_version": 1,
"version": "1.0"
}
escu/searches/support_discover_dns_records.json
+1 -1
View File
@@ -35,7 +35,7 @@
"latest_time": "-10m@m"
},
"search": "| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, \"\\*\", \"\")) | join domain [|tstats summariesonly=true count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!=\"unknown\" DNS.answer!=\"\" by DNS.query | rename DNS.query as query | where query!=\"unknown\" | rex field=query \"(?<domain>\\w+\\.\\w+?)(?:$|/)\"] | makemv delim=\" \" answer | makemv delim=\" \" type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records.csv",
"search_description": "The search takes corporate and common cloud provider domains configured under cim_corporate_email_domains.csv, cim_corporate_web_domains.csv, and cloud_domains.csv and finds their responses across the last 30 days from data in the Network Traffic datamodel, then stores the output under the discovered_dns_records.csv lookup",
"search_description": "The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Traffic` datamodel, then stores the output under the `discovered_dns_records.csv` lookup",
"search_id": "c096f721-8842-42ce-bfc7-74bd8c72b7c3",
"search_name": "Discover DNS records",
"search_type": "support",
escu/stories/dns_hijacking.json
+3 -2
View File
@@ -13,7 +13,7 @@
],
"modification_date": "2019-02-14",
"name": "DNS Hijacking",
"narrative": "Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. Its distributed nature is one reason, as it relies on unstructured connections between millions of clients and servers over inherently insecure protocols.<br></br>The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. <br></br>On January 22, 2019, the US Department of Homeland Security 2019's Cybersecurity and Infrastructure Security Agency (CISA) raised awareness of some high-profile DNS hijacking attacks against infrastructure, both in the United States and abroad. It issued Emergency Directive 19-01 (see https://cyber.dhs.gov/ed/19-01/), which summarized the activity and required government agencies to take the following four actions, all within 10 days: <ol><li>For all .gov or other agency-managed domains, audit public DNS records on all authoritative and secondary DNS servers, verify that they resolve to the intended location or report them to CISA.</li><li>Update the passwords for all accounts on systems that can make changes to each agency 2019s DNS records.</li><li>Implement multi-factor authentication (MFA) for all accounts on systems that can make changes to each agency 2019s DNS records or, if impossible, provide CISA with the names of systems, the reasons why MFA cannot be enabled within the required timeline, and an ETA for when it can be enabled.</li><li>CISA will begin regular delivery of newly added certificates to Certificate Transparency (CT) logs for agency domains via the Cyber Hygiene service. Upon receipt, agencies must immediately begin monitoring CT log data for certificates issued that they did not request. If an agency confirms that a certificate was unauthorized, it must report the certificate to the issuing certificate authority and to CISA.</li></ol>Of course, it makes sense to put equivalent actions in place within your environment, as well. <br></br>In DNS hijacking, the attacker assumes control over an account or makes use of a DNS service exploit to make changes to DNS records. Once they gain access, attackers can substitute their own MX records, name-server records, and addresses, redirecting emails and traffic through their infrastructure, where they can read, copy, or modify information seen. They can also generate valid encryption certificates to help them avoid browser-certificate checks. In one notable attack on the Internet service provider, GoDaddy, the hackers altered Sender Policy Framework (SPF) records a relatively minor change that did not inflict excessive damage but allowed for more effective spam campaigns.<br></br>The searches in this Analytic Story help you detect and investigate activities that may indicate that DNS hijacking has taken place within your environment.",
"narrative": "Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.<br></br>The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. <br></br>On January 22, 2019, the US Department of Homeland Security 2019's Cybersecurity and Infrastructure Security Agency (CISA) raised awareness of some high-profile DNS hijacking attacks against infrastructure, both in the United States and abroad. It issued Emergency Directive 19-01 (see https://cyber.dhs.gov/ed/19-01/), which summarized the activity and required government agencies to take the following four actions, all within 10 days: <ol><li>For all .gov or other agency-managed domains, audit public DNS records on all authoritative and secondary DNS servers, verify that they resolve to the intended location or report them to CISA.</li><li>Update the passwords for all accounts on systems that can make changes to each agency 2019's DNS records.</li><li>Implement multi-factor authentication (MFA) for all accounts on systems that can make changes to each agency's 2019 DNS records or, if impossible, provide CISA with the names of systems, the reasons why MFA cannot be enabled within the required timeline, and an ETA for when it can be enabled.</li><li>CISA will begin regular delivery of newly added certificates to Certificate Transparency (CT) logs for agency domains via the Cyber Hygiene service. Upon receipt, agencies must immediately begin monitoring CT log data for certificates issued that they did not request. If an agency confirms that a certificate was unauthorized, it must report the certificate to the issuing certificate authority and to CISA.</li></ol>Of course, it makes sense to put equivalent actions in place within your environment, as well. <br></br>In DNS hijacking, the attacker assumes control over an account or makes use of a DNS service exploit to make changes to DNS records. Once they gain access, attackers can substitute their own MX records, name-server records, and addresses, redirecting emails and traffic through their infrastructure, where they can read, copy, or modify information seen. They can also generate valid encryption certificates to help them avoid browser-certificate checks. In one notable attack on the Internet service provider, GoDaddy, the hackers altered Sender Policy Framework (SPF) records a relatively minor change that did not inflict excessive damage but allowed for more effective spam campaigns.<br></br>The searches in this Analytic Story help you detect and investigate activities that may indicate that DNS hijacking has taken place within your environment.",
"original_authors": [
{
"company": "Splunk",
@@ -47,7 +47,8 @@
"Get DNS Server History for a host",
"Get DNS traffic ratio",
"Get Process responsible for the DNS traffic",
"Investigate Web Activity From src_ip"
"Investigate Web Activity From src_ip",
"Get History Of Email Sources"
],
"support_searches": [
"Discover DNS records"
src/default/analytic_stories.conf
+13 -12
View File
@@ -316,18 +316,19 @@ The search in this story can help you to detect if attackers are abusing your co
[DNS Hijacking]
category = Adversary Tactics
creation_date = 2019-02-09
data_models = ["Application_State", "Authentication", "Network_Resolution", "Network_Traffic", "Risk", "Vulnerabilities", "Web"]
data_models = ["Application_State", "Authentication", "Email", "Network_Resolution", "Network_Traffic", "Risk", "Vulnerabilities", "Web"]
description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records.
id = ad7eb6e0-f06c-4781-b145-a422d59c26e9
version = 1.0
mappings = {"mitre_attack": ["Command and Control", "Exfiltration Over Command and Control Channel", "Commonly Used Port", "Exfiltration Over Alternative Protocol", "Exfiltration", "Standard Application Layer Protocol", "Defense Evasion"], "cis20": ["CIS 8", "CIS 9", "CIS 12", "CIS 13", "CIS 3", "CIS 1"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS", "PR.IP", "PR.PT", "DE.AE", "DE.CM"]}
modification_date = 2019-02-09
modification_date = 2019-02-21
reference = ["https://blog.malwarebytes.com/cybercrime/2015/09/dns-hijacks-what-to-look-for/", "https://www.darkreading.com/attacks-breaches/dns-hijacking-the-silent-threat-thats-putting-your-network-at-risk/a/d-id/1330922", "https://blog.talosintelligence.com/2018/11/dnspionage-campaign-targets-middle-east.html", "https://www.fireeye.com/blog/threat-research/2019/01/global-dns-hijacking-campaign-dns-record-manipulation-at-scale.html", "https://www.splunk.com/blog/2019/01/25/cisa-emergency-directive-19-01-doing-things-the-easy-way-in-splunk.html"]
providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule"]
investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Investigate Web Activity From src_ip"]
providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Nessus", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule"]
investigative_searches = ["ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Investigate Web Activity From src_ip", "ESCU - Get History Of Email Sources"]
contextual_searches = ["ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get User Information from Identity Table", "ESCU - Get Risk Modifiers For User", "ESCU - Get Risk Modifiers For Endpoint"]
narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. Its distributed nature is one reason, as it relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\
support_searches = ["ESCU - Discover DNS records"]
narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\
\
The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \
\
@@ -335,9 +336,9 @@ On January 22, 2019, the US Department of Homeland Security 2019's Cybersecurity
\
1. For all .gov or other agency-managed domains, audit public DNS records on all authoritative and secondary DNS servers, verify that they resolve to the intended location or report them to CISA.\
\
1. Update the passwords for all accounts on systems that can make changes to each agency 2019s DNS records.\
1. Update the passwords for all accounts on systems that can make changes to each agency 2019's DNS records.\
\
1. Implement multi-factor authentication (MFA) for all accounts on systems that can make changes to each agency 2019s DNS records or, if impossible, provide CISA with the names of systems, the reasons why MFA cannot be enabled within the required timeline, and an ETA for when it can be enabled.\
1. Implement multi-factor authentication (MFA) for all accounts on systems that can make changes to each agency's 2019 DNS records or, if impossible, provide CISA with the names of systems, the reasons why MFA cannot be enabled within the required timeline, and an ETA for when it can be enabled.\
\
1. CISA will begin regular delivery of newly added certificates to Certificate Transparency (CT) logs for agency domains via the Cyber Hygiene service. Upon receipt, agencies must immediately begin monitoring CT log data for certificates issued that they did not request. If an agency confirms that a certificate was unauthorized, it must report the certificate to the issuing certificate authority and to CISA.Of course, it makes sense to put equivalent actions in place within your environment, as well. \
\
@@ -400,7 +401,7 @@ data_models = ["Application_State", "Authentication", "Email", "Endpoint", "Netw
description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment.
id = bb9f5ed2-916e-4364-bb6d-91c310efcf52
version = 1.0
mappings = {"mitre_attack": ["Third-party Software", "AppInit DLLs", "Commonly Used Port", "Command-Line Interface", "Registry Run Keys / Start Folder", "Persistence", "Defense Evasion", "Execution", "Authentication Package", "Account Discovery"], "cis20": ["CIS 7", "CIS 12", "CIS 2", "CIS 3", "CIS 8"], "kill_chain_phases": ["Exploitation", "Actions on Objectives", "Delivery", "Installation", "Command and Control"], "nist": ["ID.AM", "PR.DS", "PR.IP", "PR.PT", "DE.AE", "DE.CM"]}
mappings = {"mitre_attack": ["Third-party Software", "AppInit DLLs", "Commonly Used Port", "Command-Line Interface", "Registry Run Keys / Start Folder", "Persistence", "Defense Evasion", "Execution", "Authentication Package", "Account Discovery"], "cis20": ["CIS 7", "CIS 12", "CIS 2", "CIS 3", "CIS 8"], "kill_chain_phases": ["Exploitation", "Delivery", "Installation", "Command and Control", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS", "PR.IP", "PR.PT", "DE.AE", "DE.CM"]}
modification_date = 2018-12-03
reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"]
providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"]
@@ -730,7 +731,7 @@ data_models = ["Application_State", "Authentication", "Network_Resolution", "Net
description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers.
id = 6d13121c-90f3-446d-8ac3-27efbbc65218
version = 1.0
mappings = {"mitre_attack": ["Command and Control", "Exfiltration Over Command and Control Channel", "Commonly Used Port", "Exfiltration Over Alternative Protocol", "Exfiltration", "Defense Evasion"], "cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Command and Control", "Actions on Objectives", "Delivery"], "nist": ["PR.PT", "DE.AE", "DE.CM", "PR.AC", "PR.DS"]}
mappings = {"mitre_attack": ["Command and Control", "Exfiltration Over Command and Control Channel", "Commonly Used Port", "Exfiltration Over Alternative Protocol", "Exfiltration", "Defense Evasion"], "cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Command and Control", "Delivery", "Actions on Objectives"], "nist": ["PR.PT", "DE.AE", "DE.CM", "PR.AC", "PR.DS"]}
modification_date = 2018-07-24
reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"]
providing_technologies = ["Bluecoat", "Bro", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "macOS"]
@@ -930,7 +931,7 @@ data_models =
description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required.
id = 2e8948a5-5239-406b-b56b-6c50w3168af3
version = 2.0
mappings = {"mitre_attack": ["Exfiltration", "Credential Access", "Execution", "Initial Access"], "cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "PR.DS", "DE.CM", "PR.AC"]}
mappings = {"mitre_attack": ["Exfiltration", "Credential Access", "Execution", "Initial Access"], "cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM", "PR.DS", "DE.DP", "PR.AC"]}
modification_date = 2018-11-27
reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"]
providing_technologies = ["AWS", "Splunk Enterprise Security"]
@@ -1146,7 +1147,7 @@ data_models = ["Email"]
description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets.
id = 31337aaa-bc22-4752-b599-ef112dq1dq7a
version = 1.0
mappings = {"mitre_attack": ["Valid Accounts", "Create Account"], "kill_chain_phases": ["Actions on Objectives"], "cis20": ["CIS 6", "CIS 16"], "nist": ["DE.CM", "DE.AE", "DE.DP"]}
mappings = {"mitre_attack": ["Valid Accounts", "Create Account"], "cis20": ["CIS 6", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE", "DE.CM"]}
modification_date = 2018-10-08
reference = ["https://www.fbi.gov/scams-and-safety/common-fraud-schemes/internet-fraud", "https://www.fbi.gov/news/stories/2017-internet-crime-report-released-050718", "https://www.otalliance.org/news-events/press-releases/online-trust-alliance-reports-doubling-cyber-incidents-2017-0"]
providing_technologies = ["Bro", "Microsoft Exchange", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream"]
src/default/analyticstories.conf
+627 -590
View File
File diff suppressed because it is too large Load Diff
src/default/savedsearches.conf
+2300 -2188
View File
File diff suppressed because it is too large Load Diff