From caf4ce8fdbb05a6d6a7040d0cb29658509b8552c Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Aug 2023 12:58:36 -0700 Subject: [PATCH 1/5] updates --- detections/cloud/o365_added_service_principal.yml | 2 +- detections/cloud/o365_excessive_sso_logon_errors.yml | 2 +- detections/cloud/o365_new_federated_domain_added.yml | 11 +++-------- .../endpoint/windows_powershell_remotesigned_file.yml | 8 ++++---- 4 files changed, 9 insertions(+), 14 deletions(-) diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 4483ff8063..37adea3236 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -1,6 +1,6 @@ name: O365 Added Service Principal id: 1668812a-6047-11eb-ae93-0242ac130002 -version: 2 +version: 3 date: '2023-08-02' author: Rod Soto, Splunk status: production diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 5f6519b72b..1b465e29f5 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -1,6 +1,6 @@ name: O365 Excessive SSO logon errors id: 8158ccc4-6038-11eb-ae93-0242ac130002 -version: 2 +version: 3 date: '2023-08-02' author: Rod Soto, Splunk status: production diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 2db5563348..1ba566b31e 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -8,7 +8,7 @@ type: TTP description: This search detects the addition of a new Federated domain. data_source: [] search: '`o365_management_activity` Operation IN("*add*", "*new*") AND Operation="*domain*" - | stats count by Workload Operation Target{}.ID Actor{}.ID + | stats count by Workload Operation Target{}.ID Actor{}.ID | rename Actor{}.ID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`' @@ -30,17 +30,12 @@ tags: asset_type: Office 365 confidence: 80 impact: 80 - message: User $UserId$ has added a new federated domaain $Parameters.Value$ for - $OrganizationName$ + message: User $user$ has added a new federated domain $Parameters.Value$ for $OrganizationName$ mitre_attack_id: - T1136.003 - T1136 observable: - - name: OrganizationName - type: Other - role: - - Victim - - name: UserId + - name: user type: User role: - Victim diff --git a/detections/endpoint/windows_powershell_remotesigned_file.yml b/detections/endpoint/windows_powershell_remotesigned_file.yml index 459784176d..fdc253c62a 100644 --- a/detections/endpoint/windows_powershell_remotesigned_file.yml +++ b/detections/endpoint/windows_powershell_remotesigned_file.yml @@ -6,7 +6,7 @@ author: Teoderick Contreras, Splunk status: production type: Anomaly data_source: -- Sysmon EventCode 1 +- Sysmon Event ID 1 description: This analytic identifies the use of "remotesigned" execution policy for a file. This security setting determines whether PowerShell scripts can be executed on a computer. When the execution policy is set to "remotesigned," it allows locally created scripts to run without any restrictions, @@ -31,16 +31,16 @@ tags: asset_type: Endpoint confidence: 50 impact: 50 - message: A PowerShell commandline to remotesigned a powershell script in $dest$, + message: A PowerShell commandline with remotesigned policy executed on $dest$ mitre_attack_id: - T1059.001 - T1059 observable: - - name: Computer + - name: dest type: Hostname role: - Victim - - name: User + - name: user type: User role: - Victim From 424ce1f1c514981db0ce2f1e42fa276a47ba9a5d Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Aug 2023 13:03:40 -0700 Subject: [PATCH 2/5] Update o365_new_federated_domain_added.yml --- detections/cloud/o365_new_federated_domain_added.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 1ba566b31e..e359a3453c 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -8,7 +8,7 @@ type: TTP description: This search detects the addition of a new Federated domain. data_source: [] search: '`o365_management_activity` Operation IN("*add*", "*new*") AND Operation="*domain*" - | stats count by Workload Operation Target{}.ID Actor{}.ID | rename Actor{}.ID as user + | stats count by Workload Operation Target{}.ID Actor{} | rename Actor{}.ID as user | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`' From 8b4de41253c3ad6c885cb3386e14920083a100c3 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Aug 2023 13:52:27 -0700 Subject: [PATCH 3/5] update mode ongit add . --- .../cloud/o365_added_service_principal.yml | 20 +++++-------------- .../cloud/o365_excessive_sso_logon_errors.yml | 20 +++++++++---------- .../cloud/o365_new_federated_domain_added.yml | 19 +++++++++--------- 3 files changed, 24 insertions(+), 35 deletions(-) diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 37adea3236..a72e44b8c2 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -5,14 +5,9 @@ date: '2023-08-02' author: Rod Soto, Splunk status: production type: TTP -description: This search detects the creation of a new Federation setting by alerting - about an specific event related to its creation. +description: The following analytic detects addition of new service principal accounts added to O365 tenants. Attackers can abuse service principals in Office 365 (now known as Microsoft 365) to gain unauthorized access and perform malicious actions within an organization's environment. Service principals are essentially non-human accounts used by applications, services, or scripts to access resources and interact with APIs on behalf of the organization. data_source: [] -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created") - | stats count by src_user src_user_type action Operation authentication_service Workload - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_added_service_principal_filter`' +search: '``o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created") | stats count values(ModifiedProperties{}.NewValue) as new_value by src_user src_user_type action Operation authentication_service Workload | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: The creation of a new Federation is not necessarily malicious, @@ -30,18 +25,13 @@ tags: asset_type: Office 365 confidence: 60 impact: 70 - message: User $Actor.ID$ created a new federation setting on $Target.ID$ and added - service principal credentials from IP Address $ActorIpAddress$ + message: User $src_user$ has created new service principal $new_value$ in AzureActiveDirectory mitre_attack_id: - T1136.003 - T1136 observable: - - name: ActorIpAddress - type: IP Address - role: - - Attacker - - name: Target.ID - type: Endpoint + - name: src_user + type: User role: - Victim product: diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 1b465e29f5..2df173c3d7 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -5,16 +5,11 @@ date: '2023-08-02' author: Rod Soto, Splunk status: production type: Anomaly -description: This search detects accounts with high number of Single Sign ON (SSO) +description: The following analytic detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. data_source: [] -search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed - | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId Operation Workload - | where count >= 5 - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `o365_excessive_sso_logon_errors_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=*Sso* Operation=UserLoginFailed | stats count min(_time) as firstTime max(_time) as lastTime by user src_ip LogonError user_agent UserId Operation Workload authentication_method authentication_service| where count >= 5 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: Logon errors may not be malicious in nature however it may @@ -28,16 +23,16 @@ tags: asset_type: Office 365 confidence: 80 impact: 80 - message: User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ + message: User $user$ has caused excessive number of SSO logon errors from $src_ip$ using UserAgent $UserAgent$. mitre_attack_id: - T1556 observable: - - name: ActorIpAddress + - name: src_ip type: IP Address role: - Attacker - - name: UserId + - name: user type: User role: - Victim @@ -47,11 +42,16 @@ tags: - Splunk Cloud required_fields: - _time + - user + - src_ip - Workload - LogonError - ActorIpAddress - UserAgent - UserId + - authentication_service + - authentication_method + - Operation risk_score: 64 security_domain: threat tests: diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index e359a3453c..8c1580bfc6 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -5,10 +5,10 @@ date: '2023-08-02' author: Rod Soto, Splunk status: production type: TTP -description: This search detects the addition of a new Federated domain. +description: The following search detects the addition of a new Federated domain in O365 environments. If an attacker adds an unverified domain to Office 365, they may gain unauthorized access to the organization's email and other services, potentially leading to data breaches and information theft. It can be misused to set up adversary infrastruture for phishing, spoofing emails and malware distribution. data_source: [] -search: '`o365_management_activity` Operation IN("*add*", "*new*") AND Operation="*domain*" - | stats count by Workload Operation Target{}.ID Actor{} | rename Actor{}.ID as user +search: '`o365_management_activity` Operation IN ("*add*", "*new*") AND Operation="*domain*" + | stats count values(ModifiedProperties{}.NewValue) as new_value by user user_agent authentication_service action Workload Operation | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`' @@ -30,7 +30,7 @@ tags: asset_type: Office 365 confidence: 80 impact: 80 - message: User $user$ has added a new federated domain $Parameters.Value$ for $OrganizationName$ + message: User $user$ has added a new federated domain $new_value$ mitre_attack_id: - T1136.003 - T1136 @@ -47,12 +47,11 @@ tags: - _time - Workload - Operation - - Parameters{}.Value - - ObjectId - - OrganizationName - - OriginatingServer - - UserId - - UserKey + - ModifiedProperties{}.NewValue + - authentication_service + - user + - user_agent + - action risk_score: 64 security_domain: threat tests: From 4c76d950f80b7a9a9b1dd999191467967cf6ae2b Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Aug 2023 14:01:06 -0700 Subject: [PATCH 4/5] Update o365_added_service_principal.yml --- detections/cloud/o365_added_service_principal.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index a72e44b8c2..24b763d7f7 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -7,7 +7,7 @@ status: production type: TTP description: The following analytic detects addition of new service principal accounts added to O365 tenants. Attackers can abuse service principals in Office 365 (now known as Microsoft 365) to gain unauthorized access and perform malicious actions within an organization's environment. Service principals are essentially non-human accounts used by applications, services, or scripts to access resources and interact with APIs on behalf of the organization. data_source: [] -search: '``o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created") | stats count values(ModifiedProperties{}.NewValue) as new_value by src_user src_user_type action Operation authentication_service Workload | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`' +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="*Add service principal*" OR (Operation = "*principal*" AND action = "created") | stats count values(ModifiedProperties{}.NewValue) as new_value by src_user src_user_type action Operation authentication_service Workload | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`' how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity known_false_positives: The creation of a new Federation is not necessarily malicious, From a474fb445667a1eca17925d5354ab3d15575d5d9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 7 Aug 2023 14:02:36 -0700 Subject: [PATCH 5/5] Update o365_added_service_principal.yml --- detections/cloud/o365_added_service_principal.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 24b763d7f7..707293bcfc 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -42,11 +42,11 @@ tags: - _time - Workload - signature - - Actor{}.ID - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - Target{}.ID - - ActorIpAddress + - src_user + - src_user_type + - action + - Operation + - authentication_service risk_score: 42 security_domain: threat tests: