From 530037ad16c39fcd93d15a2d7a336b949f808630 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Vil=C3=A9m=20Zelienka?= Date: Mon, 18 May 2020 15:42:03 +0200 Subject: [PATCH 1/3] Fixed typo in search, search optimization Changes Processs to Processes. Moved process search to tstats. --- detections/create_local_admin_via_net.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/detections/create_local_admin_via_net.yml b/detections/create_local_admin_via_net.yml index 6cc228236c..3373a7ba6d 100644 --- a/detections/create_local_admin_via_net.yml +++ b/detections/create_local_admin_via_net.yml @@ -35,10 +35,9 @@ detect: latest_time: -10m@m search: '| tstats `security_content_summariesonly` count values(Processes.user) as user values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where (Processs.process_name=net.exe OR Processes.process_name=net1.exe) by + where (Processes.process_name=net.exe OR Processes.process_name=net1.exe) AND (Processes.process=*localgroup* OR Processes.process=*/add* OR Processes.process=*user*) by Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | search (process=*localgroup* OR - process=*/add* OR process=*user*) |`create_local_admin_via_net_filter`' + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_local_admin_via_net_filter`' suppress: suppress_fields: dest suppress_period: 86400s From 9f11288073b600639048b13427fc5319c46d7a1d Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 18 May 2020 12:23:07 -0700 Subject: [PATCH 2/3] supress fields updated --- detections/create_local_admin_via_net.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/create_local_admin_via_net.yml b/detections/create_local_admin_via_net.yml index 3373a7ba6d..624c8466c1 100644 --- a/detections/create_local_admin_via_net.yml +++ b/detections/create_local_admin_via_net.yml @@ -39,7 +39,7 @@ detect: Processes.process Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`create_local_admin_via_net_filter`' suppress: - suppress_fields: dest + suppress_fields: dest, process_name suppress_period: 86400s eli5: Net.exe is a built-in Windows command-line tool that can be used to add, display, or modify user accounts. While Microsoft administrators use this tool to manage From f2fcabe907503aa45792b33af7cca52ad3700709 Mon Sep 17 00:00:00 2001 From: bpatel Date: Mon, 18 May 2020 12:25:30 -0700 Subject: [PATCH 3/3] link update --- stories/lateral_movement.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/stories/lateral_movement.yml b/stories/lateral_movement.yml index 1e01455fbb..7bbfb88f0d 100644 --- a/stories/lateral_movement.yml +++ b/stories/lateral_movement.yml @@ -54,7 +54,7 @@ original_authors: email: davidd@splunk.com name: David Dorsey references: - - https://blog.binarydefense.com/reliably-detecting-pass-the-hash-through-event-log-analysis + - https://www.binarydefense.com/reliably-detecting-pass-the-hash/ - https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html spec_version: 2 usecase: Advanced Threat Detection