mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge branch 'develop' of github.com:splunk/security-content into tf23
This commit is contained in:
Xiao Lin
@@ -12,10 +12,16 @@ description: A required step while exploiting the CVE-2021-44228-Log4j vulnerabi
|
||||
reaching out to default ports used by the LDAP and RMI protocols. This behavior
|
||||
could represent successfull exploitation. Note that adversaries can easily decide
|
||||
to use arbitrary ports for these protocols and potentially bypass this detection.
|
||||
search: ' `sysmon` EventCode=3 (process_name=java OR process_name=java.exe) (DestinationPort=389
|
||||
OR DestinationPort=1389 OR DestinationPort = 1099 ) | rename Computer as dest | stats
|
||||
count min(_time) as firstTime max(_time) as lastTime by dest, process_name, DestinationPort
|
||||
| `security_content_ctime(firstTime)` | `outbound_network_connection_from_java_using_default_ports_filter`'
|
||||
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
|
||||
where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR
|
||||
Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name
|
||||
Processes.dest Processes.process_path Processes.process Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports
|
||||
where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR
|
||||
Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)`
|
||||
| rename dest as connection_to_CNC] | table _time dest parent_process_name process_name
|
||||
process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
@@ -35,7 +41,7 @@ tags:
|
||||
cve:
|
||||
- CVE-2021-44228
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
@@ -54,11 +60,14 @@ tags:
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- process_name
|
||||
- EventID
|
||||
- CommandLine
|
||||
- Computer
|
||||
- DestinationPort
|
||||
- DestinationIp
|
||||
- Processes.process_guid
|
||||
- Processes.process_name
|
||||
- Processes.dest
|
||||
- Processes.process_path
|
||||
- Processes.process
|
||||
- Processes.parent_process_name
|
||||
- Ports.process_guid
|
||||
- Ports.dest
|
||||
- Ports.dest_port
|
||||
risk_score: 54
|
||||
security_domain: endpoint
|
||||
|
||||
@@ -0,0 +1,64 @@
|
||||
name: Suspicious Computer Account Name Change
|
||||
id: 35a61ed8-61c4-11ec-bc1e-acde48001122
|
||||
version: 1
|
||||
date: '2021-12-20'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287)
|
||||
exploitation chain, adversaries need to create a new computer account name and rename it to
|
||||
match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer
|
||||
account names always end with `$`. This analytic leverages Event Id 4781,
|
||||
`The name of an account was changed`, to identify a computer account rename event with a suspicious name that does not terminate with `$`.
|
||||
This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
|
||||
search: '`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$"
|
||||
| table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name |
|
||||
`suspicious_computer_account_name_change_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Windows event logs from your hosts. In addition, the Splunk Windows TA is needed.
|
||||
known_false_positives: Renaming a computer account name to a name that not end with
|
||||
'$' is highly unsual and may not have any legitimate scenarios.
|
||||
references:
|
||||
- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
|
||||
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
|
||||
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
|
||||
tags:
|
||||
analytic_story:
|
||||
- sAMAccountName Spoofing and Domain Controller Impersonation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
|
||||
kill_chain_phases:
|
||||
- Privilege Escalation
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1078.002
|
||||
cve:
|
||||
- CVE-2021-42287
|
||||
- CVE-2021-42278
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- ComputerName
|
||||
- Account_Name
|
||||
- Old_Account_Name
|
||||
- New_Account_Name
|
||||
security_domain: endpoint
|
||||
impact: 100
|
||||
confidence: 70
|
||||
risk_score: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Privilege Escalation
|
||||
message: A computer account $Old_Account_Name$ was renamed with a suspicious computer
|
||||
name
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,70 @@
|
||||
name: Suspicious Kerberos Service Ticket Request
|
||||
id: 8b1297bc-6204-11ec-b7c4-acde48001122
|
||||
version: 1
|
||||
date: '2021-12-20'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
|
||||
Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and
|
||||
obtain a Kerberos Service Ticket (TGS) with a domain controller computer account
|
||||
as the Service Name. This Service Ticket can be then used to take control of the
|
||||
domain controller on the final part of the attack. This analytic leverages Event
|
||||
Id 4769, `A Kerberos service ticket was requested`, to identify an unusual TGS request
|
||||
where the Account_Name requesting the ticket matches the Service_Name field. This
|
||||
behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287
|
||||
for privilege escalation.
|
||||
search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name)
|
||||
= lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 |
|
||||
table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious
|
||||
| `suspicious_kerberos_service_ticket_request_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
|
||||
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
|
||||
known_false_positives: We have tested this detection logic with ~2 million 4769 events
|
||||
and did not identify false positives. However, they may be possible in certain environments.
|
||||
Filter as needed.
|
||||
references:
|
||||
- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
|
||||
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
|
||||
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
|
||||
- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13
|
||||
tags:
|
||||
analytic_story:
|
||||
- sAMAccountName Spoofing and Domain Controller Impersonation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
|
||||
kill_chain_phases:
|
||||
- Privilege Escalation
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1078.002
|
||||
cve:
|
||||
- CVE-2021-42287
|
||||
- CVE-2021-42278
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Service_Name
|
||||
- Account_Name
|
||||
- Client_Address
|
||||
- Failure_Code
|
||||
security_domain: endpoint
|
||||
impact: 100
|
||||
confidence: 60
|
||||
risk_score: 60
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Privilege Escalation
|
||||
message: A suspicious Kerberos Service Ticket was requested by $Account_Name$
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,68 @@
|
||||
name: Suspicious Ticket Granting Ticket Request
|
||||
id: d77d349e-6269-11ec-9cfe-acde48001122
|
||||
version: 1
|
||||
date: '2021-12-21'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: Hunting
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller
|
||||
Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request
|
||||
a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed
|
||||
computer account. The TGT request will be preceded by a computer account name event.
|
||||
This analytic leverages Event Id 4781, `The name of an account was changed` and
|
||||
event Id 4768 `A Kerberos authentication ticket (TGT) was requested` to correlate
|
||||
a sequence of events where the new computer account on event id 4781 matches the
|
||||
request account on event id 4768. This behavior could represent an exploitation
|
||||
attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation.
|
||||
search: ' `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$")
|
||||
OR (EventCode=4768 Account_Name!="*$") | eval RenamedComputerAccount = coalesce(New_Account_Name,
|
||||
mvindex(Account_Name,0)) | transaction RenamedComputerAccount startswith=(EventCode=4781)
|
||||
endswith=(EventCode=4768) | eval short_lived=case((duration<2),"TRUE") | search
|
||||
short_lived = TRUE | table _time, ComputerName, EventCode, Account_Name,RenamedComputerAccount,
|
||||
short_lived |`suspicious_ticket_granting_ticket_request_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
Domain Controller and Kerberos events. The Advanced Security Audit policy setting
|
||||
`Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled.
|
||||
known_false_positives: A computer account name change event inmediately followed by
|
||||
a kerberos TGT request with matching fields is unsual. However, legitimate behavior
|
||||
may trigger it. Filter as needed.
|
||||
references:
|
||||
- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
|
||||
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
|
||||
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
|
||||
tags:
|
||||
analytic_story:
|
||||
- sAMAccountName Spoofing and Domain Controller Impersonation
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
|
||||
kill_chain_phases:
|
||||
- Privilege Escalation
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1078.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- Old_Account_Name
|
||||
- New_Account_Name
|
||||
- Account_Name
|
||||
- ComputerName
|
||||
security_domain: endpoint
|
||||
impact: 100
|
||||
confidence: 60
|
||||
risk_score: 60
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Privilege Escalation
|
||||
message: A suspicious TGT was requested was requested
|
||||
observable:
|
||||
- name: ComputerName
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
automated_detection_testing: passed
|
||||
@@ -0,0 +1,29 @@
|
||||
name: sAMAccountName Spoofing and Domain Controller Impersonation
|
||||
id: 0244fdee-61be-11ec-900e-acde48001122
|
||||
version: 1
|
||||
date: '2021-12-20'
|
||||
author: Mauricio Velazco, Splunk
|
||||
description: Monitor for activities and techniques associated with the exploitation of the sAMAccountName Spoofing (CVE-2021-42278)
|
||||
and Domain Controller Impersonation (CVE-2021-42287) vulnerabilities.
|
||||
narrative: On November 9, 2021, Microsoft released patches to address two vulnerabilities that affect Windows Active Directory networks,
|
||||
sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287). On December 10, 2021, security researchers Charlie Clark and
|
||||
Andrew Schwartz released a blog post where they shared how to weaponise these vulnerabilities in a target network an the initial detection opportunities. When successfully exploited,
|
||||
CVE-2021-42278 and CVE-2021-42287 allow an adversary, who has stolen the credentials of a low priviled domain user, to obtain a Kerberos Service ticket for a
|
||||
Domain Controller computer account. The only requirement is to have network connectivity to a domain controller.
|
||||
This attack vector effectivelly allows attackers to escalate their privileges in an Active Directory from a regular domain user account
|
||||
and take control of a domain controller. While patches have been released to address these vulnerabilities, deploying detection controls for this attack may help
|
||||
help defenders identify attackers attempting exploitation.
|
||||
references:
|
||||
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278
|
||||
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287
|
||||
- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- sAMAccountName Spoofing and Domain Controller Impersonation
|
||||
category:
|
||||
- Privilege Escalation
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
usecase: Advanced Threat Detection
|
||||
@@ -6,7 +6,7 @@ tests:
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: linux-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log
|
||||
source: Syslog:Linux-Sysmon/Operational
|
||||
sourcetype: sysmon_linux
|
||||
- file_name: windows-sysmon.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Suspicious Computer Account Name Change Unit Test
|
||||
tests:
|
||||
- name: Suspicious Computer Account Name Change
|
||||
file: endpoint/suspicious_computer_account_name_change.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Suspicious Kerberos Service Ticket Request Unit Test
|
||||
tests:
|
||||
- name: Suspicious Kerberos Service Ticket Request
|
||||
file: endpoint/suspicious_kerberos_service_ticket_request.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
@@ -0,0 +1,13 @@
|
||||
name: Suspicious Ticket Granting Ticket Request Unit Test
|
||||
tests:
|
||||
- name: Suspicious Ticket Granting Ticket Request
|
||||
file: endpoint/suspicious_ticket_granting_ticket_request.yml
|
||||
pass_condition: '| stats count | where count > 0'
|
||||
earliest_time: '-24h'
|
||||
latest_time: 'now'
|
||||
attack_data:
|
||||
- file_name: windows-security.log
|
||||
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log
|
||||
source: WinEventLog:Security
|
||||
sourcetype: WinEventLog
|
||||
update_timestamp: True
|
||||
Reference in New Issue
Block a user