diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index 422529e4f5..b22c450fe7 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -12,10 +12,16 @@ description: A required step while exploiting the CVE-2021-44228-Log4j vulnerabi reaching out to default ports used by the LDAP and RMI protocols. This behavior could represent successfull exploitation. Note that adversaries can easily decide to use arbitrary ports for these protocols and potentially bypass this detection. -search: ' `sysmon` EventCode=3 (process_name=java OR process_name=java.exe) (DestinationPort=389 - OR DestinationPort=1389 OR DestinationPort = 1099 ) | rename Computer as dest | stats - count min(_time) as firstTime max(_time) as lastTime by dest, process_name, DestinationPort - | `security_content_ctime(firstTime)` | `outbound_network_connection_from_java_using_default_ports_filter`' +search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes + where (Processes.process_name="java.exe" OR Processes.process_name=javaw.exe OR + Processes.process_name=javaw.exe) by _time Processes.process_guid Processes.process_name + Processes.dest Processes.process_path Processes.process Processes.parent_process_name + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | join process_guid [| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Ports + where (Ports.dest_port= 389 OR Ports.dest_port= 636 OR Ports.dest_port = 1389 OR + Ports.dest_port = 1099 ) by Ports.process_guid Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` + | rename dest as connection_to_CNC] | table _time dest parent_process_name process_name + process_path process connection_to_CNC dest_port | `outbound_network_connection_from_java_using_default_ports_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. @@ -35,7 +41,7 @@ tags: cve: - CVE-2021-44228 dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log impact: 90 kill_chain_phases: - Exploitation @@ -54,11 +60,14 @@ tags: - Splunk Cloud required_fields: - _time - - process_name - - EventID - - CommandLine - - Computer - - DestinationPort - - DestinationIp + - Processes.process_guid + - Processes.process_name + - Processes.dest + - Processes.process_path + - Processes.process + - Processes.parent_process_name + - Ports.process_guid + - Ports.dest + - Ports.dest_port risk_score: 54 security_domain: endpoint diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml new file mode 100644 index 0000000000..e201d09671 --- /dev/null +++ b/detections/endpoint/suspicious_computer_account_name_change.yml @@ -0,0 +1,64 @@ +name: Suspicious Computer Account Name Change +id: 35a61ed8-61c4-11ec-bc1e-acde48001122 +version: 1 +date: '2021-12-20' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) + exploitation chain, adversaries need to create a new computer account name and rename it to + match the name of a domain controller account without the ending '$'. In Windows Active Directory environments, computer + account names always end with `$`. This analytic leverages Event Id 4781, + `The name of an account was changed`, to identify a computer account rename event with a suspicious name that does not terminate with `$`. + This behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. +search: '`wineventlog_security` EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$" + | table _time, ComputerName, Account_Name, Old_Account_Name, New_Account_Name | + `suspicious_computer_account_name_change_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. +known_false_positives: Renaming a computer account name to a name that not end with + '$' is highly unsual and may not have any legitimate scenarios. +references: +- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287 +tags: + analytic_story: + - sAMAccountName Spoofing and Domain Controller Impersonation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1078 + - T1078.002 + cve: + - CVE-2021-42287 + - CVE-2021-42278 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - ComputerName + - Account_Name + - Old_Account_Name + - New_Account_Name + security_domain: endpoint + impact: 100 + confidence: 70 + risk_score: 70 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: A computer account $Old_Account_Name$ was renamed with a suspicious computer + name + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml new file mode 100644 index 0000000000..01088d134a --- /dev/null +++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml @@ -0,0 +1,70 @@ +name: Suspicious Kerberos Service Ticket Request +id: 8b1297bc-6204-11ec-b7c4-acde48001122 +version: 1 +date: '2021-12-20' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller + Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and + obtain a Kerberos Service Ticket (TGS) with a domain controller computer account + as the Service Name. This Service Ticket can be then used to take control of the + domain controller on the final part of the attack. This analytic leverages Event + Id 4769, `A Kerberos service ticket was requested`, to identify an unusual TGS request + where the Account_Name requesting the ticket matches the Service_Name field. This + behavior could represent an exploitation attempt of CVE-2021-42278 and CVE-2021-42287 + for privilege escalation. +search: ' `wineventlog_security` EventCode=4769 | eval isSuspicious = if(lower(Service_Name) + = lower(mvindex(split(Account_Name,"@"),0)+"$"),1,0) | where isSuspicious = 1 | + table _time, Client_Address, Account_Name, Service_Name, Failure_Code, isSuspicious + | `suspicious_kerberos_service_ticket_request_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: We have tested this detection logic with ~2 million 4769 events + and did not identify false positives. However, they may be possible in certain environments. + Filter as needed. +references: +- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287 +- https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-sfu/02636893-7a1f-4357-af9a-b672e3e3de13 +tags: + analytic_story: + - sAMAccountName Spoofing and Domain Controller Impersonation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1078 + - T1078.002 + cve: + - CVE-2021-42287 + - CVE-2021-42278 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Service_Name + - Account_Name + - Client_Address + - Failure_Code + security_domain: endpoint + impact: 100 + confidence: 60 + risk_score: 60 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: A suspicious Kerberos Service Ticket was requested by $Account_Name$ + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml new file mode 100644 index 0000000000..769e3f4a24 --- /dev/null +++ b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml @@ -0,0 +1,68 @@ +name: Suspicious Ticket Granting Ticket Request +id: d77d349e-6269-11ec-9cfe-acde48001122 +version: 1 +date: '2021-12-21' +author: Mauricio Velazco, Splunk +type: Hunting +datamodel: +- Endpoint +description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller + Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request + a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed + computer account. The TGT request will be preceded by a computer account name event. + This analytic leverages Event Id 4781, `The name of an account was changed` and + event Id 4768 `A Kerberos authentication ticket (TGT) was requested` to correlate + a sequence of events where the new computer account on event id 4781 matches the + request account on event id 4768. This behavior could represent an exploitation + attempt of CVE-2021-42278 and CVE-2021-42287 for privilege escalation. +search: ' `wineventlog_security` (EventCode=4781 Old_Account_Name="*$" New_Account_Name!="*$") + OR (EventCode=4768 Account_Name!="*$") | eval RenamedComputerAccount = coalesce(New_Account_Name, + mvindex(Account_Name,0)) | transaction RenamedComputerAccount startswith=(EventCode=4781) + endswith=(EventCode=4768) | eval short_lived=case((duration<2),"TRUE") | search + short_lived = TRUE | table _time, ComputerName, EventCode, Account_Name,RenamedComputerAccount, + short_lived |`suspicious_ticket_granting_ticket_request_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + Domain Controller and Kerberos events. The Advanced Security Audit policy setting + `Audit Kerberos Authentication Service` within `Account Logon` needs to be enabled. +known_false_positives: A computer account name change event inmediately followed by + a kerberos TGT request with matching fields is unsual. However, legitimate behavior + may trigger it. Filter as needed. +references: +- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287 +tags: + analytic_story: + - sAMAccountName Spoofing and Domain Controller Impersonation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log + kill_chain_phases: + - Privilege Escalation + mitre_attack_id: + - T1078 + - T1078.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Old_Account_Name + - New_Account_Name + - Account_Name + - ComputerName + security_domain: endpoint + impact: 100 + confidence: 60 + risk_score: 60 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: A suspicious TGT was requested was requested + observable: + - name: ComputerName + type: Endpoint + role: + - Victim + automated_detection_testing: passed diff --git a/stories/domain_controller_impersonation_&_samaccountname_spoofing.yml b/stories/domain_controller_impersonation_&_samaccountname_spoofing.yml new file mode 100644 index 0000000000..9d385372ba --- /dev/null +++ b/stories/domain_controller_impersonation_&_samaccountname_spoofing.yml @@ -0,0 +1,29 @@ +name: sAMAccountName Spoofing and Domain Controller Impersonation +id: 0244fdee-61be-11ec-900e-acde48001122 +version: 1 +date: '2021-12-20' +author: Mauricio Velazco, Splunk +description: Monitor for activities and techniques associated with the exploitation of the sAMAccountName Spoofing (CVE-2021-42278) + and Domain Controller Impersonation (CVE-2021-42287) vulnerabilities. +narrative: On November 9, 2021, Microsoft released patches to address two vulnerabilities that affect Windows Active Directory networks, + sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287). On December 10, 2021, security researchers Charlie Clark and + Andrew Schwartz released a blog post where they shared how to weaponise these vulnerabilities in a target network an the initial detection opportunities. When successfully exploited, + CVE-2021-42278 and CVE-2021-42287 allow an adversary, who has stolen the credentials of a low priviled domain user, to obtain a Kerberos Service ticket for a + Domain Controller computer account. The only requirement is to have network connectivity to a domain controller. + This attack vector effectivelly allows attackers to escalate their privileges in an Active Directory from a regular domain user account + and take control of a domain controller. While patches have been released to address these vulnerabilities, deploying detection controls for this attack may help + help defenders identify attackers attempting exploitation. +references: +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42278 +- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42287 +- https://exploit.ph/cve-2021-42287-cve-2021-42278-weaponisation.html +tags: + analytic_story: + - sAMAccountName Spoofing and Domain Controller Impersonation + category: + - Privilege Escalation + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file diff --git a/tests/endpoint/outbound_network_connection_from_java_using_default_ports.test.yml b/tests/endpoint/outbound_network_connection_from_java_using_default_ports.test.yml index 09e3797d54..2f972aaf90 100644 --- a/tests/endpoint/outbound_network_connection_from_java_using_default_ports.test.yml +++ b/tests/endpoint/outbound_network_connection_from_java_using_default_ports.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: '-24h' latest_time: 'now' attack_data: - - file_name: linux-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/linux-sysmon.log - source: Syslog:Linux-Sysmon/Operational - sourcetype: sysmon_linux \ No newline at end of file + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/outbound_java/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/suspicious_computer_account_name_change.test.yml b/tests/endpoint/suspicious_computer_account_name_change.test.yml new file mode 100644 index 0000000000..18f8ebe21b --- /dev/null +++ b/tests/endpoint/suspicious_computer_account_name_change.test.yml @@ -0,0 +1,13 @@ +name: Suspicious Computer Account Name Change Unit Test +tests: +- name: Suspicious Computer Account Name Change + file: endpoint/suspicious_computer_account_name_change.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml b/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml new file mode 100644 index 0000000000..b101e3b2ce --- /dev/null +++ b/tests/endpoint/suspicious_kerberos_service_ticket_request.test.yml @@ -0,0 +1,13 @@ +name: Suspicious Kerberos Service Ticket Request Unit Test +tests: +- name: Suspicious Kerberos Service Ticket Request + file: endpoint/suspicious_kerberos_service_ticket_request.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file diff --git a/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml b/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml new file mode 100644 index 0000000000..b1c22e97be --- /dev/null +++ b/tests/endpoint/suspicious_ticket_granting_ticket_request.test.yml @@ -0,0 +1,13 @@ +name: Suspicious Ticket Granting Ticket Request Unit Test +tests: +- name: Suspicious Ticket Granting Ticket Request + file: endpoint/suspicious_ticket_granting_ticket_request.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/samaccountname_spoofing/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True \ No newline at end of file