Branch was auto-updated.

detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml

@@ -0,0 +1,49 @@
+name: Allow Inbound Traffic By Firewall Rule Registry
+id: 0a46537c-be02-11eb-92ca-acde48001122
+version: 1
+date: '2021-05-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic detects a potential suspicious modification of firewall
+  rule registry allowing inbound traffic in specific port with public profile. This
+  technique was seen in some attacker want to have a remote access to a machine by
+  allowing the traffic in firewall rule.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*"
+  Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name =
+  "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" Registry.registry_value_name
+  = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user
+  Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`'
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure
+  that this registry was included in your config files ex. sysmon config to be monitored.
+known_false_positives: network admin may add/remove/modify public inbound firewall
+  rule that may cause this rule to be triggered.
+references:
+- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
+tags:
+  analytic_story:
+  - Prohibited Traffic Allowed or Protocol Mismatch
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1021.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.registry_value_name
+  - Registry.registry_key_name
+  - Registry.dest
+  - Registry.user
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log

detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml

@@ -0,0 +1,44 @@
+name: Allow Inbound Traffic In Firewall Rule
+id: a5d85486-b89c-11eb-8267-acde48001122
+version: 1
+date: '2021-05-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect suspicious powershell command to allow inbound
+  traffic in specific local port with public profile. This technique was seen in some
+  attacker want to have a remote access to a machine by allowing the traffic in firewall
+  rule.
+search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message
+  = "*Inbound*" Message = "*Allow*"  Message = "*-LocalPort*" | stats count min(_time)
+  as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+known_false_positives: administrator may allow inbound traffic in certain network
+  or machine.
+references:
+- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps
+tags:
+  analytic_story:
+  - Prohibited Traffic Allowed or Protocol Mismatch
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1021.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log

detections/endpoint/enable_rdp_in_other_port_number.yml

@@ -0,0 +1,46 @@
+name: Enable RDP In Other Port Number
+id: 99495452-b899-11eb-96dc-acde48001122
+version: 1
+date: '2021-05-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect a modification to registry to enable rdp to
+  a machine with different port number. This technique was seen in some atttacker
+  tries to do lateral movement and remote access to a compromised machine to gain
+  control of it.
+search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name)
+  as registry_key_name values(Registry.registry_path) as registry_path min(_time)
+  as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal
+  Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest
+  Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)`
+  | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
+known_false_positives: unknown
+references:
+- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/
+tags:
+  analytic_story:
+  - Prohibited Traffic Allowed or Protocol Mismatch
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1021
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Registry.registry_path
+  - Registry.dest
+  - Registry.user
+  - Registry.registry_value_name
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log

detections/endpoint/mailsniper_invoke_functions.yml

@@ -0,0 +1,45 @@
+name: Mailsniper Invoke functions
+id: a36972c8-b894-11eb-9f78-acde48001122
+version: 1
+date: '2021-05-19'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This search is to detect known mailsniper.ps1 functions executed in a
+  machine. This technique was seen in some attacker to harvest some sensitive e-mail
+  in a compromised exchange server.
+search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*",
+  "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*",
+  "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*",
+  "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*")
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message
+  ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `mailsniper_invoke_functions_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the powershell logs  from your endpoints. make sure you enable needed
+  registry to monitor this event.
+known_false_positives: unknown
+references:
+- https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/
+tags:
+  analytic_story:
+  - Data Exfiltration
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1114.001
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log

detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml

@@ -0,0 +1,51 @@
+name: SecretDumps Offline NTDS Dumping Tool
+id: 5672819c-be09-11eb-bbfb-acde48001122
+version: 1
+date: '2021-05-26'
+author: Teoderick Contreras, Splunk
+type: batch
+datamodel:
+- Endpoint
+description: This analytic detects a potential usage of secretsdump.py tool for dumping
+  credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry
+  hive. This technique was seen in some attacker that dump ntlm hashes offline after
+  having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
+  as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "python*.exe"
+  Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*"
+  OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process
+  = "*-bootkey*") by Processes.process_name Processes.process Processes.parent_process_name
+  Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid
+  | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `secretdumps_offline_ntds_dumping_tool_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: unknown
+references:
+- https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py
+tags:
+  analytic_story:
+  - Credential Dumping
+  kill_chain_phases:
+  - Exploitation
+  mitre_attack_id:
+  - T1003.003
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.process_name
+  - Processes.process
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.dest Processes.user
+  - Processes.process_id
+  - Processes.process_guid
+  security_domain: endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log

tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml

@@ -0,0 +1,12 @@
+name: Allow Inbound Traffic By Firewall Rule Registry Unit Test
+tests:
+- name: Allow Inbound Traffic By Firewall Rule Registry
+  file: endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml

@@ -0,0 +1,12 @@
+name: Allow Inbound Traffic In Firewall Rule Unit Test
+tests:
+- name: Allow Inbound Traffic In Firewall Rule
+  file: endpoint/allow_inbound_traffic_in_firewall_rule.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/enable_rdp_in_other_port_number.test.yml

@@ -0,0 +1,12 @@
+name: Enable RDP In Other Port Number Unit Test
+tests:
+- name: Enable RDP In Other Port Number
+  file: endpoint/enable_rdp_in_other_port_number.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog

tests/endpoint/mailsniper_invoke_functions.test.yml

@@ -0,0 +1,12 @@
+name: Mailsniper Invoke functions Unit Test
+tests:
+- name: Mailsniper Invoke functions
+  file: endpoint/mailsniper_invoke_functions.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog

tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml

@@ -0,0 +1,12 @@
+name: SecretDumps Offline NTDS Dumping Tool Unit Test
+tests:
+- name: SecretDumps Offline NTDS Dumping Tool
+  file: endpoint/secretdumps_offline_ntds_dumping_tool.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog