diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml new file mode 100644 index 0000000000..c991e648d7 --- /dev/null +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -0,0 +1,49 @@ +name: Allow Inbound Traffic By Firewall Rule Registry +id: 0a46537c-be02-11eb-92ca-acde48001122 +version: 1 +date: '2021-05-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic detects a potential suspicious modification of firewall + rule registry allowing inbound traffic in specific port with public profile. This + technique was seen in some attacker want to have a remote access to a machine by + allowing the traffic in firewall rule. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" + Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = + "*|Dir=In|*" Registry.registry_value_name = "*|Profile=Public|*" Registry.registry_value_name + = "*|LPort=*" by Registry.registry_path Registry.registry_key_name Registry.user + Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `allow_inbound_traffic_by_firewall_rule_registry_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure + that this registry was included in your config files ex. sysmon config to be monitored. +known_false_positives: network admin may add/remove/modify public inbound firewall + rule that may cause this rule to be triggered. +references: +- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps +tags: + analytic_story: + - Prohibited Traffic Allowed or Protocol Mismatch + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1021.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.registry_value_name + - Registry.registry_key_name + - Registry.dest + - Registry.user + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml new file mode 100644 index 0000000000..8193070f70 --- /dev/null +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -0,0 +1,44 @@ +name: Allow Inbound Traffic In Firewall Rule +id: a5d85486-b89c-11eb-8267-acde48001122 +version: 1 +date: '2021-05-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect suspicious powershell command to allow inbound + traffic in specific local port with public profile. This technique was seen in some + attacker want to have a remote access to a machine by allowing the traffic in firewall + rule. +search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message + = "*Inbound*" Message = "*Allow*" Message = "*-LocalPort*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `allow_inbound_traffic_in_firewall_rule_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: administrator may allow inbound traffic in certain network + or machine. +references: +- https://docs.microsoft.com/en-us/powershell/module/netsecurity/new-netfirewallrule?view=windowsserver2019-ps +tags: + analytic_story: + - Prohibited Traffic Allowed or Protocol Mismatch + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1021.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml new file mode 100644 index 0000000000..eaf7807ce6 --- /dev/null +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -0,0 +1,46 @@ +name: Enable RDP In Other Port Number +id: 99495452-b899-11eb-96dc-acde48001122 +version: 1 +date: '2021-05-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect a modification to registry to enable rdp to + a machine with different port number. This technique was seen in some atttacker + tries to do lateral movement and remote access to a compromised machine to gain + control of it. +search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) + as registry_key_name values(Registry.registry_path) as registry_path min(_time) + as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.registry_path="*HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal + Server\\WinStations\\RDP-Tcp*" Registry.registry_key_name = "PortNumber" by Registry.dest + Registry.user Registry.registry_value_name | `security_content_ctime(lastTime)` + | `security_content_ctime(firstTime)` | `drop_dm_object_name(Registry)` | `enable_rdp_in_other_port_number_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: unknown +references: +- https://www.mvps.net/docs/how-to-secure-remote-desktop-rdp/ +tags: + analytic_story: + - Prohibited Traffic Allowed or Protocol Mismatch + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1021 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Registry.registry_path + - Registry.dest + - Registry.user + - Registry.registry_value_name + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml new file mode 100644 index 0000000000..b91f27648b --- /dev/null +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -0,0 +1,45 @@ +name: Mailsniper Invoke functions +id: a36972c8-b894-11eb-9f78-acde48001122 +version: 1 +date: '2021-05-19' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This search is to detect known mailsniper.ps1 functions executed in a + machine. This technique was seen in some attacker to harvest some sensitive e-mail + in a compromised exchange server. +search: '`powershell` EventCode=4104 Message IN ("*Invoke-GlobalO365MailSearch*", + "*Invoke-GlobalMailSearch*", "*Invoke-SelfSearch*", "*Invoke-PasswordSprayOWA*", + "*Invoke-PasswordSprayEWS*","*Invoke-DomainHarvestOWA*", "*Invoke-UsernameHarvestOWA*","*Invoke-OpenInboxFinder*","*Invoke-InjectGEventAPI*","*Invoke-InjectGEvent*","*Invoke-SearchGmail*", + "*Invoke-MonitorCredSniper*", "*Invoke-AddGmailRule*","*Invoke-PasswordSprayEAS*","*Invoke-UsernameHarvestEAS*") + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message + ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `mailsniper_invoke_functions_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the powershell logs from your endpoints. make sure you enable needed + registry to monitor this event. +known_false_positives: unknown +references: +- https://www.blackhillsinfosec.com/introducing-mailsniper-a-tool-for-searching-every-users-email-for-sensitive-data/ +tags: + analytic_story: + - Data Exfiltration + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1114.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - Message + - ComputerName + - User + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml new file mode 100644 index 0000000000..1a91a7be88 --- /dev/null +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -0,0 +1,51 @@ +name: SecretDumps Offline NTDS Dumping Tool +id: 5672819c-be09-11eb-bbfb-acde48001122 +version: 1 +date: '2021-05-26' +author: Teoderick Contreras, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic detects a potential usage of secretsdump.py tool for dumping + credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry + hive. This technique was seen in some attacker that dump ntlm hashes offline after + having a copy of ntds.dit and SAM/SYSTEM/SECURITY registry hive. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "python*.exe" + Processes.process = "*.py*" Processes.process = "*-ntds*" (Processes.process = "*-system*" + OR Processes.process = "*-sam*" OR Processes.process = "*-security*" OR Processes.process + = "*-bootkey*") by Processes.process_name Processes.process Processes.parent_process_name + Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid + | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `secretdumps_offline_ntds_dumping_tool_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: unknown +references: +- https://github.com/SecureAuthCorp/impacket/blob/master/examples/secretsdump.py +tags: + analytic_story: + - Credential Dumping + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1003.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + - Processes.parent_process_name + - Processes.parent_process + - Processes.dest Processes.user + - Processes.process_id + - Processes.process_guid + security_domain: endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log diff --git a/tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml b/tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml new file mode 100644 index 0000000000..39d282bf2b --- /dev/null +++ b/tests/endpoint/allow_inbound_traffic_by_firewall_rule_registry.test.yml @@ -0,0 +1,12 @@ +name: Allow Inbound Traffic By Firewall Rule Registry Unit Test +tests: +- name: Allow Inbound Traffic By Firewall Rule Registry + file: endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml b/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml new file mode 100644 index 0000000000..ac2dd09fa0 --- /dev/null +++ b/tests/endpoint/allow_inbound_traffic_in_firewall_rule.test.yml @@ -0,0 +1,12 @@ +name: Allow Inbound Traffic In Firewall Rule Unit Test +tests: +- name: Allow Inbound Traffic In Firewall Rule + file: endpoint/allow_inbound_traffic_in_firewall_rule.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/enable_rdp_in_other_port_number.test.yml b/tests/endpoint/enable_rdp_in_other_port_number.test.yml new file mode 100644 index 0000000000..25e3995cc1 --- /dev/null +++ b/tests/endpoint/enable_rdp_in_other_port_number.test.yml @@ -0,0 +1,12 @@ +name: Enable RDP In Other Port Number Unit Test +tests: +- name: Enable RDP In Other Port Number + file: endpoint/enable_rdp_in_other_port_number.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/mailsniper_invoke_functions.test.yml b/tests/endpoint/mailsniper_invoke_functions.test.yml new file mode 100644 index 0000000000..067c1bc19f --- /dev/null +++ b/tests/endpoint/mailsniper_invoke_functions.test.yml @@ -0,0 +1,12 @@ +name: Mailsniper Invoke functions Unit Test +tests: +- name: Mailsniper Invoke functions + file: endpoint/mailsniper_invoke_functions.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-powershell.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-powershell.log + source: WinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: WinEventLog \ No newline at end of file diff --git a/tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml b/tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml new file mode 100644 index 0000000000..061bd35c35 --- /dev/null +++ b/tests/endpoint/secretdumps_offline_ntds_dumping_tool.test.yml @@ -0,0 +1,12 @@ +name: SecretDumps Offline NTDS Dumping Tool Unit Test +tests: +- name: SecretDumps Offline NTDS Dumping Tool + file: endpoint/secretdumps_offline_ntds_dumping_tool.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/honeypots/casper/datasets1/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file