adding new kerberos constrained delegation discovery

detections/endpoint/windows_powerview_constrained_delegation_discovery.yml

@@ -0,0 +1,67 @@
+name: Windows PowerView Constrained Delegation Discovery
+id: 86dc8176-6e6c-42d6-9684-5444c6557ab3
+version: 1
+date: '2022-03-31'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
+  to identify commandlets used by the PowerView hacking tool leveraged to discover Windows endpoints with Kerberos Constrained Delegation.
+  Red Teams and adversaries alike may leverage use this technique for situational awareness and Active Directory Discovery.
+search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*" OR Message = "*Get-NetComputer*")
+  AND (Message = "*-TrustedToAuth*") | stats count min(_time) as firstTime max(_time) as lastTime
+  by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `windows_powerview_constrained_delegation_discovery_filter`'
+how_to_implement: The following  analytic requires PowerShell operational logs
+  to be imported. Modify the powershell macro as needed to match the sourcetype or
+  add index. This analytic is specific to 4104, or PowerShell Script Block Logging.
+known_false_positives: Administrators or power users may leverage PowerView for system management or troubleshooting.
+references:
+- https://attack.mitre.org/techniques/T1018/
+- https://adsecurity.org/?p=1667
+- https://docs.microsoft.com/en-us/defender-for-identity/cas-isp-unconstrained-kerberos
+- https://www.guidepointsecurity.com/blog/delegating-like-a-boss-abusing-kerberos-delegation-in-active-directory/
+- https://book.hacktricks.xyz/windows/active-directory-methodology/constrained-delegation
+tags:
+  analytic_story:
+  - Active Directory Kerberos Attacks
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Discovery
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/constrained/windows-powershell.log
+  impact: 50
+  kill_chain_phases:
+  - Reconnaissance
+  message: Suspicious PowerShell Get-DomainComputer was identified on endpoint $ComputerName$
+  mitre_attack_id:
+  - T1018
+  nist:
+  - DE.CM
+  observable:
+  - name: ComputerName
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - EventCode
+  - Message
+  - ComputerName
+  - User
+  risk_score: 35
+  security_domain: endpoint

detections/endpoint/windows_powerview_unconstrained_delegation_discovery.yml

@@ -6,7 +6,7 @@ author: Mauricio Velazco, Splunk
 type: TTP
 datamodel: []
 description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104)
-  to identify commandlets used by the PowerView hacking tool leveraged to discovery Windows endpoints with Kerberos Unconstrained Delegation.
+  to identify commandlets used by the PowerView hacking tool leveraged to discover Windows endpoints with Kerberos Unconstrained Delegation.
   Red Teams and adversaries alike may leverage use this technique for situational awareness and Active Directory Discovery.
 search: '`powershell` EventCode=4104 (Message = "*Get-DomainComputer*" OR Message = "*Get-NetComputer*")
   AND (Message = "*-Unconstrained*") | stats count min(_time) as firstTime max(_time) as lastTime

tests/endpoint/windows_powerview_constrained_delegation_discovery.test.yml

@@ -0,0 +1,12 @@
+name: Windows PowerView Constrained Delegation Discovery Unit Test
+tests:
+- name: Windows PowerView Constrained Delegation Discovery
+  file: endpoint/windows_powerview_constrained_delegation_discovery.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/constrained/windows-powershell.log
+    source: WinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: WinEventLog