diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml new file mode 100644 index 0000000000..7f23ef53de --- /dev/null +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -0,0 +1,52 @@ +name: CMD Echo Pipe - Escalation +id: eb277ba0-b96b-11eb-b00e-acde48001122 +version: 1 +date: '2021-05-20' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: This analytic identifies a common behavior by Cobalt Strike and other + frameworks where the adversary will escalate privileges, either via `jump` (Cobalt + Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will + look like `cmd.exe /c echo 4sgryt3436 > \\.\Pipe\5erg53`. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=cmd.exe + OR Processes.process=*%comspec%*) (Processes.process=*echo* AND Processes.process=*pipe*) + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `cmd_echo_pipe___escalation_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Unknown. It is possible filtering may be required to ensure + fidelity. +references: +- https://redcanary.com/threat-detection-report/threats/cobalt-strike/ +- https://github.com/rapid7/meterpreter/blob/master/source/extensions/priv/server/elevate/namedpipe.c +tags: + analytic_story: + - Cobalt Strike + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + kill_chain_phases: + - Exploitation + - Privilege Escalation + mitre_attack_id: + - T1059.003 + - T1543.003 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml new file mode 100644 index 0000000000..60d457ee0e --- /dev/null +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -0,0 +1,55 @@ +name: Detect AzureHound Command-Line Arguments +id: 26f02e96-c300-11eb-b611-acde48001122 +version: 1 +date: '2021-06-01' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies the common command-line argument used + by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may + be modified, but these changes are dependent upon the operator. In most instances + the defaults are used. This analytic works to identify the common command-line attributes + used. It does not cover the entirety of every argument in order to avoid false positives. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*invoke-azurehound*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_azurehound_command_line_arguments_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: Unknown. +references: +- https://attack.mitre.org/software/S0521/ +- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors +- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 +- https://github.com/BloodHoundAD/BloodHound/blob/master/Collectors/AzureHound.ps1 +tags: + analytic_story: + - Discovery Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + - T1087.001 + - T1482 + - T1069.002 + - T1069.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml new file mode 100644 index 0000000000..29457b304e --- /dev/null +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -0,0 +1,56 @@ +name: Detect AzureHound File Modifications +id: 1c34549e-c31b-11eb-996b-acde48001122 +version: 1 +date: '2021-06-01' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic is similar to SharpHound file modifications, but + this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound + equivilent but for Azure. It's possible this may never be seen in an environment + as most attackers may execute this tool remotely. Once execution is complete, a + zip file with a similar name will drop `20210601090751-azurecollection.zip`. In + addition to the zip, multiple .json files will be written to disk, which are in + the zip. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*-azurecollection.zip", + "*-azprivroleadminrights.json", "*-azglobaladminrights.json", "*-azcloudappadmins.json", + "*-azapplicationadmins.json") by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name + Filesystem.file_path Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_azurehound_file_modifications_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on file modifications that include the name of the process, and file, responsible + for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` + node. +known_false_positives: False positives should be limited as the analytic is specific + to a filename with extension .zip. Filter as needed. +references: +- https://posts.specterops.io/introducing-bloodhound-4-0-the-azure-update-9b2b26c5e350 +- https://raw.githubusercontent.com/BloodHoundAD/BloodHound/master/Collectors/AzureHound.ps1 +tags: + analytic_story: + - Discovery Techniques + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + - T1087.001 + - T1482 + - T1069.002 + - T1069.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - file_path + - dest + - file_name + - process_id + - file_create_time + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index d257cbbeff..4853444bb1 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -35,6 +35,7 @@ tags: - DHS Report TA18-074A - HAFNIUM Group - DarkSide Ransomware + - Lateral Movement asset_type: Endpoint automated_detection_testing: passed cis20: diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml new file mode 100644 index 0000000000..e48b741092 --- /dev/null +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -0,0 +1,49 @@ +name: Detect Renamed 7-Zip +id: 4057291a-b8cf-11eb-95fe-acde48001122 +version: 1 +date: '2021-05-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies renamed 7-Zip usage using Sysmon. At + this stage of an attack, review parallel processes and file modifications for data + that is staged or potentially have been exfiltrated. This analytic utilizes the + OriginalFileName to capture the renamed process. +search: '`sysmon` EventID=1 (OriginalFileName=7z*.exe AND process_name!=7z*.exe) | + stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, + process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_7_zip_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Limited false positives, however this analytic will need to + be modified for each environment if Sysmon is not used. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md +tags: + analytic_story: + - Collection and Staging + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + kill_chain_phases: + - Exfiltration + mitre_attack_id: + - T1560.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - User + - parent_process_name + - process_name + - OriginalFileName + - process_path + - CommandLine + - Product + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml new file mode 100644 index 0000000000..c680170fbe --- /dev/null +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -0,0 +1,59 @@ +name: Detect Renamed PSExec +id: 683e6196-b8e8-11eb-9a79-acde48001122 +version: 1 +date: '2021-05-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies renamed instances of `PsExec.exe` being + utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` + or other SysInternal utility usage with the command-line argument of `-accepteula`. + In this instance, we are using `OriginalFileName` from Sysmon to identify `PsExec` + usage. During triage, validate this is the legitimate version of `PsExec` by review + the PE metadata. In addition, review parallel processes for further suspicious behavior. +search: '`sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) | + stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, + process_name, OriginalFileName, process_path, CommandLine Product | rename Computer + as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_renamed_psexec_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. +known_false_positives: Limited false positives should be present. It is possible some + third party applications may use older versions of PsExec, filter as needed. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1569.002/T1569.002.yaml +- https://redcanary.com/blog/threat-hunting-psexec-lateral-movement/ +tags: + analytic_story: + - SamSam Ransomware + - DHS Report TA18-074A + - HAFNIUM Group + - DarkSide Ransomware + - Lateral Movement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log + kill_chain_phases: + - Exploitation + - Lateral Movement + - Execution + mitre_attack_id: + - T1569.002 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - User + - parent_process_name + - process_name + - OriginalFileName + - process_path + - CommandLine + - Product + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml new file mode 100644 index 0000000000..36e298b533 --- /dev/null +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -0,0 +1,53 @@ +name: Detect Renamed WinRAR +id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 +version: 1 +date: '2021-05-19' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analtyic identifies renamed instances of `WinRAR.exe`. + In most cases, it is not common for WinRAR to be used renamed, however it is common + to be installed by a third party application and executed from a non-standard path. + In this instance, we are using `OriginalFileName` from Sysmon to determine if the + process is WinRAR. During triage, validate additional metadata from the binary that + this is `WinRAR`. Review parallel processes and file modifications. +search: '`sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, + parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product + | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_renamed_winrar_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Modify query for specific EDR products as needed. +known_false_positives: Unknown. It is possible third party applications use renamed + instances of WinRAR. +references: +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1560.001/T1560.001.md +tags: + analytic_story: + - Collection and Staging + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + kill_chain_phases: + - Exploitation + - Exfiltration + mitre_attack_id: + - T1560.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - User + - parent_process_name + - process_name + - OriginalFileName + - process_path + - CommandLine + - Product + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml new file mode 100644 index 0000000000..40a71caa63 --- /dev/null +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -0,0 +1,59 @@ +name: Detect SharpHound Command-Line Arguments +id: a0bdd2f6-c2ff-11eb-b918-acde48001122 +version: 1 +date: '2021-06-01' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies common command-line arguments used + by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, + function names may be modified, but these changes are dependent upon the operator. + In most instances the defaults are used. This analytic works to identify the common + command-line attributes used. It does not cover the entirety of every argument in + order to avoid false positives. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where Processes.process IN ("*-collectionMethod*","*invoke-bloodhound*") + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_sharphound_command_line_arguments_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. +known_false_positives: False positives should be limited as the arguments used are + specific to SharpHound. Filter as needed or add more command-line arguments as needed. +references: +- https://attack.mitre.org/software/S0521/ +- https://thedfirreport.com/?s=bloodhound +- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors +- https://github.com/BloodHoundAD/SharpHound3 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk +tags: + analytic_story: + - Discovery Techniques + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + - T1087.001 + - T1482 + - T1069.002 + - T1069.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml new file mode 100644 index 0000000000..cd97b9e36d --- /dev/null +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -0,0 +1,67 @@ +name: Detect SharpHound File Modifications +id: 42b4b438-beed-11eb-ba1d-acde48001122 +version: 1 +date: '2021-05-27' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. + SharpHound will query the domain controller and begin gathering all the data related + to the domain and trusts. For output, it will drop a .zip file upon completion following + a typical pattern that is often not changed. This analytic focuses on the default + file name scheme. Note that this may be evaded with different parameters within + SharpHound, but that depends on the operator. `-randomizefilenames` and `-encryptzip` + are two examples. In addition, executing SharpHound via .exe or .ps1 without any + command-line arguments will still perform activity and dump output to the default + filename. Example default filename `20210601181553_BloodHound.zip`. SharpHound creates + multiple temp files following the same pattern `20210601182121_computers.json`, + `domains.json`, `gpos.json`, `ous.json` and `users.json`. Tuning may be required, + or remove these json's entirely if it is too noisy. During traige, review parallel + processes for further suspicious behavior. Typically, the process executing the + `.ps1` ingestor will be PowerShell. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Filesystem where Filesystem.file_name IN ("*bloodhound.zip", + "*_computers.json", "*_gpos.json", "*_domains.json", "*_users.json", "*_groups.json") + by Filesystem.file_create_time Filesystem.process_id Filesystem.file_name Filesystem.file_path + Filesystem.dest | `drop_dm_object_name(Filesystem)` | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `detect_sharphound_file_modifications_filter`' +how_to_implement: To successfully implement this search you need to be ingesting information + on file modifications that include the name of the process, and file, responsible + for the changes from your endpoints into the `Endpoint` datamodel in the `Filesystem` + node. +known_false_positives: False positives should be limited as the analytic is specific + to a filename with extension .zip. Filter as needed. +references: +- https://attack.mitre.org/software/S0521/ +- https://thedfirreport.com/?s=bloodhound +- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors +- https://github.com/BloodHoundAD/SharpHound3 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk +tags: + analytic_story: + - Discovery Techniques + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + - T1087.001 + - T1482 + - T1069.002 + - T1069.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - file_path + - dest + - file_name + - process_id + - file_create_time + security_domain: endpoint + automated_detection_testing: passed diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml new file mode 100644 index 0000000000..5cac410070 --- /dev/null +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -0,0 +1,63 @@ +name: Detect SharpHound Usage +id: dd04b29a-beed-11eb-87bc-acde48001122 +version: 1 +date: '2021-05-27' +author: Michael Haag, Splunk +type: batch +datamodel: +- Endpoint +description: The following analytic identifies SharpHound binary usage by using the + `OriginalFileName` from Sysmon. In addition to renaming the PE, other coverage is + available to detect command-line arguments. This particular analytic only looks + for the OriginalFileName of `SharpHound.exe`. It is possible older instances of + SharpHound.exe have different original filenames. Dependent upon the operator, the + code may be re-compiled and the attributes removed or changed to anything else. + During triage, review the metadata of the binary in question. Review parallel processes + for suspicious behavior. Identify the source of this binary. +search: '`sysmon` EventID=1 (OriginalFileName=SharpHound.exe process_name!=sharphound.exe) + | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, + parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product + | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `detect_sharphound_usage_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: False positives should be limited as this is specific to a + file attribute not used by anything else. Filter as needed. +references: +- https://attack.mitre.org/software/S0521/ +- https://thedfirreport.com/?s=bloodhound +- https://github.com/BloodHoundAD/BloodHound/tree/master/Collectors +- https://github.com/BloodHoundAD/SharpHound3 +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md#atomic-test-2---run-bloodhound-from-local-disk +tags: + analytic_story: + - Discovery Techniques + - Ransomware + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + kill_chain_phases: + - Reconnaissance + mitre_attack_id: + - T1087.002 + - T1087.001 + - T1482 + - T1069.002 + - T1069.001 + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - dest + - User + - parent_process_name + - process_name + - OriginalFileName + - process_path + - CommandLine + - Product + security_domain: endpoint + automated_detection_testing: passed diff --git a/stories/windows_discovery_techniques.yml b/stories/windows_discovery_techniques.yml index 29a7004cf0..5b0a190e53 100644 --- a/stories/windows_discovery_techniques.yml +++ b/stories/windows_discovery_techniques.yml @@ -15,6 +15,7 @@ narrative: Attackers may not have much if any insight into their target's enviro references: - https://attack.mitre.org/tactics/TA0007/ - https://cyberd.us/penetration-testing + - https://attack.mitre.org/software/S0521/ tags: analytic_story: - Windows Discovery Techniques @@ -22,4 +23,7 @@ tags: - Adversary Tactics product: - Splunk Behavioral Analytics + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud usecase: Advanced Threat Detection diff --git a/tests/endpoint/cmd_echo_pipe___escalation.test.yml b/tests/endpoint/cmd_echo_pipe___escalation.test.yml new file mode 100644 index 0000000000..7cb42e8713 --- /dev/null +++ b/tests/endpoint/cmd_echo_pipe___escalation.test.yml @@ -0,0 +1,12 @@ +name: CMD Echo Pipe - Escalation Unit Test +tests: +- name: CMD Echo Pipe - Escalation + file: endpoint/cmd_echo_pipe___escalation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/detect_azurehound_command_line_arguments.test.yml b/tests/endpoint/detect_azurehound_command_line_arguments.test.yml new file mode 100644 index 0000000000..67a0591dcd --- /dev/null +++ b/tests/endpoint/detect_azurehound_command_line_arguments.test.yml @@ -0,0 +1,12 @@ +name: Detect AzureHound Command-Line Arguments Unit Test +tests: +- name: Detect AzureHound Command-Line Arguments + file: endpoint/detect_azurehound_command_line_arguments.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/detect_azurehound_file_modifications.test.yml b/tests/endpoint/detect_azurehound_file_modifications.test.yml new file mode 100644 index 0000000000..3db5f91274 --- /dev/null +++ b/tests/endpoint/detect_azurehound_file_modifications.test.yml @@ -0,0 +1,12 @@ +name: Detect AzureHound File Modifications Unit Test +tests: +- name: Detect AzureHound File Modifications + file: endpoint/detect_azurehound_file_modifications.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/detect_renamed_7_zip.test.yml b/tests/endpoint/detect_renamed_7_zip.test.yml new file mode 100644 index 0000000000..e0d0b5016b --- /dev/null +++ b/tests/endpoint/detect_renamed_7_zip.test.yml @@ -0,0 +1,12 @@ +name: Detect Renamed 7-Zip Unit Test +tests: +- name: Detect Renamed 7-Zip + file: endpoint/detect_renamed_7_zip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/detect_renamed_psexec.test.yml b/tests/endpoint/detect_renamed_psexec.test.yml new file mode 100644 index 0000000000..4433a31734 --- /dev/null +++ b/tests/endpoint/detect_renamed_psexec.test.yml @@ -0,0 +1,12 @@ +name: Detect Renamed PSExec Unit Test +tests: +- name: Detect Renamed PSExec + file: endpoint/detect_renamed_psexec.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/detect_renamed_winrar.test.yml b/tests/endpoint/detect_renamed_winrar.test.yml new file mode 100644 index 0000000000..62ae0f0c3d --- /dev/null +++ b/tests/endpoint/detect_renamed_winrar.test.yml @@ -0,0 +1,12 @@ +name: Detect Renamed WinRAR Unit Test +tests: +- name: Detect Renamed WinRAR + file: endpoint/detect_renamed_winrar.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog \ No newline at end of file diff --git a/tests/endpoint/detect_sharphound_command_line_arguments.test.yml b/tests/endpoint/detect_sharphound_command_line_arguments.test.yml new file mode 100644 index 0000000000..837aca3e30 --- /dev/null +++ b/tests/endpoint/detect_sharphound_command_line_arguments.test.yml @@ -0,0 +1,12 @@ +name: Detect SharpHound Command-Line Arguments Unit Test +tests: +- name: Detect SharpHound Command-Line Arguments + file: endpoint/detect_sharphound_command_line_arguments.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/detect_sharphound_file_modifications.test.yml b/tests/endpoint/detect_sharphound_file_modifications.test.yml new file mode 100644 index 0000000000..29fc4d865b --- /dev/null +++ b/tests/endpoint/detect_sharphound_file_modifications.test.yml @@ -0,0 +1,12 @@ +name: Detect SharpHound File Modifications Unit Test +tests: +- name: Detect SharpHound File Modifications + file: endpoint/detect_sharphound_file_modifications.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog diff --git a/tests/endpoint/detect_sharphound_usage.test.yml b/tests/endpoint/detect_sharphound_usage.test.yml new file mode 100644 index 0000000000..da4408fc50 --- /dev/null +++ b/tests/endpoint/detect_sharphound_usage.test.yml @@ -0,0 +1,12 @@ +name: Detect SharpHound Usage Unit Test +tests: +- name: Detect SharpHound Usage + file: endpoint/detect_sharphound_usage.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/sharphound/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog