From 1b7f966a84bc5078df87b1e18528d65a2e8c8f68 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 21 Jun 2021 16:40:59 -0400 Subject: [PATCH 01/10] re-factoring windows event log cleared detections --- .../suspicious_event_log_service_behavior.yml | 47 +++++++++++++++++++ .../endpoint/windows_event_log_cleared.yml | 4 +- ...icious_event_log_service_behavior.test.yml | 13 +++++ 3 files changed, 62 insertions(+), 2 deletions(-) create mode 100644 detections/endpoint/suspicious_event_log_service_behavior.yml create mode 100644 tests/endpoint/suspicious_event_log_service_behavior.test.yml diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml new file mode 100644 index 0000000000..2070d99edc --- /dev/null +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -0,0 +1,47 @@ +name: Suspicious Event Log Service Behavior +id: 2b85aa3d-f5f6-4c2e-a081-a09f6e1c2e40 +version: 1 +date: '2021-06-17' +author: Mauricio Velazco, Splunk +type: batch +datamodel: [] +description: This search looks for Windows events that indicate the event logging service has been shut down. +search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode + dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `windows_event_log_cleared_filter` +how_to_implement: To successfully implement this search, you need to be ingesting + Windows event logs from your hosts. +known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. +references: [] +tags: + analytic_story: + - Windows Log Manipulation + - Ransomware + - Clop Ransomware + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 6 + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-system.log + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1070.001 + nist: + - DE.DP + - PR.IP + - PR.AC + - PR.AT + - DE.AE + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - EventCode + - dest + security_domain: endpoint diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index a2df6f11e6..ca4ece0ee9 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -1,13 +1,13 @@ name: Windows Event Log Cleared id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a -version: 4 +version: 5 date: '2020-07-06' author: Rico Valdez, Splunk type: batch datamodel: [] description: This search looks for Windows events that indicate one of the Windows event logs has been purged. -search: (`wineventlog_security` (EventCode=1102 OR EventCode=1100)) OR (`wineventlog_system` +search: (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter` diff --git a/tests/endpoint/suspicious_event_log_service_behavior.test.yml b/tests/endpoint/suspicious_event_log_service_behavior.test.yml new file mode 100644 index 0000000000..ff9de13f16 --- /dev/null +++ b/tests/endpoint/suspicious_event_log_service_behavior.test.yml @@ -0,0 +1,13 @@ +name: Suspicious Event Log Service Behavior +tests: +- name: Suspicious Event Log Service Behavior + file: endpoint/windows_event_log_cleared.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log + source: WinEventLog:Security + sourcetype: WinEventLog + update_timestamp: True From 8d0b0caa910501ac12e37b583698ee1390527b89 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 21 Jun 2021 16:45:52 -0400 Subject: [PATCH 02/10] Update suspicious_event_log_service_behavior.yml updating filter name --- detections/endpoint/suspicious_event_log_service_behavior.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 2070d99edc..0f9561bfcb 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -8,7 +8,7 @@ datamodel: [] description: This search looks for Windows events that indicate the event logging service has been shut down. search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_event_log_cleared_filter` + | `suspicious_event_log_service_behavior` how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. From e4f5a3894d1d8da0b005303128785fbf1d08125b Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 21 Jun 2021 17:10:54 -0400 Subject: [PATCH 03/10] fixing errors fixing filter name --- detections/endpoint/suspicious_event_log_service_behavior.yml | 2 +- dist/escu/default/macros.conf | 4 ++++ tests/endpoint/suspicious_event_log_service_behavior.test.yml | 2 +- 3 files changed, 6 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 0f9561bfcb..27bf78bf2c 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -8,7 +8,7 @@ datamodel: [] description: This search looks for Windows events that indicate the event logging service has been shut down. search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `suspicious_event_log_service_behavior` + | `suspicious_event_log_service_behavior_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 23ff0d0431..932b0c4e20 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -2087,6 +2087,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[suspicious_event_log_service_behavior] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_security_account_manager_stopped_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/tests/endpoint/suspicious_event_log_service_behavior.test.yml b/tests/endpoint/suspicious_event_log_service_behavior.test.yml index ff9de13f16..05382d554d 100644 --- a/tests/endpoint/suspicious_event_log_service_behavior.test.yml +++ b/tests/endpoint/suspicious_event_log_service_behavior.test.yml @@ -1,7 +1,7 @@ name: Suspicious Event Log Service Behavior tests: - name: Suspicious Event Log Service Behavior - file: endpoint/windows_event_log_cleared.yml + file: endpoint/suspicious_event_log_service_behavior.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From b3d2ddba5885e0094719f2d4c5e1ec48b52d51ae Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 21 Jun 2021 15:47:47 -0600 Subject: [PATCH 04/10] Minor fixes --- .../suspicious_event_log_service_behavior.yml | 7 ++++--- detections/endpoint/windows_event_log_cleared.yml | 11 ++++++----- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 27bf78bf2c..fae725c679 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -6,9 +6,10 @@ author: Mauricio Velazco, Splunk type: batch datamodel: [] description: This search looks for Windows events that indicate the event logging service has been shut down. -search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `suspicious_event_log_service_behavior_filter` +search: '(`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode, dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_event_log_service_behavior_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index ca4ece0ee9..da467a78b5 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -7,14 +7,15 @@ type: batch datamodel: [] description: This search looks for Windows events that indicate one of the Windows event logs has been purged. -search: (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` - EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_event_log_cleared_filter` +search: '(`wineventlog_security` EventCode=1102) OR (`wineventlog_system` + EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode, dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_event_log_cleared_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. known_false_positives: It is possible that these logs may be legitimately cleared - by Administrators. + by Administrators. Filter as needed. references: [] tags: analytic_story: From 19ea75d969d8a61d558328fb184ffe9bbd9e2c80 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 21 Jun 2021 17:50:09 -0400 Subject: [PATCH 05/10] adding references --- detections/endpoint/suspicious_event_log_service_behavior.yml | 3 ++- detections/endpoint/windows_event_log_cleared.yml | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 27bf78bf2c..0ff541b630 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -12,7 +12,8 @@ search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firs how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. -references: [] +references: + - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100 tags: analytic_story: - Windows Log Manipulation diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index ca4ece0ee9..7db56f97a0 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -15,7 +15,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin Windows event logs from your hosts. known_false_positives: It is possible that these logs may be legitimately cleared by Administrators. -references: [] +references: + - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102 tags: analytic_story: - Windows Log Manipulation From b7e73f5f60d8314058d67912a59a791be8a4d5ba Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 21 Jun 2021 16:14:31 -0600 Subject: [PATCH 06/10] quick updates --- .../suspicious_event_log_service_behavior.yml | 19 +++++++++++++------ .../endpoint/windows_event_log_cleared.yml | 10 ++++++---- 2 files changed, 19 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 0ff541b630..09ff3c6d59 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -5,15 +5,22 @@ date: '2021-06-17' author: Mauricio Velazco, Splunk type: batch datamodel: [] -description: This search looks for Windows events that indicate the event logging service has been shut down. -search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `suspicious_event_log_service_behavior_filter` +description: The following analytic utilizes Windows Event ID 1100 to identify when Windows event log service is shutdown. Note that, this is a voluminous analytic that will require tuning or restricted to specific endpoints based on criticality. + This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. + During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. +search: '(`wineventlog_security` EventCode=1100) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `suspicious_event_log_service_behavior_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - Windows event logs from your hosts. -known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. + Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. +known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. Filter as needed. references: - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100 + - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads + - https://attack.mitre.org/techniques/T1070/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md tags: analytic_story: - Windows Log Manipulation diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 7db56f97a0..1b322e2800 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -7,10 +7,12 @@ type: batch datamodel: [] description: This search looks for Windows events that indicate one of the Windows event logs has been purged. -search: (`wineventlog_security` EventCode=1102) OR (`wineventlog_system` - EventCode=104) | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_event_log_cleared_filter` +search: '(`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode + dest + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_event_log_cleared_filter`' how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. known_false_positives: It is possible that these logs may be legitimately cleared From 4166bb310438a849f2d07a1a3cae07e9897b22cb Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Mon, 21 Jun 2021 16:15:10 -0600 Subject: [PATCH 07/10] Update windows_event_log_cleared.yml --- detections/endpoint/windows_event_log_cleared.yml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 1b322e2800..42cdcd27ce 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -8,8 +8,7 @@ datamodel: [] description: This search looks for Windows events that indicate one of the Windows event logs has been purged. search: '(`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode - dest + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`' From 15a86efb8011b5c19ce717da12fb4600a1438dd5 Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 22 Jun 2021 14:24:22 -0600 Subject: [PATCH 08/10] Update suspicious_event_log_service_behavior.yml --- .../endpoint/suspicious_event_log_service_behavior.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 09ff3c6d59..383a298709 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -9,7 +9,7 @@ description: The following analytic utilizes Windows Event ID 1100 to identify w This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. search: '(`wineventlog_security` EventCode=1100) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest + | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName Message EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_event_log_service_behavior_filter`' @@ -31,9 +31,7 @@ tags: - CIS 3 - CIS 5 - CIS 6 - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-system.log + dataset: [] kill_chain_phases: - Actions on Objectives mitre_attack_id: From 192c2159f886a20716c6f13d09cc517f78a5b431 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 22 Jun 2021 20:45:30 +0000 Subject: [PATCH 09/10] Added detection testing service results inSuspicious Event Log Service Behavior --- .../suspicious_event_log_service_behavior.yml | 33 +++++++++++-------- 1 file changed, 19 insertions(+), 14 deletions(-) diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 383a298709..0992aa2c3b 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -5,22 +5,25 @@ date: '2021-06-17' author: Mauricio Velazco, Splunk type: batch datamodel: [] -description: The following analytic utilizes Windows Event ID 1100 to identify when Windows event log service is shutdown. Note that, this is a voluminous analytic that will require tuning or restricted to specific endpoints based on criticality. - This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. - During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. -search: '(`wineventlog_security` EventCode=1100) - | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName Message EventCode - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `suspicious_event_log_service_behavior_filter`' +description: The following analytic utilizes Windows Event ID 1100 to identify when + Windows event log service is shutdown. Note that, this is a voluminous analytic + that will require tuning or restricted to specific endpoints based on criticality. + This event generates every time Windows Event Log service has shut down. It also + generates during normal system shutdown. During triage, based on time of day and + user, determine if this was planned. If not planned, follow through with reviewing + parallel alerts and other data sources to determine what else may have occurred. +search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime + max(_time) as lastTime by ComputerName Message EventCode | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `suspicious_event_log_service_behavior_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. -known_false_positives: It is possible the Event Logging service gets shut down due to system errors or legitimately administration tasks. Filter as needed. +known_false_positives: It is possible the Event Logging service gets shut down due + to system errors or legitimately administration tasks. Filter as needed. references: - - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100 - - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads - - https://attack.mitre.org/techniques/T1070/001/ - - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md +- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1100 +- https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads +- https://attack.mitre.org/techniques/T1070/001/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md tags: analytic_story: - Windows Log Manipulation @@ -31,7 +34,8 @@ tags: - CIS 3 - CIS 5 - CIS 6 - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/atomic_red_team/windows-security.log kill_chain_phases: - Actions on Objectives mitre_attack_id: @@ -51,3 +55,4 @@ tags: - EventCode - dest security_domain: endpoint + automated_detection_testing: passed From f164626ac80699aca16b756344a78edf30d7c99c Mon Sep 17 00:00:00 2001 From: mhaag-spl <5632822+MHaggis@users.noreply.github.com> Date: Tue, 22 Jun 2021 14:59:47 -0600 Subject: [PATCH 10/10] Updated Windows event log cleared --- .../suspicious_event_log_service_behavior.yml | 4 ++-- .../endpoint/windows_event_log_cleared.yml | 19 ++++++++++++------- 2 files changed, 14 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 0992aa2c3b..40bbadb486 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -6,14 +6,14 @@ author: Mauricio Velazco, Splunk type: batch datamodel: [] description: The following analytic utilizes Windows Event ID 1100 to identify when - Windows event log service is shutdown. Note that, this is a voluminous analytic + Windows event log service is shutdown. Note that this is a voluminous analytic that will require tuning or restricted to specific endpoints based on criticality. This event generates every time Windows Event Log service has shut down. It also generates during normal system shutdown. During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing parallel alerts and other data sources to determine what else may have occurred. search: (`wineventlog_security` EventCode=1100) | stats count min(_time) as firstTime - max(_time) as lastTime by ComputerName Message EventCode | `security_content_ctime(firstTime)` + max(_time) as lastTime by dest Message EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_event_log_service_behavior_filter` how_to_implement: To successfully implement this search, you need to be ingesting Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 42cdcd27ce..2ba7c33006 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -1,23 +1,28 @@ name: Windows Event Log Cleared id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a -version: 5 +version: 6 date: '2020-07-06' -author: Rico Valdez, Splunk +author: Rico Valdez, Michael Haag, Splunk type: batch datamodel: [] -description: This search looks for Windows events that indicate one of the Windows - event logs has been purged. +description: The following analytic utilizes Windows Security Event ID 1102 or System log event 104 to identify when + a Windows event log is cleared. Note that this analytic will require tuning or restricted to specific endpoints based on criticality. + During triage, based on time of day and user, determine if this was planned. If not planned, follow through with reviewing + parallel alerts and other data sources to determine what else may have occurred. search: '(`wineventlog_security` EventCode=1102) OR (`wineventlog_system` EventCode=104) - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode dest + | stats count min(_time) as firstTime max(_time) as lastTime by dest Message EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_event_log_cleared_filter`' how_to_implement: To successfully implement this search, you need to be ingesting - Windows event logs from your hosts. + Windows event logs from your hosts. In addition, the Splunk Windows TA is needed. known_false_positives: It is possible that these logs may be legitimately cleared - by Administrators. + by Administrators. Filter as needed. references: - https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-1102 + - https://www.ired.team/offensive-security/defense-evasion/disabling-windows-event-logs-by-suspending-eventlog-service-threads + - https://attack.mitre.org/techniques/T1070/001/ + - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1070.001/T1070.001.md tags: analytic_story: - Windows Log Manipulation