admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added detection testing service results inDetect Exchange Web Shell, ProxyLogon

Browse Source
This commit is contained in:
root
2021-03-22 12:54:27 +00:00
parent 5f1b737ace
commit 3657fc8ea7
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/detect_exchange_web_shell.yml
+15 -8
View File
@@ -9,14 +9,19 @@ datamodel:
description: 'The following query identifies suspicious .aspx created in 3 paths identified
by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM
group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`,
and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional
and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious
on the surface. inspect the contents for script code inside. Identify additional
log sources, IIS included, to review source and other potential exploitation.'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*",
"*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path
| `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process]
| dedup file_create_time
| table dest file_create_time, file_name, file_path, process_name
| `detect_exchange_web_shell_filter`'
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name
Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [|
tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*",
"*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx"
by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name
Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time
file_name file_path process_name process_path process] | dedup file_create_time
| table dest file_create_time, file_name, file_path, process_name | `detect_exchange_web_shell_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem`
@@ -29,7 +34,8 @@ references:
tags:
analytic_story:
- HAFNIUM Group
dataset: []
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1505.003/windows-sysmon_proxylogon.log
kill_chain_phases:
- Exploitation
mitre_attack_id:
@@ -46,3 +52,4 @@ tags:
- Filesystem.file_hash
- Filesystem.user
security_domain: endpoint
automated_detection_testing: passed