Merge branch 'develop' into duplicate_nter

2026-06-08 17:32:49 +00:00 · 2023-02-06 16:58:51 -08:00
parent f44b2f1761 92fb614b61
commit 37e95ccdcc
78 changed files with 1227 additions and 17 deletions
@@ -166,8 +166,8 @@ setup_schema = {
                  },
                  "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
                    "app_number": 3110,
-                    "app_version": "4.5.0",
-                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz"
+                    "app_version": "4.5.1",
+                    "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz"
                  },
                  "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": {
                    "app_number": 3088,
@@ -102,8 +102,8 @@
    },
    "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": {
        "app_number": 3110,
-        "app_version": "4.5.0",
-        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz"
+        "app_version": "4.5.1",
+        "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz"
    },
    "SPLUNK_TA_FOR_IIS": {
      "app_number": 3185,
@@ -27,6 +27,7 @@ references: []
 tags:
  analytic_story:
  - Suspicious Cloud User Activities
+  - Compromised User Account
  asset_type: AWS Instance
  cis20:
  - CIS 16
@@ -0,0 +1,70 @@
+name: AWS Concurrent Sessions From Different Ips
+id: 51c04fdb-2746-465a-b86e-b413a09c9085
+version: 1
+date: '2023-02-01'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an AWS IAM account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. 
+  This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate
+  online resources. When a user navigates the AWS Console after authentication, the API call with the event name `DescribeEventAggregates` is registered in the AWS CloudTrail logs. The Splunk Threat Research team leveraged
+  this event name to identify 2 concurrent sessions. The presence of this event occurring from two different IP addresses is highly unlikely.
+  As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. 
+search: ' `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal" 
+  | bin span=5m _time 
+  | stats values(userAgent) values(eventName) values(src_ip) as src_ip  dc(src_ip) as distinct_ip_count by _time user_arn 
+  | where distinct_ip_count > 1 
+  | `aws_concurrent_sessions_from_different_ips_filter`'
+how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
+references:
+- https://attack.mitre.org/techniques/T1185/
+- https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/
+- https://github.com/kgretzky/evilginx2
+tags:
+  analytic_story:
+  - Compromised User Account
+  - AWS Identity and Access Management Account
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: User $user_arn$ has concurrent sessions from more than one unique IP address $src_ip$ in the span of 5 minutes.
+  mitre_attack_id:
+  - T1185
+  nist:
+  - DE.CM
+  observable:
+  - name: user_arn
+    type: User
+    role:
+    - Victim
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - user_arn
+  - aws_account_id
+  - src_ip
+  risk_score: 42
+  security_domain: threat
@@ -18,6 +18,7 @@ references:
 tags:
  analytic_story:
  - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
  asset_type: AWS Account
  cis20:
  - CIS 3
@@ -0,0 +1,67 @@
+name: AWS High Number Of Failed Authentications For User
+id: e3236f49-daf3-4b70-b808-9290912ac64d
+version: 1
+date: '2023-01-27'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies an AWS account with more than 20 failed authentication events in the span of 5 minutes. This behavior 
+  could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection.
+search: '`cloudtrail` eventName=ConsoleLogin action=failure 
+  | bucket span=10m _time
+  | stats dc(_raw) AS failed_attempts values(src_ip) as src_ip values(user_agent) by _time, user_name, eventName, eventSource aws_account_id 
+  | where failed_attempts > 20
+  | `aws_high_number_of_failed_authentications_for_user_filter`'
+how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
+references:
+- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html
+tags:
+  analytic_story:
+  - Compromised User Account
+  - AWS Identity and Access Management Account Takeover
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 70
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: User $user_name$ failed to authenticate more than 20 times in the span of 5 minutes for AWS Account $aws_account_id$
+  mitre_attack_id:
+  - T1201
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - requestParameters.userName
+  - eventSource
+  - user_arn
+  - aws_account_id
+  - src_ip
+  risk_score: 35
+  security_domain: threat
@@ -0,0 +1,69 @@
+name: AWS High Number Of Failed Authentications From Ip
+id: f75b7f1a-b8eb-4975-a214-ff3e0a944757
+version: 1
+date: '2023-01-30'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies an IP address failing to authenticate 20 or more times to the AWS Web Console in the span of 5 minutes. This behavior 
+  could represent a brute force attack against an AWS tenant to obtain initial access or elevate privileges. As environments differ across organizations, security teams should customize the threshold of this detection. 
+search: '`cloudtrail` eventName=ConsoleLogin action=failure
+  | bucket span=5m _time 
+  | stats dc(_raw) AS failed_attempts values(user_name) as tried_accounts values(user_agent) by _time, src_ip, eventName, eventSource aws_account_id 
+  | where failed_attempts > 20 
+  | `aws_high_number_of_failed_authentications_from_ip_filter`'
+how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
+known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
+references:
+- https://attack.mitre.org/techniques/T1110/003/
+- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/
+- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/
+tags:
+  analytic_story:
+  - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
+  asset_type: AWS Account
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 90
+  context:
+  - Source:Cloud Data
+  - Outcome:Blocked
+  - Stage:Recon
+  - Other:Brute Force
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$
+  mitre_attack_id:
+  - T1110
+  - T1110.003
+  - T1110.004
+  nist:
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: tried_accounts
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - user
+  - action
+  - eventName
+  - src_ip
+  risk_score: 54
+  security_domain: threat
+
@@ -6,7 +6,7 @@ author: Bhavin Patel
 type: Anomaly
 datamodel: []
 description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. 
-search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
+search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats  dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent |  where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`'
 how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment.
 known_false_positives: No known false postives for this detection. Please review this alert
 references:
@@ -16,6 +16,7 @@ references:
 tags:
  analytic_story:
  - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
  asset_type: AWS Account
  cis20:
  - CIS 3
@@ -0,0 +1,73 @@
+name: AWS New MFA Method Registered For User
+id: 4e3c26f2-4fb9-4bd7-ab46-1b76ffa2a23b
+version: 1
+date: '2023-01-31'
+author: Bhavin Patel, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies the registration of a new Multi Factor authentication method for an AWS account. Adversaries who have obtained unauthorized access to an AWS account may register a new MFA method to maintain persistence. 
+search: ' `cloudtrail` eventName=CreateVirtualMFADevice 
+  | stats count values(requestParameters.virtualMFADeviceName) as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn src_ip 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)`
+  | `aws_new_mfa_method_registered_for_user_filter`'
+how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This
+  search works when AWS CloudTrail logs.
+known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
+references:
+- https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/
+- https://attack.mitre.org/techniques/T1556/
+- https://attack.mitre.org/techniques/T1556/006/
+- https://twitter.com/jhencinski/status/1618660062352007174
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail.json
+  impact: 80
+  kill_chain_phases:
+  - Installation
+  - Actions on Objectives
+  message: A new virtual device $virtualMFADeviceName$ is added to user  $user_arn$
+  mitre_attack_id:
+  - T1556
+  - T1556.006
+  nist:
+  - DE.CM
+  observable:
+  - name: user_name
+    type: User
+    role:
+    - Victim
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - src_ip
+  - eventName 
+  - eventSource 
+  - requestParameters.virtualMFADeviceName 
+  - errorCode 
+  - userIdentity.principalId
+  - userAgent  
+  - awsRegion
+  - user_name 
+  - userIdentity.arn 
+  - _time
+  risk_score: 64
+  security_domain: identity
@@ -0,0 +1,65 @@
+name: AWS Password Policy Changes
+id: aee4a575-7064-4e60-b511-246f9baf9895
+version: 1
+date: '2023-01-26'
+author: Bhavin Patel, Splunk
+type: Hunting
+datamodel: []
+description: This search looks for AWS CloudTrail events where a user is making successful API calls to view/update/delete the existing password policy in an AWS organization. It is unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised.
+search: '`cloudtrail` eventName IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") errorCode=success | stats count values(eventName) as eventName values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode  awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`  | `aws_password_policy_changes_filter`'
+how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This
+  search works with AWS CloudTrail logs.
+known_false_positives: While this search has no known false positives, it is possible
+  that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event. 
+references:
+- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html
+tags:
+  analytic_story:
+  - AWS IAM Privilege Escalation
+  - Compromised User Account
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Privilege Escalation
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail.json
+  impact: 90
+  kill_chain_phases:
+  - Reconnaissance
+  message: User $user_arn$ is attempting to $eventName$ the password policy for account id $aws_account_id$
+  mitre_attack_id:
+  - T1201
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src_ip
+    type: IP Address
+    role:
+    - Attacker
+  - name: user_arn
+    type: User
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - eventName
+  - userAgent
+  - errorCode
+  - requestParameters.userName
+  - eventSource
+  - user_arn
+  - aws_account_id
+  - src_ip
+  risk_score: 72
+  security_domain: threat
@@ -0,0 +1,69 @@
+name: AWS Successful Console Authentication From Multiple IPs
+id: 395e50e1-2b87-4fa3-8632-0dfbdcbcd2cb
+version: 1
+date: '2023-01-19'
+author: Bhavin Patel, Splunk
+type: Anomaly
+datamodel: []
+description: The following analytic identifies an AWS account successfully authenticating from more than one unique Ip address in the span of 5 minutes. This behavior could represent
+  an adversary who has stolen credentials via a phishing attack or some other method and using them to access corporate online resources around the same time as a legitimate user.
+  As users may behave differently across organizations, security teams should test and customize this detection to fit their environments.
+search: ' `cloudtrail` eventName = ConsoleLogin 
+  | bin span=5m _time 
+  | stats values(userAgent) values(eventName) values(src_ip) dc(src_ip) as distinct_ip_count by _time user_arn 
+  | where distinct_ip_count>1 
+  | `aws_successful_console_authentication_from_multiple_ips_filter`'
+how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This
+  search works when AWS CloudTrail events are normalized use the Authentication datamodel.
+known_false_positives: A user with successful authentication events from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
+references:
+- https://rhinosecuritylabs.com/aws/mfa-phishing-on-aws/
+tags:
+  analytic_story:
+  - Suspicious AWS Login Activities
+  - Compromised User Account
+  asset_type: AWS Account
+  cis20:
+  - CIS 13
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Scope:External
+  - Outcome:Allowed
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json
+  impact: 90
+  kill_chain_phases:
+  - Actions on Objectives
+  message: User $user_arn$ has successfully logged into the AWS Console from different IP addresses $src$ within 5 mins
+  mitre_attack_id:
+  - T1586
+  - T1535
+  nist:
+  - PR.DS
+  - PR.AC
+  - DE.CM
+  observable:
+  - name: src
+    type: IP Address
+    role:
+    - Attacker
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Authentication.src
+  - Authentication.user
+  - Authentication.signature
+  - Authentication.user_agent
+  - Authentication.action 
+  - Authentication.user_type
+  risk_score: 72
+  security_domain: threat
@@ -0,0 +1,69 @@
+name: Azure AD Concurrent Sessions From Different Ips
+id: a9126f73-9a9b-493d-96ec-0dd06695490d
+version: 1
+date: '2023-01-24'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an Azure AD account with concurrent sessions coming from more than one unique Ip address within the span of 5 minutes. 
+  This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to 
+  access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments.
+search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs
+  | rename properties.* as *
+  | bucket span=5m _time
+  | stats  dc(ipAddress) AS unique_ips values(ipAddress) values(appDisplayName) by _time, userPrincipalName
+  | where unique_ips > 1
+  | `azure_ad_concurrent_sessions_from_different_ips_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). 
+  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
+references:
+- https://attack.mitre.org/techniques/T1185/
+- https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/
+- https://github.com/kgretzky/evilginx2
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 60
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: User $userPrincipalName$ has concurrent sessions from more than one unique IP address in the span of 5 minutes.
+  mitre_attack_id:
+  - T1185
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
+  risk_score: 42
+  security_domain: threat
@@ -0,0 +1,64 @@
+name: Azure AD High Number Of Failed Authentications For User
+id: 630b1694-210a-48ee-a450-6f79e7679f2c
+version: 1
+date: '2023-01-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an Azure AD account with more than 20 failed authentication events in the span of 5 minutes. This behavior 
+  could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection.
+search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
+| rename properties.* as *
+| bucket span=5m _time
+| stats  dc(_raw) AS failed_attempts  values(ipAddress) by userPrincipalName, _time
+| where failed_attempts > 20
+| `azure_ad_high_number_of_failed_authentications_for_user_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). 
+  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
+references:
+- https://attack.mitre.org/techniques/T1110/
+- https://attack.mitre.org/techniques/T1110/001/
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: User $userPrincipalName$ failed to authenticate more than 20 times in the span of 5 minutes.
+  mitre_attack_id:
+  - T1110
+  - T1110.001
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
+  risk_score: 35
+  security_domain: identity
@@ -0,0 +1,70 @@
+name: Azure AD High Number Of Failed Authentications From Ip
+id: e5ab41bf-745d-4f72-a393-2611151afd8e
+version: 1
+date: '2023-01-23'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an Ip address failing to authenticate 20 or more times to an Azure AD tenant in the span of 5 minutes. This behavior 
+  could represent a brute force attack againstan Azure AD to obtain initial access or elevate privileges. As environments differ across organizations, security teams should customize the threshold of this detection.
+search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false
+  | rename properties.* as *
+  | bucket span=5m _time
+  | stats  dc(_raw) AS failed_attempts values(userPrincipalName) by ipAddress, _time
+  | where failed_attempts > 20
+  | `azure_ad_high_number_of_failed_authentications_from_ip_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). 
+  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application.
+references:
+- https://attack.mitre.org/techniques/T1110/
+- https://attack.mitre.org/techniques/T1110/001/
+- https://attack.mitre.org/techniques/T1110/003/
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 70
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: $ipAddress$ failed to authenticate more than 20 times in the span of 5 minutes.
+  mitre_attack_id:
+  - T1110
+  - T1110.001
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
+  risk_score: 35
+  security_domain: identity
@@ -0,0 +1,71 @@
+name: Azure AD New MFA Method Registered For User
+id: 2628b087-4189-403f-9044-87403f777a1b
+version: 1
+date: '2023-01-30'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies the registration of a new Multi Factor authentication method for an Azure AD account. Adversaries who have obtained
+  unauthorized access to an Azure AD account may register a new MFA method to maintain persistence. 
+search: ' `azuread` category=AuditLogs operationName="User registered security info" properties.operationType=Add 
+  | rename properties.* as * 
+  | rename targetResources{}.* as *  
+  | stats  values(userPrincipalName) by _time, resultDescription, result, callerIpAddress
+  | `azure_ad_new_mfa_method_registered_for_user_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. 
+  Specifically, this analytic leverages the AuditLogs log category.
+known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection.
+references:
+- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks
+- https://attack.mitre.org/techniques/T1556/
+- https://attack.mitre.org/techniques/T1556/006/
+- https://twitter.com/jhencinski/status/1618660062352007174
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure Active Directory
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread.log
+  impact: 80
+  kill_chain_phases:
+  - Installation
+  - Actions on Objectives
+  message: UPDATE message
+  mitre_attack_id:
+  - T1556
+  - T1556.006
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: callerIpAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - category
+  - operationName
+  - properties.operationType
+  - userPrincipalName
+  - resultDescription
+  - result
+  - callerIpAddress
+  risk_score: 64
+  security_domain: identity
@@ -0,0 +1,72 @@
+name: Azure AD Successful Authentication From Different Ips
+id: be6d868d-33b6-4aaa-912e-724fb555b11a
+version: 1
+date: '2023-01-24'
+author: Mauricio Velazco, Splunk
+type: TTP
+datamodel: []
+description: The following analytic identifies an Azure AD account successfully authenticating from more than one unique Ip address in the span of 5 minutes. This behavior could represent
+  an adversary who has stolen credentials via a phishing attack or some other method and using them to access corporate online resources around the same time as a legitimate user.
+  As users may behave differently across organizations, security teams should test and customize this detection to fit their environments.
+search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=SignInLogs
+  | rename properties.* as *
+  | bucket span=5m _time
+  | stats  dc(ipAddress) AS unique_ips values(ipAddress) values(appDisplayName) by _time, userPrincipalName
+  | where unique_ips > 1
+  | `azure_ad_successful_authentication_from_different_ips_filter`'
+how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). 
+  You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs
+  log category.
+known_false_positives: A user with successful authentication events from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment.
+references:
+- T1110
+- T1110.001
+- T1110.003
+tags:
+  analytic_story:
+  - Compromised User Account
+  - Azure Active Directory Account Takeover
+  asset_type: Azure AD
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Cloud Data
+  - Stage:Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread.log
+  impact: 70
+  kill_chain_phases:
+  - Exploitation
+  message: User $userPrincipalName$ has had successful authentication events from more than one unique IP address in the span of 5 minutes.
+  mitre_attack_id:
+  - T1110
+  - T1110.001
+  - T1110.003
+  nist:
+  - DE.CM
+  observable:
+  - name: userPrincipalName
+    type: User
+    role:
+    - Victim
+  - name: ipAddress
+    type: IP Address
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - properties.status.errorCode
+  - category
+  - properties.authenticationDetails
+  - properties.userPrincipalName
+  - properties.ipAddress
+  - properties.appDisplayName
+  risk_score: 56
+  security_domain: identity
@@ -45,6 +45,7 @@ tags:
  - Suspicious AWS Login Activities
  - Suspicious Cloud Authentication Activities
  - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
  asset_type: AWS Instance
  cis20:
  - CIS 16
@@ -46,6 +46,7 @@ tags:
  - Suspicious AWS Login Activities
  - Suspicious Cloud Authentication Activities
  - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
  asset_type: AWS Instance
  cis20:
  - CIS 16
@@ -45,6 +45,7 @@ tags:
  - Suspicious AWS Login Activities
  - Suspicious Cloud Authentication Activities
  - AWS Identity and Access Management Account Takeover
+  - Compromised User Account
  asset_type: AWS Instance
  cis20:
  - CIS 16
@@ -41,6 +41,7 @@ tags:
  - ProxyNotShell
  - Qakbot
  - Chaos Ransomware
+  - AsyncRAT
  automated_detection_testing: passed
  confidence: 50
  context:
@@ -52,6 +52,8 @@ tags:
  - Trickbot
  - Chaos Ransomware
  - LockBit Ransomware
+  - AsyncRAT
+  - Swift Slicer
  automated_detection_testing: passed
  confidence: 50
  context:
@@ -2,7 +2,7 @@ name: Execution of File with Multiple Extensions
 id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7
 version: 3
 date: '2020-11-18'
-author: Rico Valdez, Splunk
+author: Rico Valdez, Teoderick Contreras, Splunk
 type: TTP
 datamodel:
 - Endpoint
@@ -10,21 +10,25 @@ description: This search looks for processes launched from files that have doubl
  extensions in the file name. This is typically done to obscure the "real" file extension
  and make it appear as though the file being accessed is a data file, as opposed
  to executable content.
-search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
-  as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe
-  OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process
-  = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by
-  Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`'
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes 
+  where Processes.process IN ("*.doc.exe", "*.xls.exe","*.ppt.exe", "*.htm.exe", "*.html.exe", "*.txt.exe", "*.pdf.exe", 
+  "*.docx.exe", "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*rtf.exe") 
+  by Processes.dest Processes.user Processes.process Processes.parent_process 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `drop_dm_object_name(Processes)` 
+  | `execution_of_file_with_multiple_extensions_filter`'
 how_to_implement: To successfully implement this search, you must be ingesting data
  that records process activity from your hosts to populate the endpoint data model
  in the processes node.
 known_false_positives: None identified.
-references: []
+references: 
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
  analytic_story:
  - Windows File Extension and Association Abuse
  - Masquerading - Rename System Utilities
+  - AsyncRAT
  asset_type: Endpoint
  cis20:
  - CIS 3
@@ -34,9 +34,11 @@ references:
 - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/
 - https://tria.ge/210929-ap75vsddan
 - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
  analytic_story:
  - Remcos
+  - AsyncRAT
  confidence: 100
  context:
  - Source:Endpoint
@@ -30,6 +30,7 @@ tags:
  - DHS Report TA18-074A
  - HAFNIUM Group
  - DarkCrystal RAT
+  - AsyncRAT
  asset_type: Endpoint
  cis20:
  - CIS 3
@@ -20,9 +20,11 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E
  During triage, review parallel processes using an EDR product or 4688 events. It
  will be important to understand the timeline of events around this activity. Review
  the entire logged PowerShell script block.'
-search: '`powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time)
-  as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
-  | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`'
+search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*gnirtS46esaBmorF*" 
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `powershell_fileless_script_contains_base64_encoded_content_filter`'
 how_to_implement: To successfully implement this analytic, you will need to enable
  PowerShell Script Block Logging on some or all endpoints. Additional setup here
  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
@@ -36,6 +38,7 @@ tags:
  analytic_story:
  - Hermetic Wiper 
  - Malicious PowerShell
+  - AsyncRAT
  confidence: 80
  context:
  - Source:Endpoint
@@ -38,6 +38,7 @@ tags:
  - Hermetic Wiper 
  - Malicious PowerShell
  - AgentTesla
+  - AsyncRAT
  confidence: 80
  context:
  - Source:Endpoint
@@ -30,6 +30,7 @@ tags:
  analytic_story:
  - Hermetic Wiper 
  - Malicious PowerShell
+  - AsyncRAT
  confidence: 80
  context:
  - Source:Endpoint
@@ -37,6 +37,7 @@ tags:
  - Industroyer2
  - Qakbot
  - LockBit Ransomware
+  - AsyncRAT
  confidence: 80
  context:
  - Source:Endpoint
@@ -56,6 +56,7 @@ tags:
  - Azorult
  - Qakbot
  - Chaos Ransomware
+  - AsyncRAT
  asset_type: Endpoint
  cis20:
  - CIS 8
@@ -35,6 +35,7 @@ tags:
  - Remcos
  - Hermetic Wiper
  - Living Off The Land
+  - AsyncRAT
  automated_detection_testing: passed
  confidence: 60
  context:
@@ -37,6 +37,7 @@ tags:
  - Remcos
  - Living Off The Land
  - Qakbot
+  - AsyncRAT
  confidence: 80
  context:
  - Source:Endpoint
@@ -39,6 +39,7 @@ tags:
  - Qakbot
  - Trickbot
  - Prestige Ransomware
+  - AsyncRAT
  asset_type: Endpoint
  cis20:
  - CIS 3
@@ -32,6 +32,7 @@ tags:
  - Unusual Processes
  - Qakbot
  - IcedID
+  - AsyncRAT
  confidence: 90
  context:
  - Stage:Execution
@@ -1,7 +1,7 @@
 name: Suspicious Process File Path
 id: 9be25988-ad82-11eb-a14f-acde48001122
 version: 1
-date: '2021-05-05'
+date: '2023-01-25'
 author: Teoderick Contreras, Splunk
 type: TTP
 datamodel:
@@ -31,6 +31,7 @@ references:
 - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/
 - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/
 - https://twitter.com/pr0xylife/status/1590394227758104576
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
  analytic_story:
  - Data Destruction 
@@ -50,6 +51,8 @@ tags:
  - Prestige Ransomware
  - Chaos Ransomware
  - LockBit Ransomware
+  - AsyncRAT
+  - Swift Slicer
  automated_detection_testing: passed
  confidence: 50
  context:
@@ -26,10 +26,12 @@ how_to_implement: To successfully implement this search you need to be ingesting
 known_false_positives: unknown
 references:
 - https://www.joesandbox.com/analysis/369332/0/html
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
  analytic_story:
  - FIN7
  - Remcos
+  - AsyncRAT
  confidence: 70
  context:
  - Source:Endpoint
@@ -22,9 +22,11 @@ references:
 - https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113
 - https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e
 - https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
 tags:
  analytic_story:
  - Brute Ratel C4
+  - AsyncRAT
  asset_type:  Endpoint
  cis20:
  - CIS 3
@@ -0,0 +1,69 @@
+name: Windows Powershell Cryptography Namespace
+id: f8b482f4-6d62-49fa-a905-dfa15698317b
+version: 1
+date: '2023-01-26'
+author: Teoderick Contreras, Splunk
+type: Anomaly
+datamodel:
+- Endpoint
+description: The following analytic identifies suspicious PowerShell script execution
+  via EventCode 4104 that is processing cryptography namespace library. 
+  This technique was seen in several powershell malware, loader, downloader and stager that will decrypt or decode the next malicious stager or the actual payload. 
+  This Anomaly detection can be a good indicator that a powershell process to decrypt code. We recommend to further check the parent_process_name, the file or data 
+  it tries to decrypt, network connection and user who execute the script.
+search: '`powershell` EventCode=4104 ScriptBlockText = "*System.Security.Cryptography*" AND NOT(ScriptBlockText IN ("*SHA*", "*MD5*", "*DeriveBytes*"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_powershell_cryptography_namespace_filter`'
+how_to_implement: To successfully implement this analytic, you will need to enable
+  PowerShell Script Block Logging on some or all endpoints. Additional setup here
+  https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
+known_false_positives: False positives should be limited. Filter as needed.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+tags:
+  analytic_story:
+  - AsyncRAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 50
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log
+  impact: 50
+  kill_chain_phases:
+  - Exploitation
+  message: A suspicious powershell script contains cryptography command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$
+  mitre_attack_id:
+  - T1059.001
+  - T1059
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Hostname
+    role:
+    - Victim
+  - name: User
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - ScriptBlockText
+  - Opcode
+  - Computer
+  - UserID
+  - EventCodes
+  risk_score: 25
+  security_domain: endpoint
@@ -0,0 +1,76 @@
+name: Windows Scheduled Task with Highest Privileges
+id: 2f15e1a4-0fc2-49dd-919e-cbbe60699218
+version: 1
+date: '2023-01-26'
+author: Teoderick Contreras, Splunk
+type: TTP
+datamodel:
+- Endpoint
+description: The following analytic identifies Schtasks.exe creating a new task with highest privilege execution. 
+  This techniques was seen in asyncrat where it uses the scheduled task as part of it persistence and privilege escalation. 
+  AsyncRAT will setup a scheduled task with parameter '/rl' and 'highest' to trigger this technique. This TTP detection can be a 
+  good indicator of malware or adversaries trying to gain persistence and privilege escalation through scheduled task. We recommend to always 
+  check and monitoring this type of events even filtering is needed.
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime  from datamodel=Endpoint.Processes 
+  where Processes.process_name = "schtasks.exe" Processes.process = "*/rl *" Processes.process = "* highest *"
+  by Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_guid Processes.dest Processes.user 
+  | `drop_dm_object_name(Processes)` 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `windows_scheduled_task_with_highest_privileges_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
+known_false_positives: False positives will be limited to legitimate applications
+  creating a task to run as SYSTEM. Filter as needed based on parent process, or modify
+  the query to have world writeable paths to restrict it.
+references:
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+tags:
+  analytic_story:
+  - AsyncRAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 80
+  context:
+  - Source:Endpoint
+  - Stage:Persistence
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log
+  impact: 80
+  kill_chain_phases:
+  - Exploitation
+  message: a $process_name$ creating a schedule task $process$ with highest run level privilege in $dest$
+  mitre_attack_id:
+  - T1053
+  - T1053.005
+  nist:
+  - DE.CM
+  observable:
+  - name: dest
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Processes.dest
+  - Processes.user
+  - Processes.parent_process_name
+  - Processes.parent_process
+  - Processes.original_file_name
+  - Processes.process_name
+  - Processes.process
+  - Processes.process_id
+  - Processes.parent_process_path
+  - Processes.process_path
+  - Processes.parent_process_id
+  risk_score: 64
+  security_domain: endpoint
@@ -0,0 +1,70 @@
+name: 'Windows Spearphishing Attachment Connect To None MS Office Domain'
+id: 1cb40e15-cffa-45cc-abbd-e35884a49766
+version: 1
+date: '2023-01-27'
+author: Teoderick Contreras, Splunk
+type: Hunting
+datamodel:
+- Endpoint
+description: this detection was designed to identifies suspicious office documents
+  that connect to a website aside from Microsoft Office Domain. This technique was seen in 
+  several malicious documents that abuses .rels xml properties of MS office to connect or download malicious files. 
+  This hunting query can a good pivot or guide to check what URL link it tries to connect, what domain, where the documents came from and 
+  how the connection happens.
+search: '`sysmon` EventCode=22 Image IN ("*\\winword.exe","*\\excel.exe","*\\powerpnt.exe","*\\mspub.exe","*\\visio.exe","*\\wordpad.exe","*\\wordview.exe","*\\onenote.exe",
+  "*\\onenotem.exe","*\\onenoteviewer.exe","*\\onenoteim.exe") 
+  AND NOT(QueryName IN ("*.office.com", "*.office.net"))
+  | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryResults QueryStatus Computer
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`'
+how_to_implement: To successfully implement this search, you need to be ingesting
+  logs with the process name, parent process, and command-line executions from your
+  endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
+  Sysmon TA.
+known_false_positives: Windows Office document may contain legitimate url link other than MS office Domain. filter is needed
+references:
+- https://www.netskope.com/blog/asyncrat-using-fully-undetected-downloader
+- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat
+tags:
+  analytic_story:
+  - Spearphishing Attachments
+  - AsyncRAT
+  asset_type: Endpoint
+  cis20:
+  - CIS 3
+  - CIS 5
+  - CIS 16
+  confidence: 30
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log
+  impact: 30
+  kill_chain_phases:
+  - Exploitation
+  message: a office document process $Image$ connect to an URL link $QueryName$ in $Computer$
+  mitre_attack_id:
+  - T1566.001
+  - T1566
+  nist:
+  - DE.CM
+  observable:
+  - name: Computer
+    type: Endpoint
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - Image 
+  - QueryName 
+  - QueryResults 
+  - QueryStatus 
+  - Computer
+  risk_score: 9
+  security_domain: endpoint
@@ -51,6 +51,7 @@ tags:
  - Industroyer2
  - CISA AA22-257A
  - Prestige Ransomware
+  - AsyncRAT
  confidence: 100
  context:
  - Source:Endpoint
@@ -36,6 +36,7 @@ tags:
  - CISA AA22-257A
  - Qakbot
  - Prestige Ransomware
+  - AsyncRAT
  confidence: 100
  context:
  - Source:Endpoint
@@ -0,0 +1,18 @@
+name: Compromised User Account
+id: 19669154-e9d1-4a01-b144-e6592a078092
+version: 1
+date: '2023-01-19'
+author: Mauricio Velazco, Bhavin Patel, Splunk
+description: Monitor for activities and techniques associated with Compromised User Account attacks.
+narrative: Compromised User Account occurs when cybercriminals gain unauthorized access to accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential signs of Compromised User Accounts.
+references:
+- https://www.proofpoint.com/us/threat-reference/compromised-account
+tags:
+  analytic_story: Compromised User Account
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection
@@ -0,0 +1,13 @@
+name: AWS Concurrent Sessions From Different Ips Unit Test
+tests:
+- name: AWS Concurrent Sessions From Different Ips
+  file: cloud/aws_concurrent_sessions_from_different_ips.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: AWS High Number Of Failed Authentications For User Unit Test
+tests:
+- name: AWS High Number Of Failed Authentications For User
+  file: cloud/aws_high_number_of_failed_authentications_for_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: AWS High Number Of Failed Authentications From Ip Unit Test
+tests:
+- name: AWS High Number Of Failed Authentications From Ip
+  file: cloud/aws_high_number_of_failed_authentications_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: aws_cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json
+    source: aws_cloudtrail
+    sourcetype: aws:cloudtrail
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: AWS New MFA Method Registered For User Unit Test
+tests:
+- name: AWS New MFA Method Registered For User
+  file: cloud/aws_new_mfa_method_registered_for_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: AWS Password Policy Changes Unit Test
+tests:
+- name: AWS Password Policy Changes
+  file: cloud/aws_password_policy_changes.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: AWS Successful Console Authentication From Multiple IPs Unit Test
+tests:
+- name: AWS Successful Console Authentication From Multiple IPs
+  file: cloud/aws_successful_console_authentication_from_multiple_ips.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -7d
+  latest_time: now
+  attack_data:
+  - file_name: cloudtrail.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: Azure AD Concurrent Sessions From Different Ips Unit Test
+tests:
+- name: Azure AD Concurrent Sessions From Different Ips
+  file: cloud/azure_ad_concurrent_sessions_from_different_ips.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azuread.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: Azure AD High Number Of Failed Authentications For User Unit Test
+tests:
+- name: Azure AD High Number Of Failed Authentications For User
+  file: cloud/azure_ad_high_number_of_failed_authentications_for_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azuread.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: Azure AD High Number Of Failed Authentications From Ip Unit Test
+tests:
+- name: Azure AD High Number Of Failed Authentications From Ip
+  file: cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azuread.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: Azure AD New MFA Method Registered For User Unit Test
+tests:
+- name: Azure AD New MFA Method Registered For User
+  file: cloud/azure_ad_new_mfa_method_registered_for_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azuread.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: Azure AD Successful Authentication From Different Ips Unit Test
+tests:
+- name: Azure AD Successful Authentication From Different Ips
+  file: cloud/azure_ad_successful_authentication_from_different_ips.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: azuread.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread.log
+    source: mscs:azure:eventhub
+    sourcetype: mscs:azure:eventhub
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: Windows Powershell Cryptography Namespace Unit Test
+tests:
+- name: Windows Powershell Cryptography Namespace
+  file: endpoint/windows_powershell_cryptography_namespace.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: windows-powershell-xml.log
+    data:  https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log
+    source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: Windows Scheduled Task with Highest Privileges Unit Test
+tests:
+- name: Windows Scheduled Task with Highest Privileges
+  file: endpoint/windows_scheduled_task_with_highest_privileges.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true
@@ -0,0 +1,13 @@
+name: Windows Spearphishing Attachment Connect To None MS Office Domain Unit Test
+tests:
+- name: 'Windows Spearphishing Attachment Connect To None MS Office Domain'
+  file: endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: -24h
+  latest_time: now
+  attack_data:
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog
+    update_timestamp: true