From d78f2a9eb7a7638abc8752467ea142b3dc814de7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 19 Jan 2023 17:01:48 -0500 Subject: [PATCH 01/45] new analytic story --- stories/compromised_user_account.yml | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) create mode 100644 stories/compromised_user_account.yml diff --git a/stories/compromised_user_account.yml b/stories/compromised_user_account.yml new file mode 100644 index 0000000000..e530f12edb --- /dev/null +++ b/stories/compromised_user_account.yml @@ -0,0 +1,16 @@ +name: Compromised User Account +id: 19669154-e9d1-4a01-b144-e6592a078092 +version: 1 +date: '2023-01-19' +author: Mauricio Velazco, Bhavin Patel, Splunk +description: UPDATE_DESCRIPTION +narrative: UPDATE_NARRATIVE +references: [] +tags: + analytic_story: Compromised User Account + category: [] + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection From 05aca8a58eddc55c894b00b032a45a6274e7858c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 19 Jan 2023 15:49:02 -0800 Subject: [PATCH 02/45] new aws detection --- .../aws_console_logins_from_multiple_ips.yml | 67 +++++++++++++++++++ ..._console_logins_from_multiple_ips.test.yml | 13 ++++ 2 files changed, 80 insertions(+) create mode 100644 detections/cloud/aws_console_logins_from_multiple_ips.yml create mode 100644 tests/cloud/aws_console_logins_from_multiple_ips.test.yml diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_console_logins_from_multiple_ips.yml new file mode 100644 index 0000000000..7a5eb822ef --- /dev/null +++ b/detections/cloud/aws_console_logins_from_multiple_ips.yml @@ -0,0 +1,67 @@ +name: AWS Console Logins From Multiple IPs +id: 395e50e1-2b87-4fa3-8632-0dfbdcbcd2cb +version: 1 +date: '2023-01-19' +author: Bhavin Patel, Splunk +type: Anomaly +datamodel: +- Authentication +description: This search looks for AWS CloudTrail authentication events where there are successfull AWS Console Login events from 2 or more different source IP addresses within a span of 5 mins. Often times, attackers with start with a phishing campaigns to commpromise cloud user accounts and would proceeed with trying to those use credentials before they would potentially expire or if the user rotates their credential then its no longer valid. Detecting successfull login attempts in from a short time window is a strong indicator of malicious behavior. +search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime dc(Authentication.src) as distinct_ip_count values(Authentication.src) as src_ip values(Authentication.user_agent) as user_agent values(Authentication.action) as action from datamodel=Authentication + where Authentication.signature=ConsoleLogin by _time span=5m Authentication.user Authentication.user_type +| `drop_dm_object_name(Authentication)` +| where distinct_ip_count >= 2 | `aws_console_logins_from_multiple_ips_filter`' +how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This + search works when AWS CloudTrail events are normalized use the Authentication datamodel. +known_false_positives: It is highly unlikely to have two login attempts from entirely differnt IP addresses. +references: +- https://rhinosecuritylabs.com/aws/mfa-phishing-on-aws/ +tags: + analytic_story: + - Suspicious AWS Login Activities + asset_type: AWS Account + cis20: + - CIS 13 + confidence: 80 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json + impact: 90 + kill_chain_phases: + - Actions on Objectives + message: User $user$ has successfully logged into the AWS Console from different IP addresses $src$ with 5 mins + mitre_attack_id: + - T1586 + - T1586.003 + - T1535 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src + type: IP Address + role: + - Attacker + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Authentication.src + - Authentication.user + - Authentication.signature + - Authentication.user_agent + - Authentication.action + - Authentication.user_type + risk_score: 72 + security_domain: threat diff --git a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml new file mode 100644 index 0000000000..2fe61c69da --- /dev/null +++ b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml @@ -0,0 +1,13 @@ +name: AWS Console Logins From Multiple IPs Unit Test +tests: +- name: AWS Console Logins From Multiple IPs + file: cloud/aws_console_logins_from_multiple_ips.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file From 4b24cc6d533d20e009ebea6baa9d10a6dd9bfdab Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 19 Jan 2023 16:01:20 -0800 Subject: [PATCH 03/45] tagging aws relevant detection draft --- .../abnormally_high_number_of_cloud_infrastructure_api_calls.yml | 1 + .../cloud/aws_console_login_failed_during_mfa_challenge.yml | 1 + detections/cloud/aws_console_logins_from_multiple_ips.yml | 1 + .../cloud/detect_aws_console_login_by_user_from_new_city.yml | 1 + .../cloud/detect_aws_console_login_by_user_from_new_country.yml | 1 + .../cloud/detect_aws_console_login_by_user_from_new_region.yml | 1 + 6 files changed, 6 insertions(+) diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index b9b1648f44..7ea17bbea4 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -27,6 +27,7 @@ references: [] tags: analytic_story: - Suspicious Cloud User Activities + - Compromised User Account asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml index 38b241aff2..a99ad315ee 100644 --- a/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml +++ b/detections/cloud/aws_console_login_failed_during_mfa_challenge.yml @@ -18,6 +18,7 @@ references: tags: analytic_story: - AWS Identity and Access Management Account Takeover + - Compromised User Account asset_type: AWS Account cis20: - CIS 3 diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_console_logins_from_multiple_ips.yml index 7a5eb822ef..40d881cbed 100644 --- a/detections/cloud/aws_console_logins_from_multiple_ips.yml +++ b/detections/cloud/aws_console_logins_from_multiple_ips.yml @@ -19,6 +19,7 @@ references: tags: analytic_story: - Suspicious AWS Login Activities + - Compromised User Account asset_type: AWS Account cis20: - CIS 13 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 8e9b146e12..f532929c78 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -45,6 +45,7 @@ tags: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - AWS Identity and Access Management Account Takeover + - Compromised User Account asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index e7c56a9109..c04c3450c0 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -46,6 +46,7 @@ tags: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - AWS Identity and Access Management Account Takeover + - Compromised User Account asset_type: AWS Instance cis20: - CIS 16 diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index e488247f0d..2d05ca3bd0 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -45,6 +45,7 @@ tags: - Suspicious AWS Login Activities - Suspicious Cloud Authentication Activities - AWS Identity and Access Management Account Takeover + - Compromised User Account asset_type: AWS Instance cis20: - CIS 16 From 090e5c4bee27e2a77512e864b4b156a600e5e4e6 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 19 Jan 2023 16:38:20 -0800 Subject: [PATCH 04/45] yml changes --- detections/cloud/aws_console_logins_from_multiple_ips.yml | 1 - tests/cloud/aws_console_logins_from_multiple_ips.test.yml | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_console_logins_from_multiple_ips.yml index 40d881cbed..d1785df1d2 100644 --- a/detections/cloud/aws_console_logins_from_multiple_ips.yml +++ b/detections/cloud/aws_console_logins_from_multiple_ips.yml @@ -37,7 +37,6 @@ tags: message: User $user$ has successfully logged into the AWS Console from different IP addresses $src$ with 5 mins mitre_attack_id: - T1586 - - T1586.003 - T1535 nist: - PR.DS diff --git a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml index 2fe61c69da..42d59f1013 100644 --- a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml +++ b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - file_name: cloudtrail.json + - file_name: cloudtrail.json data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1586.003/aws_console_login_multiple_ips/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail From 5f165066974b1c72b1c858b8f36ce4c005dbb886 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 23 Jan 2023 17:31:48 -0500 Subject: [PATCH 05/45] adding new azure ad brute force detection --- ...ber_of_failed_authentications_for_user.yml | 63 +++++++++++++++++++ stories/compromised_user_account.yml | 2 +- ...f_failed_authentications_for_user.test.yml | 13 ++++ 3 files changed, 77 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml create mode 100644 tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml new file mode 100644 index 0000000000..d1b8611199 --- /dev/null +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml @@ -0,0 +1,63 @@ +name: Azure AD High Number Of Failed Authentications For User +id: 630b1694-210a-48ee-a450-6f79e7679f2c +version: 1 +date: '2023-01-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies an Azure AD account with more than 20 failed authentication events in the span of 5 minutes. This behavior + could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection. +search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false +| rename properties.* as * +| bucket span=5m _time +| stats dc(_raw) AS failed_attempts values(ipAddress) by userPrincipalName, _time +| where failed_attempts > 20 +| `azure_ad_high_number_of_failed_authentications_for_user_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. +references: +- https://attack.mitre.org/techniques/T1110/001/ +tags: + analytic_story: + - Compromised User Account + asset_type: Azure AD + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + impact: 50 + kill_chain_phases: + - Exploitation + message: User $userPrincipalName$ failed to authenticate more than 20 times in the span of 5 minutes. + mitre_attack_id: + - T1110 + - T1110.001 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress + risk_score: 35 + security_domain: identity diff --git a/stories/compromised_user_account.yml b/stories/compromised_user_account.yml index e530f12edb..d73a0510ae 100644 --- a/stories/compromised_user_account.yml +++ b/stories/compromised_user_account.yml @@ -3,7 +3,7 @@ id: 19669154-e9d1-4a01-b144-e6592a078092 version: 1 date: '2023-01-19' author: Mauricio Velazco, Bhavin Patel, Splunk -description: UPDATE_DESCRIPTION +description: Monitor for activities and techniques associated with Compromised User Account attacks. narrative: UPDATE_NARRATIVE references: [] tags: diff --git a/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml new file mode 100644 index 0000000000..0e25e156c4 --- /dev/null +++ b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml @@ -0,0 +1,13 @@ +name: Azure AD High Number Of Failed Authentications For User Unit Test +tests: +- name: Azure AD High Number Of Failed Authentications For User + file: cloud/azure_ad_high_number_of_failed_authentications_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azure-audit.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true \ No newline at end of file From a7f6ddbfeb2cc50914cd8c6ff3d2d9b5b0fbb984 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 23 Jan 2023 20:46:00 -0500 Subject: [PATCH 06/45] adding new azure ad brute force detection --- ...ber_of_failed_authentications_for_user.yml | 1 + ...mber_of_failed_authentications_from_ip.yml | 69 +++++++++++++++++++ ...f_failed_authentications_for_user.test.yml | 2 +- ...of_failed_authentications_from_ip.test.yml | 13 ++++ 4 files changed, 84 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml create mode 100644 tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml index d1b8611199..44a7660637 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml @@ -19,6 +19,7 @@ how_to_implement: You must install the latest version of Splunk Add-on for Micro log category. known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. references: +- https://attack.mitre.org/techniques/T1110/ - https://attack.mitre.org/techniques/T1110/001/ tags: analytic_story: diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml new file mode 100644 index 0000000000..8c0c20cf28 --- /dev/null +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml @@ -0,0 +1,69 @@ +name: Azure AD High Number Of Failed Authentications From Ip +id: e5ab41bf-745d-4f72-a393-2611151afd8e +version: 1 +date: '2023-01-23' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies an Ip address which failing to authenticate 20 or more times to an Azure AD tenant in the span of 5 minutes. This behavior + could represent a brute force attack againstan Azure AD. As environments differ across organizations, security teams should customize the threshold of this detection. +search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false + | rename properties.* as * + | bucket span=5m _time + | stats dc(_raw) AS failed_attempts values(userPrincipalName) by ipAddress, _time + | where failed_attempts > 20 + | `azure_ad_high_number_of_failed_authentications_from_ip_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. +references: +- https://attack.mitre.org/techniques/T1110/ +- https://attack.mitre.org/techniques/T1110/001/ +- https://attack.mitre.org/techniques/T1110/003/ +tags: + analytic_story: + - Compromised User Account + asset_type: Azure AD + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 70 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + impact: 50 + kill_chain_phases: + - Exploitation + message: $ipAddress$ failed to authenticate more than 20 times in the span of 5 minutes. + mitre_attack_id: + - T1110 + - T1110.001 + - T1110.003 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress + risk_score: 35 + security_domain: identity diff --git a/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml index 0e25e156c4..5ca2a596ea 100644 --- a/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml +++ b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: azure-audit.log + - file_name: azuread.log data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_high_number_of_failed_authentications_for_user/azuread.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub diff --git a/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml new file mode 100644 index 0000000000..2fd8ca9235 --- /dev/null +++ b/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml @@ -0,0 +1,13 @@ +name: Azure AD High Number Of Failed Authentications From Ip Unit Test +tests: +- name: Azure AD High Number Of Failed Authentications From Ip + file: cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From faedd6645ab76e23e31456fc85a0d251319ba71a Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 24 Jan 2023 14:02:06 -0500 Subject: [PATCH 07/45] adding new detection for azure ad session hijacking --- ...concurrent_sessions_from_different_ips.yml | 68 +++++++++++++++++++ ...ber_of_failed_authentications_for_user.yml | 3 +- ...rrent_sessions_from_different_ips.test.yml | 13 ++++ 3 files changed, 82 insertions(+), 2 deletions(-) create mode 100644 detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml create mode 100644 tests/cloud/azure_ad_concurrent_sessions_from_different_ips.test.yml diff --git a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml new file mode 100644 index 0000000000..72df8ef9c7 --- /dev/null +++ b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml @@ -0,0 +1,68 @@ +name: Azure AD Concurrent Sessions From Different Ips +id: a9126f73-9a9b-493d-96ec-0dd06695490d +version: 1 +date: '2023-01-24' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies an Azure AD account with concurrent sessions coming from more than one unique Ip addresses within the span of 5 minutes. + This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to + access corporate online resources. As users may behave different across organizations, security teams should test and customize this detection to fit their environments. +search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs + | rename properties.* as * + | bucket span=5m _time + | stats dc(ipAddress) AS unique_ips values(ipAddress) values(appDisplayName) by _time, userPrincipalName + | where unique_ips > 1 + | `azure_ad_concurrent_sessions_from_different_ips_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment. +references: +- https://attack.mitre.org/techniques/T1185/ +- https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/ +- https://github.com/kgretzky/evilginx2 +tags: + analytic_story: + - Compromised User Account + asset_type: Azure AD + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread.log + impact: 70 + kill_chain_phases: + - Exploitation + message: User $userPrincipalName$ has concurrent sessions from more than one unique IP address in the span of 5 minutes. + mitre_attack_id: + - T1185 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress + risk_score: 42 + security_domain: threat diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml index 44a7660637..476a04a4a2 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml @@ -4,8 +4,7 @@ version: 1 date: '2023-01-23' author: Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic identifies an Azure AD account with more than 20 failed authentication events in the span of 5 minutes. This behavior could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection. search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false diff --git a/tests/cloud/azure_ad_concurrent_sessions_from_different_ips.test.yml b/tests/cloud/azure_ad_concurrent_sessions_from_different_ips.test.yml new file mode 100644 index 0000000000..553df17d5f --- /dev/null +++ b/tests/cloud/azure_ad_concurrent_sessions_from_different_ips.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Concurrent Sessions From Different Ips Unit Test +tests: +- name: Azure AD Concurrent Sessions From Different Ips + file: cloud/azure_ad_concurrent_sessions_from_different_ips.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/azure_ad_concurrent_sessions_from_different_ips/azuread.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 0c79ce7d966d018142f2567c90b0eddb33d6104b Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 24 Jan 2023 18:50:51 -0500 Subject: [PATCH 08/45] adding new detection --- ...concurrent_sessions_from_different_ips.yml | 4 +- ...sful_authentication_from_different_ips.yml | 70 +++++++++++++++++++ ...authentication_from_different_ips.test.yml | 13 ++++ 3 files changed, 85 insertions(+), 2 deletions(-) create mode 100644 detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml create mode 100644 tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml diff --git a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml index 72df8ef9c7..6d57a712bc 100644 --- a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml @@ -5,9 +5,9 @@ date: '2023-01-24' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic identifies an Azure AD account with concurrent sessions coming from more than one unique Ip addresses within the span of 5 minutes. +description: The following analytic identifies an Azure AD account with concurrent sessions coming from more than one unique Ip address within the span of 5 minutes. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to - access corporate online resources. As users may behave different across organizations, security teams should test and customize this detection to fit their environments. + access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=NonInteractiveUserSignInLogs | rename properties.* as * | bucket span=5m _time diff --git a/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml new file mode 100644 index 0000000000..75f3890ac1 --- /dev/null +++ b/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml @@ -0,0 +1,70 @@ +name: Azure AD Succesful Authentication From Different Ips +id: be6d868d-33b6-4aaa-912e-724fb555b11a +version: 1 +date: '2023-01-24' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies an Azure AD account successfully authenticating from more than one unique Ip address in the span of 5 minutes. This behavior could represent + an adversary who has stolen credentials via a phishing attack or some other method and using them to access corporate online resources around the same time as a legitimate user. + As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. +search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=SignInLogs + | rename properties.* as * + | bucket span=5m _time + | stats dc(ipAddress) AS unique_ips values(ipAddress) values(appDisplayName) by _time, userPrincipalName + | where unique_ips > 1 + | `azure_ad_succesful_authentication_from_different_ips_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). + You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs + log category. +known_false_positives: A user with successful authentication events from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment. +references: +- T1110 +- T1110.001 +- T1110.003 +tags: + analytic_story: + - Compromised User Account + asset_type: Azure AD + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_succesful_authentication_from_different_ips/azuread.log + impact: 70 + kill_chain_phases: + - Exploitation + message: User $userPrincipalName$ has had successful authentication events from more than one unique IP address in the span of 5 minutes. + mitre_attack_id: + - T1110 + - T1110.001 + - T1110.003 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: ipAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - properties.status.errorCode + - category + - properties.authenticationDetails + - properties.userPrincipalName + - properties.ipAddress + risk_score: 56 + security_domain: identity \ No newline at end of file diff --git a/tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml b/tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml new file mode 100644 index 0000000000..61fc50f54d --- /dev/null +++ b/tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml @@ -0,0 +1,13 @@ +name: Azure AD Succesful Authentication From Different Ips Unit Test +tests: +- name: Azure AD Succesful Authentication From Different Ips + file: cloud/azure_ad_succesful_authentication_from_different_ips.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_succesful_authentication_from_different_ips/azuread.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From f1628eefd36ec0c01b570b0f49cc77b57eb1c2c1 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 25 Jan 2023 15:08:29 +0100 Subject: [PATCH 09/45] asyncrat-onenote-chain2 --- ...cmd_carry_out_string_command_parameter.yml | 1 + ..._or_script_creation_in_suspicious_path.yml | 1 + ...ution_of_file_with_multiple_extensions.yml | 20 +++++++++++-------- .../endpoint/loading_of_dynwrapx_module.yml | 2 ++ ...hell_process___execution_policy_bypass.yml | 1 + ...script_contains_base64_encoded_content.yml | 9 ++++++--- ...ding_dotnet_into_memory_via_reflection.yml | 1 + .../powershell_processing_stream_of_data.yml | 1 + detections/endpoint/recon_using_wmi_class.yml | 1 + ...2_silent_and_install_param_dll_loading.yml | 1 + ...svr32_with_known_silent_switch_cmdline.yml | 1 + ...eduled_task_deleted_or_created_via_cmd.yml | 1 + .../endpoint/suspicious_copy_on_system32.yml | 1 + .../vbscript_execution_using_wscript_app.yml | 2 ++ ...eduled_task_created_within_public_path.yml | 1 + ...ws_task_scheduler_event_action_started.yml | 1 + 16 files changed, 34 insertions(+), 11 deletions(-) diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index c19a9120a2..1239ddecd3 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -41,6 +41,7 @@ tags: - ProxyNotShell - Qakbot - Chaos Ransomware + - AsyncRAT automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 636a33c60c..90c96e45b9 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -52,6 +52,7 @@ tags: - Trickbot - Chaos Ransomware - LockBit Ransomware + - AsyncRAT automated_detection_testing: passed confidence: 50 context: diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 12e3d27224..a6245ff28a 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -2,7 +2,7 @@ name: Execution of File with Multiple Extensions id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 version: 3 date: '2020-11-18' -author: Rico Valdez, Splunk +author: Rico Valdez, Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint @@ -10,21 +10,25 @@ description: This search looks for processes launched from files that have doubl extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed to executable content. -search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where Processes.process = *.doc.exe - OR Processes.process = *.htm.exe OR Processes.process = *.html.exe OR Processes.process - = *.txt.exe OR Processes.process = *.pdf.exe OR Processes.process = *.doc.exe by - Processes.dest Processes.user Processes.process Processes.parent_process | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | `execution_of_file_with_multiple_extensions_filter`' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process IN ("*.doc.exe", "*.xls.exe","*.ppt.exe", "*.htm.exe", "*.html.exe", "*.txt.exe", "*.pdf.exe", + "*.docx.exe", "*.xlsx.exe", "*.pptx.exe","*.one.exe", "*.bat.exe", "*rtf.exe") + by Processes.dest Processes.user Processes.process Processes.parent_process + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `drop_dm_object_name(Processes)` + | `execution_of_file_with_multiple_extensions_filter`' how_to_implement: To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. known_false_positives: None identified. -references: [] +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - Windows File Extension and Association Abuse - Masquerading - Rename System Utilities + - AsyncRAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index e0f0ca006b..089c1fa6db 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -34,9 +34,11 @@ references: - https://bohops.com/2018/06/28/abusing-com-registry-structure-clsid-localserver32-inprocserver32/ - https://tria.ge/210929-ap75vsddan - https://www.virustotal.com/gui/file/cb77b93150cb0f7fe65ce8a7e2a5781e727419451355a7736db84109fa215a89 +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - Remcos + - AsyncRAT confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 0d1737fdd4..7161c76f83 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -30,6 +30,7 @@ tags: - DHS Report TA18-074A - HAFNIUM Group - DarkCrystal RAT + - AsyncRAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 6be2fe62a8..2739c8c549 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -20,9 +20,11 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 ScriptBlockText=*frombase64string* | stats count min(_time) - as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_fileless_script_contains_base64_encoded_content_filter`' +search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*'gnirtS46esaBmorF'[-1..-16]*" + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `powershell_fileless_script_contains_base64_encoded_content_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -36,6 +38,7 @@ tags: analytic_story: - Hermetic Wiper - Malicious PowerShell + - AsyncRAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml index d75da6a33f..c7994cef85 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_reflection.yml @@ -38,6 +38,7 @@ tags: - Hermetic Wiper - Malicious PowerShell - AgentTesla + - AsyncRAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index f1916b6e27..ef4b4a8c3b 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -30,6 +30,7 @@ tags: analytic_story: - Hermetic Wiper - Malicious PowerShell + - AsyncRAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index d2097f3cea..35bbbeeae8 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -37,6 +37,7 @@ tags: - Industroyer2 - Qakbot - LockBit Ransomware + - AsyncRAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 1aab04eb9a..256fa37499 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -35,6 +35,7 @@ tags: - Remcos - Hermetic Wiper - Living Off The Land + - AsyncRAT automated_detection_testing: passed confidence: 60 context: diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 4870a430ed..c5fe49ec9e 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -37,6 +37,7 @@ tags: - Remcos - Living Off The Land - Qakbot + - AsyncRAT confidence: 80 context: - Source:Endpoint diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index b2fcb6a9ba..86658c58f1 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -39,6 +39,7 @@ tags: - Qakbot - Trickbot - Prestige Ransomware + - AsyncRAT asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index cf42d1b659..27c4affdff 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -32,6 +32,7 @@ tags: - Unusual Processes - Qakbot - IcedID + - AsyncRAT confidence: 90 context: - Stage:Execution diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index bf7c985b7b..4f1cf24d68 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -26,10 +26,12 @@ how_to_implement: To successfully implement this search you need to be ingesting known_false_positives: unknown references: - https://www.joesandbox.com/analysis/369332/0/html +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - FIN7 - Remcos + - AsyncRAT confidence: 70 context: - Source:Endpoint diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index ae08ecbce2..b696018c69 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -51,6 +51,7 @@ tags: - Industroyer2 - CISA AA22-257A - Prestige Ransomware + - AsyncRAT confidence: 100 context: - Source:Endpoint diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index ddfd760714..f07564c58f 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -36,6 +36,7 @@ tags: - CISA AA22-257A - Qakbot - Prestige Ransomware + - AsyncRAT confidence: 100 context: - Source:Endpoint From 24d3ef152a2ab2419b4b51674d4f1e3830d5a11f Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Wed, 25 Jan 2023 15:11:30 +0100 Subject: [PATCH 10/45] Update powershell_fileless_script_contains_base64_encoded_content.yml --- ...wershell_fileless_script_contains_base64_encoded_content.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index 2739c8c549..61a46593c3 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -20,7 +20,7 @@ description: 'The following analytic utilizes PowerShell Script Block Logging (E During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block.' -search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*'gnirtS46esaBmorF'[-1..-16]*" +search: '`powershell` EventCode=4104 ScriptBlockText = "*frombase64string*" OR ScriptBlockText = "*gnirtS46esaBmorF*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From f32b5bc51e433166b8a79c15f137ab5b830d9e94 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 25 Jan 2023 15:14:05 +0100 Subject: [PATCH 11/45] asyncrat-onenote-chain2 --- detections/endpoint/registry_keys_used_for_persistence.yml | 1 + detections/endpoint/suspicious_process_file_path.yml | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index f34b445490..7cf8f71de9 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -56,6 +56,7 @@ tags: - Azorult - Qakbot - Chaos Ransomware + - AsyncRAT asset_type: Endpoint cis20: - CIS 8 diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index d7d110624c..03fc872956 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -1,7 +1,7 @@ name: Suspicious Process File Path id: 9be25988-ad82-11eb-a14f-acde48001122 version: 1 -date: '2021-05-05' +date: '2023-01-25' author: Teoderick Contreras, Splunk type: TTP datamodel: @@ -31,6 +31,7 @@ references: - https://www.trendmicro.com/vinfo/hk/threat-encyclopedia/malware/trojan.ps1.powtran.a/ - https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/ - https://twitter.com/pr0xylife/status/1590394227758104576 +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - Data Destruction @@ -50,6 +51,7 @@ tags: - Prestige Ransomware - Chaos Ransomware - LockBit Ransomware + - AsyncRAT automated_detection_testing: passed confidence: 50 context: From b8d7a20f319bb1df9a9d048fb03a8f4d4e40900f Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 26 Jan 2023 14:12:32 +0100 Subject: [PATCH 12/45] asyncrat-onenote-chain2 --- ...dows_powershell_cryptography_namespace.yml | 69 +++++++++++++++++ ...scheduled_task_with_highest_privileges.yml | 76 +++++++++++++++++++ ...powershell_cryptography_namespace.test.yml | 13 ++++ ...uled_task_with_highest_privileges.test.yml | 13 ++++ 4 files changed, 171 insertions(+) create mode 100644 detections/endpoint/windows_powershell_cryptography_namespace.yml create mode 100644 detections/endpoint/windows_scheduled_task_with_highest_privileges.yml create mode 100644 tests/endpoint/windows_powershell_cryptography_namespace.test.yml create mode 100644 tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml new file mode 100644 index 0000000000..24c9d0db46 --- /dev/null +++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml @@ -0,0 +1,69 @@ +name: Windows Powershell Cryptography Namespace +id: f8b482f4-6d62-49fa-a905-dfa15698317b +version: 1 +date: '2023-01-26' +author: Teoderick Contreras, Splunk +type: Anomaly +datamodel: +- Endpoint +description: The following analytic identifies suspicious PowerShell script execution + via EventCode 4104 that is processing cryptography namespace library. + This technique was seen in several powershell malware, loader, downloader and stager that will decrypt or decode the next malicious stager or the actual payload. + This Anomaly detection can be a good indicator that a powershell process to decrypt code. We recommend to further check the parent_process_name, the file or data + it tries to decrypt, network connection and user who execute the script. +search: '`powershell` EventCode=4104 ScriptBlockText = "*System.Security.Cryptography*" AND NOT(ScriptBlockText IN ("*SHA*", "*MD5*", "*DeriveBytes*")) + | stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_powershell_cryptography_namespace_filter`' +how_to_implement: To successfully implement this analytic, you will need to enable + PowerShell Script Block Logging on some or all endpoints. Additional setup here + https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +known_false_positives: False positives should be limited. Filter as needed. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +tags: + analytic_story: + - AsyncRAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 50 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log + impact: 50 + kill_chain_phases: + - Exploitation + message: A suspicious powershell script contains cryptography command in $ScriptBlockText$ with EventCode $EventCode$ in host $Computer$ + mitre_attack_id: + - T1059.001 + - T1059 + nist: + - DE.CM + observable: + - name: Computer + type: Hostname + role: + - Victim + - name: UserID + type: UserID + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - ScriptBlockText + - Opcode + - Computer + - UserID + - EventCodes + risk_score: 25 + security_domain: endpoint diff --git a/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml new file mode 100644 index 0000000000..62488a1eca --- /dev/null +++ b/detections/endpoint/windows_scheduled_task_with_highest_privileges.yml @@ -0,0 +1,76 @@ +name: Windows Scheduled Task with Highest Privileges +id: 2f15e1a4-0fc2-49dd-919e-cbbe60699218 +version: 1 +date: '2023-01-26' +author: Teoderick Contreras, Splunk +type: TTP +datamodel: +- Endpoint +description: The following analytic identifies Schtasks.exe creating a new task with highest privilege execution. + This techniques was seen in asyncrat where it uses the scheduled task as part of it persistence and privilege escalation. + AsyncRAT will setup a scheduled task with parameter '/rl' and 'highest' to trigger this technique. This TTP detection can be a + good indicator of malware or adversaries trying to gain persistence and privilege escalation through scheduled task. We recommend to always + check and monitoring this type of events even filtering is needed. +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes + where Processes.process_name = "schtasks.exe" Processes.process = "*/rl *" Processes.process = "* highest *" + by Processes.process_name Processes.parent_process_name Processes.parent_process Processes.process Processes.process_guid Processes.dest Processes.user + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_scheduled_task_with_highest_privileges_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. Tune and filter known instances of wermgr.exe may be used. +known_false_positives: False positives will be limited to legitimate applications + creating a task to run as SYSTEM. Filter as needed based on parent process, or modify + the query to have world writeable paths to restrict it. +references: +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +tags: + analytic_story: + - AsyncRAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Endpoint + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log + impact: 80 + kill_chain_phases: + - Exploitation + message: a $process_name$ creating a schedule task $process$ with highest run level privilege in $dest$ + mitre_attack_id: + - T1053 + - T1053.005 + nist: + - DE.CM + observable: + - name: dest + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.parent_process + - Processes.original_file_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_path + - Processes.process_path + - Processes.parent_process_id + risk_score: 64 + security_domain: endpoint diff --git a/tests/endpoint/windows_powershell_cryptography_namespace.test.yml b/tests/endpoint/windows_powershell_cryptography_namespace.test.yml new file mode 100644 index 0000000000..d8b74bc1b7 --- /dev/null +++ b/tests/endpoint/windows_powershell_cryptography_namespace.test.yml @@ -0,0 +1,13 @@ +name: Windows Powershell Cryptography Namespace Unit Test +tests: +- name: Windows Powershell Cryptography Namespace + file: endpoint/windows_powershell_cryptography_namespace.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: windows-powershell-xml.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/asyncrat_crypto_pwh_namespace/windows-powershell-xml.log + source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational + sourcetype: xmlwineventlog + update_timestamp: true diff --git a/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml b/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml new file mode 100644 index 0000000000..b527dbd01d --- /dev/null +++ b/tests/endpoint/windows_scheduled_task_with_highest_privileges.test.yml @@ -0,0 +1,13 @@ +name: Windows Scheduled Task with Highest Privileges Unit Test +tests: +- name: Windows Scheduled Task with Highest Privileges + file: endpoint/windows_scheduled_task_with_highest_privileges.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/asyncrat_highest_priv_schtasks/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From b6f2b630813a7a7e04d32fa850b03517e913dc73 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Thu, 26 Jan 2023 14:15:28 +0100 Subject: [PATCH 13/45] Update windows_powershell_cryptography_namespace.yml --- .../endpoint/windows_powershell_cryptography_namespace.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/windows_powershell_cryptography_namespace.yml b/detections/endpoint/windows_powershell_cryptography_namespace.yml index 24c9d0db46..22785d2a30 100644 --- a/detections/endpoint/windows_powershell_cryptography_namespace.yml +++ b/detections/endpoint/windows_powershell_cryptography_namespace.yml @@ -50,8 +50,8 @@ tags: type: Hostname role: - Victim - - name: UserID - type: UserID + - name: User + type: User role: - Victim product: From 9f0394613d68270da178115cbe21b81f6af567fb Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 26 Jan 2023 11:13:28 -0500 Subject: [PATCH 14/45] updating microsoft cloud services app metadata --- bin/docker_detection_tester/modules/validate_args.py | 4 ++-- bin/docker_detection_tester/test_config_github_actions.json | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/bin/docker_detection_tester/modules/validate_args.py b/bin/docker_detection_tester/modules/validate_args.py index de10ed4d92..fd02b34df5 100644 --- a/bin/docker_detection_tester/modules/validate_args.py +++ b/bin/docker_detection_tester/modules/validate_args.py @@ -166,8 +166,8 @@ setup_schema = { }, "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { "app_number": 3110, - "app_version": "4.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz" + "app_version": "4.5.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz" }, "SPLUNK_ADD_ON_FOR_GOOGLE_CLOUD_PLATFORM": { "app_number": 3088, diff --git a/bin/docker_detection_tester/test_config_github_actions.json b/bin/docker_detection_tester/test_config_github_actions.json index 5980af4f03..5e6ba7915d 100644 --- a/bin/docker_detection_tester/test_config_github_actions.json +++ b/bin/docker_detection_tester/test_config_github_actions.json @@ -102,8 +102,8 @@ }, "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { "app_number": 3110, - "app_version": "4.5.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_450.tgz" + "app_version": "4.5.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz" }, "SPLUNK_TA_FOR_IIS": { "app_number": 3185, From 6e695cb16e734d4aba6528fabb04a96864bcccfd Mon Sep 17 00:00:00 2001 From: tccontre Date: Thu, 26 Jan 2023 18:00:00 +0100 Subject: [PATCH 15/45] asyncrat-onenote-chain2 --- .../windows_access_token_manipulation_sedebugprivilege.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml index 89c68e99d5..867efa92ea 100644 --- a/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml +++ b/detections/endpoint/windows_access_token_manipulation_sedebugprivilege.yml @@ -22,9 +22,11 @@ references: - https://devblogs.microsoft.com/oldnewthing/20080314-00/?p=23113 - https://blog.palantir.com/windows-privilege-abuse-auditing-detection-and-defense-3078a403d74e - https://atomicredteam.io/privilege-escalation/T1134.001/#atomic-test-2---%60sedebugprivilege%60-token-duplication +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat tags: analytic_story: - Brute Ratel C4 + - AsyncRAT asset_type: Endpoint cis20: - CIS 3 From 5306030d749eaaedd39759a346b5ab5c1ea153f2 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 26 Jan 2023 16:35:43 -0500 Subject: [PATCH 16/45] fixes --- .../test_config_bak.json | 123 ++++++++++++++++++ ...concurrent_sessions_from_different_ips.yml | 1 + ...ber_of_failed_authentications_for_user.yml | 1 + ...mber_of_failed_authentications_from_ip.yml | 1 + ...sful_authentication_from_different_ips.yml | 1 + ...f_failed_authentications_for_user.test.yml | 2 +- ...of_failed_authentications_from_ip.test.yml | 2 +- 7 files changed, 129 insertions(+), 2 deletions(-) create mode 100644 bin/docker_detection_tester/test_config_bak.json diff --git a/bin/docker_detection_tester/test_config_bak.json b/bin/docker_detection_tester/test_config_bak.json new file mode 100644 index 0000000000..e6e2354d16 --- /dev/null +++ b/bin/docker_detection_tester/test_config_bak.json @@ -0,0 +1,123 @@ +{ + "apps": { + "ADD_ON_FOR_LINUX_SYSMON": { + "app_number": 6176, + "app_version": "1.0.4", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" + }, + "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { + "app_number": 2882, + "app_version": "3.0.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" + }, + "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { + "app_number": 3719, + "app_version": "1.3.2", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { + "app_number": 4055, + "app_version": "2.2.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" + }, + "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { + "app_number": 742, + "app_version": "8.4.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" + }, + "SPLUNK_ADD_ON_FOR_NGINX": { + "app_number": 3258, + "app_version": "3.1.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { + "app_number": 5238, + "app_version": "8.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" + }, + "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { + "app_number": 5234, + "app_version": "8.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" + }, + "SPLUNK_ADD_ON_FOR_SYSMON": { + "app_number": 5709, + "app_version": "2.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" + }, + "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { + "app_number": 833, + "app_version": "8.4.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" + }, + "SPLUNK_APP_FOR_STREAM": { + "app_number": 1809, + "app_version": "8.0.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" + }, + "SPLUNK_COMMON_INFORMATION_MODEL": { + "app_number": 1621, + "app_version": "5.0.0", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" + }, + "SPLUNK_ES_CONTENT_UPDATE": { + "app_number": 3449, + "app_version": null, + "local_path": null + }, + "SPLUNK_MACHINE_LEARNING_TOOLKIT": { + "app_number": 2890, + "app_version": "5.3.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" + }, + "SPLUNK_TA_FOR_ZEEK": { + "app_number": 5466, + "app_version": "1.0.5", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" + }, + "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { + "app_number": 3110, + "app_version": "4.5.1", + "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz" + } + }, + "branch": "TR-2326_migrate_password_spraying_xml", + "commit_hash": null, + "container_tag": "latest", + "detections_list": [ + "security_content/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml", + "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml", + "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml", + "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml", + "security_content/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml", + "security_content/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml", + "security_content/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml", + "security_content/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml"], + "folders": [ + "endpoint", + "cloud", + "network", + "web", + "application" + ], + "interactive": true, + "local_base_container_name": "splunk_test_%d", + "mock": false, + "mode": "selected", + "no_interactive_failure": false, + "num_containers": 1, + "persist_security_content": true, + "pr_number": null, + "reuse_image": true, + "show_splunk_app_password": false, + "splunk_app_password": null, + + "splunk_container_apps_directory": "/opt/splunk/etc/apps", + "splunkbase_password": null, + "splunkbase_username": null, + "types": [ + "Anomaly", + "Hunting", + "TTP" + ] +} diff --git a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml index 6d57a712bc..b2d8e8f2a2 100644 --- a/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/azure_ad_concurrent_sessions_from_different_ips.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Compromised User Account + - Azure Active Directory Account Takeover asset_type: Azure AD cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml index 476a04a4a2..45e9035ff5 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_for_user.yml @@ -23,6 +23,7 @@ references: tags: analytic_story: - Compromised User Account + - Azure Active Directory Account Takeover asset_type: Azure AD cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml index 8c0c20cf28..4e170cd933 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml @@ -24,6 +24,7 @@ references: tags: analytic_story: - Compromised User Account + - Azure Active Directory Account Takeover asset_type: Azure AD cis20: - CIS 3 diff --git a/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml index 75f3890ac1..55a1ab4bd8 100644 --- a/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml +++ b/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml @@ -25,6 +25,7 @@ references: tags: analytic_story: - Compromised User Account + - Azure Active Directory Account Takeover asset_type: Azure AD cis20: - CIS 3 diff --git a/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml index 5ca2a596ea..e2905d468e 100644 --- a/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml +++ b/tests/cloud/azure_ad_high_number_of_failed_authentications_for_user.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: azuread.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub update_timestamp: true \ No newline at end of file diff --git a/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml index 2fd8ca9235..c22f665da0 100644 --- a/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml +++ b/tests/cloud/azure_ad_high_number_of_failed_authentications_from_ip.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: azuread.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/azure_ad_high_number_of_failed_authentications_for_user/azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_high_number_of_failed_authentications_for_user/azuread.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub update_timestamp: true From 8a8a7b3173336b8909270a077af868063e43b0f7 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 26 Jan 2023 17:06:13 -0500 Subject: [PATCH 17/45] updating analytic story description --- stories/compromised_user_account.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/stories/compromised_user_account.yml b/stories/compromised_user_account.yml index d73a0510ae..74b5eea652 100644 --- a/stories/compromised_user_account.yml +++ b/stories/compromised_user_account.yml @@ -4,8 +4,9 @@ version: 1 date: '2023-01-19' author: Mauricio Velazco, Bhavin Patel, Splunk description: Monitor for activities and techniques associated with Compromised User Account attacks. -narrative: UPDATE_NARRATIVE -references: [] +narrative: Compromised User Account occurs when cybercriminals gain unauthorized access to accounts by using different techniques like brute force, social engineering, phishing & spear phishing, credential stuffing, etc. By posing as the real user, cyber-criminals can change account details, send out phishing emails, steal financial information or sensitive data, or use any stolen information to access further accounts within the organization. This analytic storic groups detections that can help security operations teams identify the potential signs of Compromised User Accounts. +references: +- https://www.proofpoint.com/us/threat-reference/compromised-account tags: analytic_story: Compromised User Account category: [] From 2ff71df1b0fd97074dff3bec17269f847c4e2b26 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 26 Jan 2023 17:11:29 -0800 Subject: [PATCH 18/45] new detection and update 1 --- ..._users_failing_to_authenticate_from_ip.yml | 2 +- .../cloud/aws_password_policy_changes.yml | 66 +++++++++++++++++++ .../aws_password_policy_changes.test.yml | 13 ++++ 3 files changed, 80 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/aws_password_policy_changes.yml create mode 100644 tests/cloud/aws_password_policy_changes.test.yml diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 2526a342ff..1a5c67bad6 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -6,7 +6,7 @@ author: Bhavin Patel type: Anomaly datamodel: [] description: The following analytic identifies one source Ip failing to authenticate into the AWS Console with 30 unique valid users within 10 minutes. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(user_name) AS unique_accounts values(user_name) as tried_accounts by _time, src_ip, eventName, action, user_agent | where unique_accounts > 30 |`aws_unusual_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. known_false_positives: No known false postives for this detection. Please review this alert references: diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml new file mode 100644 index 0000000000..a0a6a4610e --- /dev/null +++ b/detections/cloud/aws_password_policy_changes.yml @@ -0,0 +1,66 @@ +name: AWS Password Policy Changes +id: aee4a575-7064-4e60-b511-246f9baf9895 +version: 1 +date: '2023-01-26' +author: Bhavin Patel, Splunk +type: Hunting +datamodel: +- Endpoint +description: This search looks for AWS CloudTrail events where a user is making succesfull API calls to view/update/delete the existing password policy in your AWS organizations. It is highly unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised. +search: '`cloudtrail` eventName=*PasswordPolicy errorCode=success | stats count values(eventName) values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`' +how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event. +references: +- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html +tags: + analytic_story: + - AWS IAM Privilege Escalation + - Compromised User Account + asset_type: AWS Account + cis20: + - CIS 13 + confidence: 80 + context: + - Source:Cloud Data + - Scope:External + - Outcome:Allowed + - Stage:Privilege Escalation + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json + impact: 90 + kill_chain_phases: + - Reconnaisance + message: User $user_arn$ is attempting view/update/delete the password policy for account id $aws_account_id$ + mitre_attack_id: + - T1201 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.userName + - eventSource + - user_arn + - aws_account_id + - src_ip + risk_score: 72 + security_domain: threat diff --git a/tests/cloud/aws_password_policy_changes.test.yml b/tests/cloud/aws_password_policy_changes.test.yml new file mode 100644 index 0000000000..ce2bbe7eb3 --- /dev/null +++ b/tests/cloud/aws_password_policy_changes.test.yml @@ -0,0 +1,13 @@ +name: AWS Password Policy Changes Unit Test +tests: +- name: AWS Password Policy Changes + file: cloud/aws_password_policy_changes.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true From 6d2aea64cc4653fbbb8c1564e147d66e7d80fbfb Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Thu, 26 Jan 2023 17:14:53 -0800 Subject: [PATCH 19/45] minor fix --- detections/cloud/aws_password_policy_changes.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml index a0a6a4610e..4bb22f1797 100644 --- a/detections/cloud/aws_password_policy_changes.yml +++ b/detections/cloud/aws_password_policy_changes.yml @@ -31,7 +31,7 @@ tags: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json impact: 90 kill_chain_phases: - - Reconnaisance + - Reconnaissance message: User $user_arn$ is attempting view/update/delete the password policy for account id $aws_account_id$ mitre_attack_id: - T1201 From cf1ec25aefc2aa773ea7b17b8764e0c79e33e1cb Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Jan 2023 14:14:35 +0100 Subject: [PATCH 20/45] asyncrat-onenote-chain2 --- ...ment_connect_to_none_ms_office_domain_.yml | 70 +++++++++++++++++++ ..._connect_to_none_ms_office_domain.test.yml | 13 ++++ 2 files changed, 83 insertions(+) create mode 100644 detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml create mode 100644 tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml diff --git a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml new file mode 100644 index 0000000000..cf9810daa7 --- /dev/null +++ b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml @@ -0,0 +1,70 @@ +name: 'Windows Spearphishing Attachment Connect To None MS Office Domain' +id: 1cb40e15-cffa-45cc-abbd-e35884a49766 +version: 1 +date: '2023-01-27' +author: Teoderick Contreras, Splunk +type: Hunting +datamodel: +- Endpoint +description: this detection was designed to identifies suspicious office documents + that connect to a website aside from Microsoft Office Domain. This technique was seen in + several malicious documents that abuses .rels xml properties of MS office to connect or download malicious files. + This hunting query can a good pivot or guide to check what URL link it tries to connect, what domain, where the documents came from and + how the connection happens. +search: '`sysmon` EventCode=22 Image IN ("*\\winword.exe","*\\excel.exe","*\\powerpnt.exe","*\\mspub.exe","*\\visio.exe","*\\wordpad.exe","*\\wordview.exe","*\\onenote.exe", + "*\\onenotem.exe","*\\onenoteviewer.exe","*\\onenoteim.exe") + AND NOT(QueryName IN ("*.office.com", "*.office.net")) + | stats count min(_time) as firstTime max(_time) as lastTime by Image QueryName QueryResults QueryStatus Computer + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `windows_spearphishing_attachment_connect_to_none_ms_office_domain_filter`' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: Windows Office document may contain legitimate url link other than MS office Domain. filter is needed +references: +- https://www.netskope.com/blog/asyncrat-using-fully-undetected-downloader +- https://malpedia.caad.fkie.fraunhofer.de/details/win.asyncrat +tags: + analytic_story: + - Spearphishing Attachments + - AsyncRAT + asset_type: Endpoint + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 30 + context: + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log + impact: 30 + kill_chain_phases: + - Exploitation + message: a office document process $Image$ connect to an URL link $QueryName$ in $Computer$ + mitre_attack_id: + - T1566.001 + - T1566 + nist: + - DE.CM + observable: + - name: Computer + type: Endpoint + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - Image + - QueryName + - QueryResults + - QueryStatus + - Computer + risk_score: 9 + security_domain: endpoint diff --git a/tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml b/tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml new file mode 100644 index 0000000000..6c0843d362 --- /dev/null +++ b/tests/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.test.yml @@ -0,0 +1,13 @@ +name: Windows Spearphishing Attachment Connect To None MS Office Domain Unit Test +tests: +- name: 'Windows Spearphishing Attachment Connect To None MS Office Domain' + file: endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/office_doc_abuses_rels/sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog + update_timestamp: true From 5206d43c71f05ccf2460e2a296603e9f8e3f8c78 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 27 Jan 2023 14:15:06 +0100 Subject: [PATCH 21/45] asyncrat-onenote-chain2 --- ...spearphishing_attachment_connect_to_none_ms_office_domain.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename detections/endpoint/{windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml => windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml} (100%) diff --git a/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml b/detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml similarity index 100% rename from detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain_.yml rename to detections/endpoint/windows_spearphishing_attachment_connect_to_none_ms_office_domain.yml From 03598ec031eb32cf9d7c158ca4fb86e78d901fd4 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 27 Jan 2023 16:58:28 -0800 Subject: [PATCH 22/45] new detectiono aws --- ...ber_of_failed_authentications_for_user.yml | 63 +++++++++++++++++++ ...f_failed_authentications_for_user.test.yml | 12 ++++ 2 files changed, 75 insertions(+) create mode 100644 detections/cloud/aws_high_number_of_failed_authentications_for_user.yml create mode 100644 tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml diff --git a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml new file mode 100644 index 0000000000..3e60fc1946 --- /dev/null +++ b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml @@ -0,0 +1,63 @@ +name: AWS High Number Of Failed Authentications For User +id: e3236f49-daf3-4b70-b808-9290912ac64d +version: 1 +date: '2023-01-27' +author: Bhavin Patel, Splunk +type: Anomaly +datamodel: [] +description: The following analytic identifies an AWS IAM User account with more than 20 failed authentication events in the span of 10 minutes. This behavior could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection. +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS failed_attempts values(src_ip) as src_ip values(user_agent) by _time, user_name, eventName, eventSource aws_account_id | where failed_attempts > 20 | `aws_high_number_of_failed_authentications_for_user_filter`' +how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: While this search has no known false positives, it is possible + that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event. +references: +- https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html +tags: + analytic_story: + - Compromised User Account + - AWS Identity and Access Management Account Takeover + asset_type: AWS Account + cis20: + - CIS 13 + confidence: 70 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json + impact: 50 + kill_chain_phases: + - Exploitation + message: User $user_name$ failed to authenticate more than 20 times in the span of 5 minutes for AWS Account $aws_account_id$ + mitre_attack_id: + - T1201 + nist: + - PR.DS + - PR.AC + - DE.CM + observable: + - name: src_ip + type: IP Address + role: + - Attacker + - name: user_arn + type: User + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - userAgent + - errorCode + - requestParameters.userName + - eventSource + - user_arn + - aws_account_id + - src_ip + risk_score: 35 + security_domain: threat diff --git a/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml b/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml new file mode 100644 index 0000000000..40481d63f4 --- /dev/null +++ b/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml @@ -0,0 +1,12 @@ +name: AWS High Number Of Failed Authentications For User Unit Test +tests: +- name: AWS High Number Of Failed Authentications For User + file: cloud/aws_high_number_of_failed_authentications_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file From a7e908313a9d8c557af95e47299970ce3d739c07 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 27 Jan 2023 17:10:02 -0800 Subject: [PATCH 23/45] timeframe in test --- tests/cloud/aws_console_logins_from_multiple_ips.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml index 42d59f1013..547ec29026 100644 --- a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml +++ b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml @@ -3,7 +3,7 @@ tests: - name: AWS Console Logins From Multiple IPs file: cloud/aws_console_logins_from_multiple_ips.yml pass_condition: '| stats count | where count > 0' - earliest_time: -24h + earliest_time: -7dh latest_time: now attack_data: - file_name: cloudtrail.json From 54459489c1c4cb041f7ec007cdbc4d82e65ea524 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Fri, 27 Jan 2023 17:11:53 -0800 Subject: [PATCH 24/45] new line remove --- lookups/REFERENCE_CACHE.db.db | Bin 0 -> 16384 bytes .../cloud/aws_password_policy_changes.test.yml | 2 +- 2 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 lookups/REFERENCE_CACHE.db.db diff --git a/lookups/REFERENCE_CACHE.db.db b/lookups/REFERENCE_CACHE.db.db new file mode 100644 index 0000000000000000000000000000000000000000..6558e5f59cd95c00adc7f97e6dcf68a70328ce6e GIT binary patch literal 16384 zcmeIu!41MN5Cp&tL?{m)eCQ!r%d)PcZuT!SBIES>gjOFnCIxo=5M$-F1G z(&m~>C2D2qO}TFe=bmfHx~A9T`99kEMytLZ7fbu Date: Fri, 27 Jan 2023 17:23:05 -0800 Subject: [PATCH 25/45] update test file --- .../aws_high_number_of_failed_authentications_for_user.test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml b/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml index 40481d63f4..fe2fe784d0 100644 --- a/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml +++ b/tests/cloud/aws_high_number_of_failed_authentications_for_user.test.yml @@ -5,6 +5,7 @@ tests: pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now + attack_data: - file_name: cloudtrail.json data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_multiple_login_fail_per_user/cloudtrail.json sourcetype: aws:cloudtrail From 14edea4ca075dc75cd8ef931467fbecf9d177d6e Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 30 Jan 2023 13:10:13 -0800 Subject: [PATCH 26/45] new aws detection --- ...mber_of_failed_authentications_from_ip.yml | 49 +++++++++++++++++++ ..._users_failing_to_authenticate_from_ip.yml | 1 + ...of_failed_authentications_from_ip.test.yml | 13 +++++ 3 files changed, 63 insertions(+) create mode 100644 detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml create mode 100644 tests/cloud/aws_high_number_of_failed_authentications_from_ip.test.yml diff --git a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml new file mode 100644 index 0000000000..08078abbc8 --- /dev/null +++ b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml @@ -0,0 +1,49 @@ +name: AWS High Number Of Failed Authentications From Ip +id: f75b7f1a-b8eb-4975-a214-ff3e0a944757 +version: 1 +date: '2023-01-30' +author: '' +type: Anomaly +datamodel: +- Endpoint +description: UPDATE_DESCRIPTION +search: '| UPDATE_SPL | `aws_high_number_of_failed_authentications_from_ip_filter`' +how_to_implement: UPDATE_HOW_TO_IMPLEMENT +known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +references: +- REFERENCE +tags: + analytic_story: + - UPDATE_STORY_NAME + asset_type: UPDATE asset_type + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: UPDATE value between 1-100 + context: + - Update context + dataset: + - UPDATE_DATASET_URL + impact: UPDATE value between 1-100 + kill_chain_phases: + - Reconnaissance + - Exploitation + message: UPDATE message + mitre_attack_id: + - T1003.002 + nist: + - DE.CM + observable: + - name: UPDATE + type: UPDATE + role: + - UPDATE + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - UPDATE + risk_score: UPDATE (impact * confidence)/100 + security_domain: threat diff --git a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml index 1a5c67bad6..52529ad829 100644 --- a/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/cloud/aws_multiple_users_failing_to_authenticate_from_ip.yml @@ -16,6 +16,7 @@ references: tags: analytic_story: - AWS Identity and Access Management Account Takeover + - Compromised User Account asset_type: AWS Account cis20: - CIS 3 diff --git a/tests/cloud/aws_high_number_of_failed_authentications_from_ip.test.yml b/tests/cloud/aws_high_number_of_failed_authentications_from_ip.test.yml new file mode 100644 index 0000000000..eba42f5b51 --- /dev/null +++ b/tests/cloud/aws_high_number_of_failed_authentications_from_ip.test.yml @@ -0,0 +1,13 @@ +name: AWS High Number Of Failed Authentications From Ip Unit Test +tests: +- name: AWS High Number Of Failed Authentications From Ip + file: cloud/aws_high_number_of_failed_authentications_from_ip.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: aws_cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json + source: aws_cloudtrail + sourcetype: aws:cloudtrail + update_timestamp: true \ No newline at end of file From b629b14dca31eeef0297ded52c407ae1fff6b0d7 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 30 Jan 2023 13:38:41 -0800 Subject: [PATCH 27/45] spl and yaml updates --- ...mber_of_failed_authentications_from_ip.yml | 60 ++++++++++++------- 1 file changed, 38 insertions(+), 22 deletions(-) diff --git a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml index 08078abbc8..6a257101c0 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml @@ -2,48 +2,64 @@ name: AWS High Number Of Failed Authentications From Ip id: f75b7f1a-b8eb-4975-a214-ff3e0a944757 version: 1 date: '2023-01-30' -author: '' +author: Bhavin Patel, Splunk type: Anomaly -datamodel: -- Endpoint -description: UPDATE_DESCRIPTION -search: '| UPDATE_SPL | `aws_high_number_of_failed_authentications_from_ip_filter`' -how_to_implement: UPDATE_HOW_TO_IMPLEMENT -known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES +datamodel: [] +description: The following analytic identifies an IP address which failing to authenticate 20 or more times to an AWS Web Console in the span of 10 minutes. This behavior + could represent a brute force attack againstan Azure AD. As environments differ across organizations, security teams should customize the threshold of this detection. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. +search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS failed_attempts values(user_name) as tried_accounts values(user_agent) by _time, src_ip, eventName, eventSource aws_account_id | where failed_attempts > 20 |`aws_high_number_of_failed_authentications_from_ip_filter`' +how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. +known_false_positives: No known false postives for this detection. Please review this alert references: -- REFERENCE +- https://attack.mitre.org/techniques/T1110/003/ +- https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ +- https://softwaresecuritydotblog.wordpress.com/2019/09/28/how-to-protect-against-credential-stuffing-on-aws/ tags: analytic_story: - - UPDATE_STORY_NAME - asset_type: UPDATE asset_type + - AWS Identity and Access Management Account Takeover + - Compromised User Account + asset_type: AWS Account cis20: - CIS 3 - CIS 5 - CIS 16 - confidence: UPDATE value between 1-100 + confidence: 90 context: - - Update context + - Source:Cloud Data + - Outcome:Blocked + - Stage:Recon + - Other:Brute Force dataset: - - UPDATE_DATASET_URL - impact: UPDATE value between 1-100 + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.003/aws_mulitple_failed_console_login/aws_cloudtrail.json + impact: 60 kill_chain_phases: - - Reconnaissance - Exploitation - message: UPDATE message + message: Multiple failed console login attempts against users $tried_accounts$ seen from $src_ip$ mitre_attack_id: - - T1003.002 + - T1110 + - T1110.003 + - T1110.004 nist: - DE.CM observable: - - name: UPDATE - type: UPDATE + - name: src_ip + type: IP Address role: - - UPDATE + - Attacker + - name: tried_accounts + type: User + role: + - Victim product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud required_fields: - - UPDATE - risk_score: UPDATE (impact * confidence)/100 + - _time + - user + - action + - eventName + - src_ip + risk_score: 54 security_domain: threat + From 8dd93e3149100ac0a205807d3e28b05d7a27a844 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Mon, 30 Jan 2023 17:33:25 -0500 Subject: [PATCH 28/45] adding new detection --- ..._ad_new_mfa_method_registered_for_user.yml | 71 +++++++++++++++++++ ...ew_mfa_method_registered_for_user.test.yml | 13 ++++ 2 files changed, 84 insertions(+) create mode 100644 detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml create mode 100644 tests/cloud/azure_ad_new_mfa_method_registered_for_user.test.yml diff --git a/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml b/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml new file mode 100644 index 0000000000..2f7fe31bdb --- /dev/null +++ b/detections/cloud/azure_ad_new_mfa_method_registered_for_user.yml @@ -0,0 +1,71 @@ +name: Azure AD New MFA Method Registered For User +id: 2628b087-4189-403f-9044-87403f777a1b +version: 1 +date: '2023-01-30' +author: Mauricio Velazco, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the registration of a new Multi Factor authentication method for an Azure AD account. Adversaries who have obtained + unauthorized access to an Azure AD account may register a new MFA method to maintain persistence. +search: ' `azuread` category=AuditLogs operationName="User registered security info" properties.operationType=Add + | rename properties.* as * + | rename targetResources{}.* as * + | stats values(userPrincipalName) by _time, resultDescription, result, callerIpAddress + | `azure_ad_new_mfa_method_registered_for_user_filter`' +how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. + Specifically, this analytic leverages the AuditLogs log category. +known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks +- https://attack.mitre.org/techniques/T1556/ +- https://attack.mitre.org/techniques/T1556/006/ +- https://twitter.com/jhencinski/status/1618660062352007174 +tags: + analytic_story: + - Compromised User Account + - Azure Active Directory Account Takeover + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread.log + impact: 80 + kill_chain_phases: + - Installation + - Actions on Objectives + message: UPDATE message + mitre_attack_id: + - T1556 + - T1556.006 + nist: + - DE.CM + observable: + - name: userPrincipalName + type: User + role: + - Victim + - name: callerIpAddress + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - category + - operationName + - properties.operationType + - userPrincipalName + - resultDescription + - result + - callerIpAddress + risk_score: 64 + security_domain: identity diff --git a/tests/cloud/azure_ad_new_mfa_method_registered_for_user.test.yml b/tests/cloud/azure_ad_new_mfa_method_registered_for_user.test.yml new file mode 100644 index 0000000000..a40ab04c73 --- /dev/null +++ b/tests/cloud/azure_ad_new_mfa_method_registered_for_user.test.yml @@ -0,0 +1,13 @@ +name: Azure AD New MFA Method Registered For User Unit Test +tests: +- name: Azure AD New MFA Method Registered For User + file: cloud/azure_ad_new_mfa_method_registered_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/azure_ad_new_mfa_method_registered_for_user/azuread.log + source: mscs:azure:eventhub + sourcetype: mscs:azure:eventhub + update_timestamp: true From 71273d8fe1309f0553380c74df85d1af9f1cc650 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 30 Jan 2023 15:13:45 -0800 Subject: [PATCH 29/45] fix the errors --- detections/cloud/aws_console_logins_from_multiple_ips.yml | 4 ++-- detections/cloud/aws_password_policy_changes.yml | 2 +- tests/cloud/aws_password_policy_changes.test.yml | 2 +- 3 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_console_logins_from_multiple_ips.yml index d1785df1d2..8d5be295c7 100644 --- a/detections/cloud/aws_console_logins_from_multiple_ips.yml +++ b/detections/cloud/aws_console_logins_from_multiple_ips.yml @@ -6,9 +6,9 @@ author: Bhavin Patel, Splunk type: Anomaly datamodel: - Authentication -description: This search looks for AWS CloudTrail authentication events where there are successfull AWS Console Login events from 2 or more different source IP addresses within a span of 5 mins. Often times, attackers with start with a phishing campaigns to commpromise cloud user accounts and would proceeed with trying to those use credentials before they would potentially expire or if the user rotates their credential then its no longer valid. Detecting successfull login attempts in from a short time window is a strong indicator of malicious behavior. +description: This search looks for AWS CloudTrail authentication events where there are successfull AWS Console Login events from 2 or more different source IP addresses within a span of 10 mins. Often times, attackers with start with a phishing campaigns to commpromise cloud user accounts and would proceeed with trying to those use credentials before they would potentially expire or if the user rotates their credential then its no longer valid. Detecting successfull login attempts in from a short time window is a strong indicator of malicious behavior. search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime dc(Authentication.src) as distinct_ip_count values(Authentication.src) as src_ip values(Authentication.user_agent) as user_agent values(Authentication.action) as action from datamodel=Authentication - where Authentication.signature=ConsoleLogin by _time span=5m Authentication.user Authentication.user_type + where Authentication.signature=ConsoleLogin by _time span=10m Authentication.user Authentication.user_type | `drop_dm_object_name(Authentication)` | where distinct_ip_count >= 2 | `aws_console_logins_from_multiple_ips_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml index 4bb22f1797..4f13317d3d 100644 --- a/detections/cloud/aws_password_policy_changes.yml +++ b/detections/cloud/aws_password_policy_changes.yml @@ -28,7 +28,7 @@ tags: - Outcome:Allowed - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail.json impact: 90 kill_chain_phases: - Reconnaissance diff --git a/tests/cloud/aws_password_policy_changes.test.yml b/tests/cloud/aws_password_policy_changes.test.yml index 3b5388a3b5..eba0438dff 100644 --- a/tests/cloud/aws_password_policy_changes.test.yml +++ b/tests/cloud/aws_password_policy_changes.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: cloudtrail.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_passsword_policy/cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1201/aws_password_policy/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail update_timestamp: true \ No newline at end of file From f6c78edc5d47dee591fec5692bcbff2044954ec6 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 31 Jan 2023 11:34:28 -0800 Subject: [PATCH 30/45] new mfa added aws --- ...aws_new_mfa_method_registered_for_user.yml | 70 +++++++++++++++++++ .../cloud/aws_password_policy_changes.yml | 7 +- ...ew_mfa_method_registered_for_user.test.yml | 13 ++++ 3 files changed, 86 insertions(+), 4 deletions(-) create mode 100644 detections/cloud/aws_new_mfa_method_registered_for_user.yml create mode 100644 tests/cloud/aws_new_mfa_method_registered_for_user.test.yml diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml new file mode 100644 index 0000000000..2ceb9734df --- /dev/null +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -0,0 +1,70 @@ +name: AWS New MFA Method Registered For User +id: 4e3c26f2-4fb9-4bd7-ab46-1b76ffa2a23b +version: 1 +date: '2023-01-31' +author: Bhavin Patel, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies the registration of a new Multi Factor authentication method for an AAWS account. Adversaries who have obtained unauthorized access to an AWS account may register a new MFA method to maintain persistence. +search: ' `cloudtrail` eventName=CreateVirtualMFADevice | stats count values(requestParameters.virtualMFADeviceName) as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `aws_new_mfa_method_registered_for_user_filter`' +how_to_implement: how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This + search works when AWS CloudTrail logs. +known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. +references: +- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks +- https://attack.mitre.org/techniques/T1556/ +- https://attack.mitre.org/techniques/T1556/006/ +- https://twitter.com/jhencinski/status/1618660062352007174 +tags: + analytic_story: + - Compromised User Account + - Azure Active Directory Account Takeover + asset_type: Azure Active Directory + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 80 + context: + - Source:Cloud Data + - Stage:Persistence + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail.json + impact: 80 + kill_chain_phases: + - Installation + - Actions on Objectives + message: A new virtual device $virtualMFADeviceName$ is added to user $user_arn$ + mitre_attack_id: + - T1556 + - T1556.006 + nist: + - DE.CM + observable: + - name: user_name + type: User + role: + - Victim + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - src_ip + - eventName + - eventSource + - requestParameters.virtualMFADeviceName + - errorCode + - userIdentity.principalId + - userAgent + - awsRegion + - user_name + - userIdentity.arn + - _time + risk_score: 64 + security_domain: identity diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml index 4f13317d3d..b780210215 100644 --- a/detections/cloud/aws_password_policy_changes.yml +++ b/detections/cloud/aws_password_policy_changes.yml @@ -4,10 +4,9 @@ version: 1 date: '2023-01-26' author: Bhavin Patel, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: This search looks for AWS CloudTrail events where a user is making succesfull API calls to view/update/delete the existing password policy in your AWS organizations. It is highly unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised. -search: '`cloudtrail` eventName=*PasswordPolicy errorCode=success | stats count values(eventName) values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`' +search: '`cloudtrail` eventName IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") errorCode=success | stats count values(eventName) as eventName values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`' how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible @@ -32,7 +31,7 @@ tags: impact: 90 kill_chain_phases: - Reconnaissance - message: User $user_arn$ is attempting view/update/delete the password policy for account id $aws_account_id$ + message: User $user_arn$ is attempting to $eventName$ the password policy for account id $aws_account_id$ mitre_attack_id: - T1201 nist: diff --git a/tests/cloud/aws_new_mfa_method_registered_for_user.test.yml b/tests/cloud/aws_new_mfa_method_registered_for_user.test.yml new file mode 100644 index 0000000000..09472fe644 --- /dev/null +++ b/tests/cloud/aws_new_mfa_method_registered_for_user.test.yml @@ -0,0 +1,13 @@ +name: AWS New MFA Method Registered For User Unit Test +tests: +- name: AWS New MFA Method Registered For User + file: cloud/aws_new_mfa_method_registered_for_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556.006/aws_new_mfa_method_registered_for_user/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true \ No newline at end of file From ae07e87dc1a6342e28f388cda724ba0bcb86c102 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 31 Jan 2023 16:42:19 -0800 Subject: [PATCH 31/45] spl update --- .../cloud/aws_console_logins_from_multiple_ips.yml | 12 ++++-------- .../cloud/aws_new_mfa_method_registered_for_user.yml | 2 +- 2 files changed, 5 insertions(+), 9 deletions(-) diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_console_logins_from_multiple_ips.yml index 8d5be295c7..b043a4eb1b 100644 --- a/detections/cloud/aws_console_logins_from_multiple_ips.yml +++ b/detections/cloud/aws_console_logins_from_multiple_ips.yml @@ -4,13 +4,9 @@ version: 1 date: '2023-01-19' author: Bhavin Patel, Splunk type: Anomaly -datamodel: -- Authentication +datamodel: [] description: This search looks for AWS CloudTrail authentication events where there are successfull AWS Console Login events from 2 or more different source IP addresses within a span of 10 mins. Often times, attackers with start with a phishing campaigns to commpromise cloud user accounts and would proceeed with trying to those use credentials before they would potentially expire or if the user rotates their credential then its no longer valid. Detecting successfull login attempts in from a short time window is a strong indicator of malicious behavior. -search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime dc(Authentication.src) as distinct_ip_count values(Authentication.src) as src_ip values(Authentication.user_agent) as user_agent values(Authentication.action) as action from datamodel=Authentication - where Authentication.signature=ConsoleLogin by _time span=10m Authentication.user Authentication.user_type -| `drop_dm_object_name(Authentication)` -| where distinct_ip_count >= 2 | `aws_console_logins_from_multiple_ips_filter`' +search: ' `cloudtrail` eventName = ConsoleLogin | bin span=10m _time | stats values(userAgent) values(eventName) values(src_ip) dc(src_ip) as distinct_ip_count by _time user_arn | where distinct_ip_count>1 | `aws_console_logins_from_multiple_ips_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail events are normalized use the Authentication datamodel. known_false_positives: It is highly unlikely to have two login attempts from entirely differnt IP addresses. @@ -34,7 +30,7 @@ tags: impact: 90 kill_chain_phases: - Actions on Objectives - message: User $user$ has successfully logged into the AWS Console from different IP addresses $src$ with 5 mins + message: User $user_arn$ has successfully logged into the AWS Console from different IP addresses $src$ within 10 mins mitre_attack_id: - T1586 - T1535 @@ -64,4 +60,4 @@ tags: - Authentication.action - Authentication.user_type risk_score: 72 - security_domain: threat + security_domain: threat \ No newline at end of file diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml index 2ceb9734df..1b71f76863 100644 --- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -12,7 +12,7 @@ how_to_implement: how_to_implement: You must install Splunk AWS add on and Splun search works when AWS CloudTrail logs. known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. references: -- https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks +- https://aws.amazon.com/blogs/security/you-can-now-assign-multiple-mfa-devices-in-iam/ - https://attack.mitre.org/techniques/T1556/ - https://attack.mitre.org/techniques/T1556/006/ - https://twitter.com/jhencinski/status/1618660062352007174 From 1e9e0a1c5abec99b2f364a7e80198d9d2ea1a09a Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Tue, 31 Jan 2023 16:50:58 -0800 Subject: [PATCH 32/45] remove wrong file --- lookups/REFERENCE_CACHE.db.db | Bin 16384 -> 0 bytes 1 file changed, 0 insertions(+), 0 deletions(-) delete mode 100644 lookups/REFERENCE_CACHE.db.db diff --git a/lookups/REFERENCE_CACHE.db.db b/lookups/REFERENCE_CACHE.db.db deleted file mode 100644 index 6558e5f59cd95c00adc7f97e6dcf68a70328ce6e..0000000000000000000000000000000000000000 GIT binary patch literal 0 HcmV?d00001 literal 16384 zcmeIu!41MN5Cp&tL?{m)eCQ!r%d)PcZuT!SBIES>gjOFnCIxo=5M$-F1G z(&m~>C2D2qO}TFe=bmfHx~A9T`99kEMytLZ7fbu Date: Tue, 31 Jan 2023 17:02:34 -0800 Subject: [PATCH 33/45] fix yaml --- detections/cloud/aws_new_mfa_method_registered_for_user.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml index 1b71f76863..5e6185d2d6 100644 --- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -8,7 +8,7 @@ datamodel: [] description: The following analytic identifies the registration of a new Multi Factor authentication method for an AAWS account. Adversaries who have obtained unauthorized access to an AWS account may register a new MFA method to maintain persistence. search: ' `cloudtrail` eventName=CreateVirtualMFADevice | stats count values(requestParameters.virtualMFADeviceName) as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_new_mfa_method_registered_for_user_filter`' -how_to_implement: how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This +how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail logs. known_false_positives: Newly onboarded users who are registering an MFA method for the first time will also trigger this detection. references: From 5dd64e3fd1ac610ee09fbcaa28a39a970c09f4f8 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Feb 2023 17:01:28 -0800 Subject: [PATCH 34/45] aws concurrent detections --- ...concurrent_sessions_from_different_ips.yml | 66 +++++++++++++++++++ ...rrent_sessions_from_different_ips.test.yml | 13 ++++ 2 files changed, 79 insertions(+) create mode 100644 detections/cloud/aws_concurrent_sessions_from_different_ips.yml create mode 100644 tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml diff --git a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml new file mode 100644 index 0000000000..0ca09d2ddb --- /dev/null +++ b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml @@ -0,0 +1,66 @@ +name: AWS Concurrent Sessions From Different Ips +id: 51c04fdb-2746-465a-b86e-b413a09c9085 +version: 1 +date: '2023-02-01' +author: Bhavin Patel, Splunk +type: TTP +datamodel: [] +description: The following analytic identifies an AWS account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. In AWS, when a user is navigating the AWS Console, we observed an API call - `DescribeEventAggregates` being registered in the cloudtrail log. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. The presence of this event occuring fromm two different IP addresses is highly unlikely +search: ' `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal" +| bin span=5m _time +| stats values(userAgent) values(eventName) values(src_ip) as src_ip dc(src_ip) as distinct_ip_count by _time user_arn +| where distinct_ip_count > 1 + | `aws_concurrent_sessions_from_different_ips_filter`' +how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This + search works with AWS CloudTrail logs. +known_false_positives: A user with concurrent sessions from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment. +references: +- https://attack.mitre.org/techniques/T1185/ +- https://breakdev.org/evilginx-2-next-generation-of-phishing-2fa-tokens/ +- https://github.com/kgretzky/evilginx2 +tags: + analytic_story: + - Compromised User Account + - AWS Identity and Access Management Account + asset_type: AWS Accoun + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + confidence: 60 + context: + - Source:Cloud Data + - Stage:Initial Access + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json + impact: 70 + kill_chain_phases: + - Exploitation + message: User $user_arn$ has concurrent sessions from more than one unique IP address $src_ip$ in the span of 5 minutes. + mitre_attack_id: + - T1185 + nist: + - DE.CM + observable: + - name: user_arn + type: User + role: + - Victim + - name: src_ip + type: IP Address + role: + - Attacker + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - eventName + - userAgent + - errorCode + - user_arn + - aws_account_id + - src_ip + risk_score: 42 + security_domain: threat \ No newline at end of file diff --git a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml new file mode 100644 index 0000000000..4e2664b79b --- /dev/null +++ b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml @@ -0,0 +1,13 @@ +name: AWS Concurrent Sessions From Different Ips Unit Test +tests: +- name: AWS Concurrent Sessions From Different Ips + file: cloud/aws_concurrent_sessions_from_different_ips.yml + pass_condition: '| stats count | where count > 0' + earliest_time: -24h + latest_time: now + attack_data: + - file_name: cloudtrail.json + data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: true From 706b0842a307a3bec92e7f604636fa8b5fe39504 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Feb 2023 17:12:36 -0800 Subject: [PATCH 35/45] minor error test file --- tests/cloud/aws_console_logins_from_multiple_ips.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml index 547ec29026..280d1b83b7 100644 --- a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml +++ b/tests/cloud/aws_console_logins_from_multiple_ips.test.yml @@ -3,7 +3,7 @@ tests: - name: AWS Console Logins From Multiple IPs file: cloud/aws_console_logins_from_multiple_ips.yml pass_condition: '| stats count | where count > 0' - earliest_time: -7dh + earliest_time: -7d latest_time: now attack_data: - file_name: cloudtrail.json From 389d1e34aeebe6647e83b838a2b4d9478309a10c Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Feb 2023 17:14:07 -0800 Subject: [PATCH 36/45] updating test filee --- tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml index 4e2664b79b..64f956ff88 100644 --- a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml +++ b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml @@ -10,4 +10,4 @@ tests: data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail - update_timestamp: true + update_timestamp: true \ No newline at end of file From 7c88bf93c91b8672da2db3d37a1fa16b934531a7 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Wed, 1 Feb 2023 17:19:30 -0800 Subject: [PATCH 37/45] validation error --- .../cloud/aws_concurrent_sessions_from_different_ips.yml | 6 +++--- .../aws_concurrent_sessions_from_different_ips.test.yml | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml index 0ca09d2ddb..a04f9576f9 100644 --- a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml @@ -5,7 +5,7 @@ date: '2023-02-01' author: Bhavin Patel, Splunk type: TTP datamodel: [] -description: The following analytic identifies an AWS account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. In AWS, when a user is navigating the AWS Console, we observed an API call - `DescribeEventAggregates` being registered in the cloudtrail log. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. The presence of this event occuring fromm two different IP addresses is highly unlikely +description: The following analytic identifies an AWS account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. In AWS, when a user is navigating the AWS Console, we observed an API call - `DescribeEventAggregates` being registered in the cloudtrail log. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. The presence of this event occuring fromm two different IP addresses is highly unlikely. search: ' `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal" | bin span=5m _time | stats values(userAgent) values(eventName) values(src_ip) as src_ip dc(src_ip) as distinct_ip_count by _time user_arn @@ -22,7 +22,7 @@ tags: analytic_story: - Compromised User Account - AWS Identity and Access Management Account - asset_type: AWS Accoun + asset_type: AWS Account cis20: - CIS 3 - CIS 5 @@ -55,7 +55,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - _time - eventName - userAgent - errorCode diff --git a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml index 64f956ff88..72faec2903 100644 --- a/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml +++ b/tests/cloud/aws_concurrent_sessions_from_different_ips.test.yml @@ -7,7 +7,7 @@ tests: latest_time: now attack_data: - file_name: cloudtrail.json - data: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1185/aws_concurrent_sessions_from_different_ips/cloudtrail.json sourcetype: aws:cloudtrail source: aws_cloudtrail update_timestamp: true \ No newline at end of file From bc7fa3078f5deb6e8df10f500cf53f1f87ac3dcc Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 2 Feb 2023 18:38:06 -0500 Subject: [PATCH 38/45] multiple fixes --- ...ws_concurrent_sessions_from_different_ips.yml | 12 ++++++++---- ...number_of_failed_authentications_for_user.yml | 12 ++++++++---- ..._number_of_failed_authentications_from_ip.yml | 12 ++++++++---- .../aws_new_mfa_method_registered_for_user.yml | 7 +++++-- detections/cloud/aws_password_policy_changes.yml | 2 +- ...console_authentication_from_multiple_ips.yml} | 16 +++++++++++----- ..._number_of_failed_authentications_from_ip.yml | 4 ++-- ...essful_authentication_from_different_ips.yml} | 6 +++--- ...le_authentication_from_multiple_ips.test.yml} | 6 +++--- ...l_authentication_from_different_ips.test.yml} | 6 +++--- 10 files changed, 52 insertions(+), 31 deletions(-) rename detections/cloud/{aws_console_logins_from_multiple_ips.yml => aws_successful_console_authentication_from_multiple_ips.yml} (55%) rename detections/cloud/{azure_ad_succesful_authentication_from_different_ips.yml => azure_ad_successful_authentication_from_different_ips.yml} (91%) rename tests/cloud/{aws_console_logins_from_multiple_ips.test.yml => aws_successful_console_authentication_from_multiple_ips.test.yml} (65%) rename tests/cloud/{azure_ad_succesful_authentication_from_different_ips.test.yml => azure_ad_successful_authentication_from_different_ips.test.yml} (70%) diff --git a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml index a04f9576f9..4498ed8c1f 100644 --- a/detections/cloud/aws_concurrent_sessions_from_different_ips.yml +++ b/detections/cloud/aws_concurrent_sessions_from_different_ips.yml @@ -5,11 +5,15 @@ date: '2023-02-01' author: Bhavin Patel, Splunk type: TTP datamodel: [] -description: The following analytic identifies an AWS account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. In AWS, when a user is navigating the AWS Console, we observed an API call - `DescribeEventAggregates` being registered in the cloudtrail log. This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate online resources. As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. The presence of this event occuring fromm two different IP addresses is highly unlikely. +description: The following analytic identifies an AWS IAM account with concurrent sessions coming from more than one unique IP address within the span of 5 minutes. + This behavior could represent a session hijacking attack whereby an adversary has extracted cookies from a victims browser and is using them from a different location to access corporate + online resources. When a user navigates the AWS Console after authentication, the API call with the event name `DescribeEventAggregates` is registered in the AWS CloudTrail logs. The Splunk Threat Research team leveraged + this event name to identify 2 concurrent sessions. The presence of this event occurring from two different IP addresses is highly unlikely. + As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. search: ' `cloudtrail` eventName = DescribeEventAggregates src_ip!="AWS Internal" -| bin span=5m _time -| stats values(userAgent) values(eventName) values(src_ip) as src_ip dc(src_ip) as distinct_ip_count by _time user_arn -| where distinct_ip_count > 1 + | bin span=5m _time + | stats values(userAgent) values(eventName) values(src_ip) as src_ip dc(src_ip) as distinct_ip_count by _time user_arn + | where distinct_ip_count > 1 | `aws_concurrent_sessions_from_different_ips_filter`' how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml index 3e60fc1946..bd36953833 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_for_user.yml @@ -5,12 +5,16 @@ date: '2023-01-27' author: Bhavin Patel, Splunk type: Anomaly datamodel: [] -description: The following analytic identifies an AWS IAM User account with more than 20 failed authentication events in the span of 10 minutes. This behavior could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS failed_attempts values(src_ip) as src_ip values(user_agent) by _time, user_name, eventName, eventSource aws_account_id | where failed_attempts > 20 | `aws_high_number_of_failed_authentications_for_user_filter`' +description: The following analytic identifies an AWS account with more than 20 failed authentication events in the span of 5 minutes. This behavior + could represent a brute force attack against the account. As environments differ across organizations, security teams should customize the threshold of this detection. +search: '`cloudtrail` eventName=ConsoleLogin action=failure + | bucket span=10m _time + | stats dc(_raw) AS failed_attempts values(src_ip) as src_ip values(user_agent) by _time, user_name, eventName, eventSource aws_account_id + | where failed_attempts > 20 + | `aws_high_number_of_failed_authentications_for_user_filter`' how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -known_false_positives: While this search has no known false positives, it is possible - that an AWS admin has legitimately triggered an AWS audit tool activity which may trigger this event. +known_false_positives: A user with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. references: - https://www.trendmicro.com/cloudoneconformity/knowledge-base/aws/IAM/password-policy.html tags: diff --git a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml index 6a257101c0..154d30a99b 100644 --- a/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/aws_high_number_of_failed_authentications_from_ip.yml @@ -5,11 +5,15 @@ date: '2023-01-30' author: Bhavin Patel, Splunk type: Anomaly datamodel: [] -description: The following analytic identifies an IP address which failing to authenticate 20 or more times to an AWS Web Console in the span of 10 minutes. This behavior - could represent a brute force attack againstan Azure AD. As environments differ across organizations, security teams should customize the threshold of this detection. This behavior could represent an adversary performing a Password Spraying attack against an AWS environment tenant to obtain initial access or elevate privileges. -search: '`cloudtrail` eventName=ConsoleLogin action=failure | bucket span=10m _time | stats dc(_raw) AS failed_attempts values(user_name) as tried_accounts values(user_agent) by _time, src_ip, eventName, eventSource aws_account_id | where failed_attempts > 20 |`aws_high_number_of_failed_authentications_from_ip_filter`' +description: The following analytic identifies an IP address failing to authenticate 20 or more times to the AWS Web Console in the span of 5 minutes. This behavior + could represent a brute force attack against an AWS tenant to obtain initial access or elevate privileges. As environments differ across organizations, security teams should customize the threshold of this detection. +search: '`cloudtrail` eventName=ConsoleLogin action=failure + | bucket span=5m _time + | stats dc(_raw) AS failed_attempts values(user_name) as tried_accounts values(user_agent) by _time, src_ip, eventName, eventSource aws_account_id + | where failed_attempts > 20 + | `aws_high_number_of_failed_authentications_from_ip_filter`' how_to_implement: You must install Splunk Add-on for AWS in order to ingest Cloudtrail. We recommend the users to try different combinations of the bucket span time and the tried account threshold to tune this search according to their environment. -known_false_positives: No known false postives for this detection. Please review this alert +known_false_positives: An Ip address with more than 20 failed authentication attempts in the span of 5 minutes may also be triggered by a broken application. references: - https://attack.mitre.org/techniques/T1110/003/ - https://www.whiteoaksecurity.com/blog/goawsconsolespray-password-spraying-tool/ diff --git a/detections/cloud/aws_new_mfa_method_registered_for_user.yml b/detections/cloud/aws_new_mfa_method_registered_for_user.yml index 5e6185d2d6..9c2c9bcbc0 100644 --- a/detections/cloud/aws_new_mfa_method_registered_for_user.yml +++ b/detections/cloud/aws_new_mfa_method_registered_for_user.yml @@ -5,8 +5,11 @@ date: '2023-01-31' author: Bhavin Patel, Splunk type: TTP datamodel: [] -description: The following analytic identifies the registration of a new Multi Factor authentication method for an AAWS account. Adversaries who have obtained unauthorized access to an AWS account may register a new MFA method to maintain persistence. -search: ' `cloudtrail` eventName=CreateVirtualMFADevice | stats count values(requestParameters.virtualMFADeviceName) as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +description: The following analytic identifies the registration of a new Multi Factor authentication method for an AWS account. Adversaries who have obtained unauthorized access to an AWS account may register a new MFA method to maintain persistence. +search: ' `cloudtrail` eventName=CreateVirtualMFADevice + | stats count values(requestParameters.virtualMFADeviceName) as virtualMFADeviceName min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId user_arn src_ip + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_new_mfa_method_registered_for_user_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail logs. diff --git a/detections/cloud/aws_password_policy_changes.yml b/detections/cloud/aws_password_policy_changes.yml index b780210215..9ed4eee7b0 100644 --- a/detections/cloud/aws_password_policy_changes.yml +++ b/detections/cloud/aws_password_policy_changes.yml @@ -5,7 +5,7 @@ date: '2023-01-26' author: Bhavin Patel, Splunk type: Hunting datamodel: [] -description: This search looks for AWS CloudTrail events where a user is making succesfull API calls to view/update/delete the existing password policy in your AWS organizations. It is highly unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised. +description: This search looks for AWS CloudTrail events where a user is making successful API calls to view/update/delete the existing password policy in an AWS organization. It is unlikely for a regular user to conduct this operation. These events may potentially be malicious, adversaries often use this information to gain more understanding of the password defenses in place and exploit them to increase their attack surface when a user account is compromised. search: '`cloudtrail` eventName IN ("UpdateAccountPasswordPolicy","GetAccountPasswordPolicy","DeleteAccountPasswordPolicy") errorCode=success | stats count values(eventName) as eventName values(userAgent) min(_time) as firstTime max(_time) as lastTime by eventSource aws_account_id errorCode awsRegion userIdentity.principalId user_arn src_ip | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `aws_password_policy_changes_filter`' how_to_implement: You must install Splunk AWS Add on and Splunk App for AWS. This search works with AWS CloudTrail logs. diff --git a/detections/cloud/aws_console_logins_from_multiple_ips.yml b/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml similarity index 55% rename from detections/cloud/aws_console_logins_from_multiple_ips.yml rename to detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml index b043a4eb1b..c923a7f4ae 100644 --- a/detections/cloud/aws_console_logins_from_multiple_ips.yml +++ b/detections/cloud/aws_successful_console_authentication_from_multiple_ips.yml @@ -1,15 +1,21 @@ -name: AWS Console Logins From Multiple IPs +name: AWS Successful Console Authentication From Multiple IPs id: 395e50e1-2b87-4fa3-8632-0dfbdcbcd2cb version: 1 date: '2023-01-19' author: Bhavin Patel, Splunk type: Anomaly datamodel: [] -description: This search looks for AWS CloudTrail authentication events where there are successfull AWS Console Login events from 2 or more different source IP addresses within a span of 10 mins. Often times, attackers with start with a phishing campaigns to commpromise cloud user accounts and would proceeed with trying to those use credentials before they would potentially expire or if the user rotates their credential then its no longer valid. Detecting successfull login attempts in from a short time window is a strong indicator of malicious behavior. -search: ' `cloudtrail` eventName = ConsoleLogin | bin span=10m _time | stats values(userAgent) values(eventName) values(src_ip) dc(src_ip) as distinct_ip_count by _time user_arn | where distinct_ip_count>1 | `aws_console_logins_from_multiple_ips_filter`' +description: The following analytic identifies an AWS account successfully authenticating from more than one unique Ip address in the span of 5 minutes. This behavior could represent + an adversary who has stolen credentials via a phishing attack or some other method and using them to access corporate online resources around the same time as a legitimate user. + As users may behave differently across organizations, security teams should test and customize this detection to fit their environments. +search: ' `cloudtrail` eventName = ConsoleLogin + | bin span=5m _time + | stats values(userAgent) values(eventName) values(src_ip) dc(src_ip) as distinct_ip_count by _time user_arn + | where distinct_ip_count>1 + | `aws_successful_console_authentication_from_multiple_ips_filter`' how_to_implement: You must install Splunk AWS add on and Splunk App for AWS. This search works when AWS CloudTrail events are normalized use the Authentication datamodel. -known_false_positives: It is highly unlikely to have two login attempts from entirely differnt IP addresses. +known_false_positives: A user with successful authentication events from different Ips may also represent the legitimate use of more than one device. Filter as needed and/or customize the threshold to fit your environment. references: - https://rhinosecuritylabs.com/aws/mfa-phishing-on-aws/ tags: @@ -30,7 +36,7 @@ tags: impact: 90 kill_chain_phases: - Actions on Objectives - message: User $user_arn$ has successfully logged into the AWS Console from different IP addresses $src$ within 10 mins + message: User $user_arn$ has successfully logged into the AWS Console from different IP addresses $src$ within 5 mins mitre_attack_id: - T1586 - T1535 diff --git a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml index 4e170cd933..918b0dc752 100644 --- a/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml +++ b/detections/cloud/azure_ad_high_number_of_failed_authentications_from_ip.yml @@ -5,8 +5,8 @@ date: '2023-01-23' author: Mauricio Velazco, Splunk type: TTP datamodel: [] -description: The following analytic identifies an Ip address which failing to authenticate 20 or more times to an Azure AD tenant in the span of 5 minutes. This behavior - could represent a brute force attack againstan Azure AD. As environments differ across organizations, security teams should customize the threshold of this detection. +description: The following analytic identifies an Ip address failing to authenticate 20 or more times to an Azure AD tenant in the span of 5 minutes. This behavior + could represent a brute force attack againstan Azure AD to obtain initial access or elevate privileges. As environments differ across organizations, security teams should customize the threshold of this detection. search: ' `azuread` category= SignInLogs properties.status.errorCode=50126 properties.authenticationDetails{}.succeeded=false | rename properties.* as * | bucket span=5m _time diff --git a/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml similarity index 91% rename from detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml rename to detections/cloud/azure_ad_successful_authentication_from_different_ips.yml index 55a1ab4bd8..22dc46ffe5 100644 --- a/detections/cloud/azure_ad_succesful_authentication_from_different_ips.yml +++ b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml @@ -1,4 +1,4 @@ -name: Azure AD Succesful Authentication From Different Ips +name: Azure AD Successful Authentication From Different Ips id: be6d868d-33b6-4aaa-912e-724fb555b11a version: 1 date: '2023-01-24' @@ -13,7 +13,7 @@ search: ' `azuread` properties.authenticationDetails{}.succeeded=true category=S | bucket span=5m _time | stats dc(ipAddress) AS unique_ips values(ipAddress) values(appDisplayName) by _time, userPrincipalName | where unique_ips > 1 - | `azure_ad_succesful_authentication_from_different_ips_filter`' + | `azure_ad_successful_authentication_from_different_ips_filter`' how_to_implement: You must install the latest version of Splunk Add-on for Microsoft Cloud Services from Splunkbase (https://splunkbase.splunk.com/app/3110/#/details). You must be ingesting Azure Active Directory events into your Splunk environment. Specifically, this analytic leverages the SignInLogs log category. @@ -36,7 +36,7 @@ tags: - Source:Cloud Data - Stage:Initial Access dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_succesful_authentication_from_different_ips/azuread.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread.log impact: 70 kill_chain_phases: - Exploitation diff --git a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml b/tests/cloud/aws_successful_console_authentication_from_multiple_ips.test.yml similarity index 65% rename from tests/cloud/aws_console_logins_from_multiple_ips.test.yml rename to tests/cloud/aws_successful_console_authentication_from_multiple_ips.test.yml index 280d1b83b7..d408e012d2 100644 --- a/tests/cloud/aws_console_logins_from_multiple_ips.test.yml +++ b/tests/cloud/aws_successful_console_authentication_from_multiple_ips.test.yml @@ -1,7 +1,7 @@ -name: AWS Console Logins From Multiple IPs Unit Test +name: AWS Successful Console Authentication From Multiple IPs Unit Test tests: -- name: AWS Console Logins From Multiple IPs - file: cloud/aws_console_logins_from_multiple_ips.yml +- name: AWS Successful Console Authentication From Multiple IPs + file: cloud/aws_successful_console_authentication_from_multiple_ips.yml pass_condition: '| stats count | where count > 0' earliest_time: -7d latest_time: now diff --git a/tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml b/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml similarity index 70% rename from tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml rename to tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml index 61fc50f54d..f8b7a85cfa 100644 --- a/tests/cloud/azure_ad_succesful_authentication_from_different_ips.test.yml +++ b/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml @@ -1,13 +1,13 @@ -name: Azure AD Succesful Authentication From Different Ips Unit Test +name: Azure AD Successful Authentication From Different Ips Unit Test tests: -- name: Azure AD Succesful Authentication From Different Ips +- name: Azure AD Successful Authentication From Different Ips file: cloud/azure_ad_succesful_authentication_from_different_ips.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now attack_data: - file_name: azuread.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_succesful_authentication_from_different_ips/azuread.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1110.001/azure_ad_successful_authentication_from_different_ips/azuread.log source: mscs:azure:eventhub sourcetype: mscs:azure:eventhub update_timestamp: true From 5ae3a295a7154035fa935834047c0b4395ea8201 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Thu, 2 Feb 2023 19:09:32 -0500 Subject: [PATCH 39/45] fix typo --- ...ure_ad_successful_authentication_from_different_ips.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml b/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml index f8b7a85cfa..04acd597bf 100644 --- a/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml +++ b/tests/cloud/azure_ad_successful_authentication_from_different_ips.test.yml @@ -1,7 +1,7 @@ name: Azure AD Successful Authentication From Different Ips Unit Test tests: - name: Azure AD Successful Authentication From Different Ips - file: cloud/azure_ad_succesful_authentication_from_different_ips.yml + file: cloud/azure_ad_successful_authentication_from_different_ips.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now From 60ea283f53ba24959733e82e872c98dfe8be38e7 Mon Sep 17 00:00:00 2001 From: pyth0n1c <87383215+pyth0n1c@users.noreply.github.com> Date: Thu, 2 Feb 2023 16:32:24 -0800 Subject: [PATCH 40/45] Moving failing tests to experimental --- .../application/detect_risky_spl_using_pretrained_ml_model.yml | 0 .../application/splunk_xss_in_monitoring_console.yml | 0 .../abnormally_high_number_of_cloud_security_group_api_calls.yml | 0 .../aws_cross_account_activity_from_previously_unseen_account.yml | 0 .../{ => experimental}/cloud/circle_ci_disable_security_step.yml | 0 .../cloud/cloud_api_calls_from_previously_unseen_user_roles.yml | 0 .../cloud_compute_instance_created_by_previously_unseen_user.yml | 0 .../cloud/cloud_instance_modified_with_previously_unseen_user.yml | 0 .../cloud/gsuite_drive_share_in_external_email.yml | 0 .../dllhost_with_no_command_line_arguments_with_network.yml | 0 .../endpoint/windows_vulnerable_driver_loaded.yml | 0 .../detect_risky_spl_using_pretrained_ml_model.test.yml | 0 .../application/splunk_xss_in_monitoring_console.test.yml | 0 ...ormally_high_number_of_cloud_security_group_api_calls.test.yml | 0 ...cross_account_activity_from_previously_unseen_account.test.yml | 0 .../cloud/circle_ci_disable_security_step.test.yml | 0 .../cloud_api_calls_from_previously_unseen_user_roles.test.yml | 0 ...ud_compute_instance_created_by_previously_unseen_user.test.yml | 0 .../cloud_instance_modified_with_previously_unseen_user.test.yml | 0 .../cloud/gsuite_drive_share_in_external_email.test.yml | 0 .../dllhost_with_no_command_line_arguments_with_network.test.yml | 0 .../endpoint/windows_vulnerable_driver_loaded.test.yml | 0 22 files changed, 0 insertions(+), 0 deletions(-) rename detections/{ => experimental}/application/detect_risky_spl_using_pretrained_ml_model.yml (100%) rename detections/{ => experimental}/application/splunk_xss_in_monitoring_console.yml (100%) rename detections/{ => experimental}/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml (100%) rename detections/{ => experimental}/cloud/aws_cross_account_activity_from_previously_unseen_account.yml (100%) rename detections/{ => experimental}/cloud/circle_ci_disable_security_step.yml (100%) rename detections/{ => experimental}/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml (100%) rename detections/{ => experimental}/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml (100%) rename detections/{ => experimental}/cloud/cloud_instance_modified_with_previously_unseen_user.yml (100%) rename detections/{ => experimental}/cloud/gsuite_drive_share_in_external_email.yml (100%) rename detections/{ => experimental}/endpoint/dllhost_with_no_command_line_arguments_with_network.yml (100%) rename detections/{ => experimental}/endpoint/windows_vulnerable_driver_loaded.yml (100%) rename tests/{ => experimental}/application/detect_risky_spl_using_pretrained_ml_model.test.yml (100%) rename tests/{ => experimental}/application/splunk_xss_in_monitoring_console.test.yml (100%) rename tests/{ => experimental}/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml (100%) rename tests/{ => experimental}/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml (100%) rename tests/{ => experimental}/cloud/circle_ci_disable_security_step.test.yml (100%) rename tests/{ => experimental}/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml (100%) rename tests/{ => experimental}/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml (100%) rename tests/{ => experimental}/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml (100%) rename tests/{ => experimental}/cloud/gsuite_drive_share_in_external_email.test.yml (100%) rename tests/{ => experimental}/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml (100%) rename tests/{ => experimental}/endpoint/windows_vulnerable_driver_loaded.test.yml (100%) diff --git a/detections/application/detect_risky_spl_using_pretrained_ml_model.yml b/detections/experimental/application/detect_risky_spl_using_pretrained_ml_model.yml similarity index 100% rename from detections/application/detect_risky_spl_using_pretrained_ml_model.yml rename to detections/experimental/application/detect_risky_spl_using_pretrained_ml_model.yml diff --git a/detections/application/splunk_xss_in_monitoring_console.yml b/detections/experimental/application/splunk_xss_in_monitoring_console.yml similarity index 100% rename from detections/application/splunk_xss_in_monitoring_console.yml rename to detections/experimental/application/splunk_xss_in_monitoring_console.yml diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/experimental/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml similarity index 100% rename from detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml rename to detections/experimental/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/experimental/cloud/aws_cross_account_activity_from_previously_unseen_account.yml similarity index 100% rename from detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml rename to detections/experimental/cloud/aws_cross_account_activity_from_previously_unseen_account.yml diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/experimental/cloud/circle_ci_disable_security_step.yml similarity index 100% rename from detections/cloud/circle_ci_disable_security_step.yml rename to detections/experimental/cloud/circle_ci_disable_security_step.yml diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/experimental/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml similarity index 100% rename from detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml rename to detections/experimental/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/experimental/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml similarity index 100% rename from detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml rename to detections/experimental/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/experimental/cloud/cloud_instance_modified_with_previously_unseen_user.yml similarity index 100% rename from detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml rename to detections/experimental/cloud/cloud_instance_modified_with_previously_unseen_user.yml diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/experimental/cloud/gsuite_drive_share_in_external_email.yml similarity index 100% rename from detections/cloud/gsuite_drive_share_in_external_email.yml rename to detections/experimental/cloud/gsuite_drive_share_in_external_email.yml diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/experimental/endpoint/dllhost_with_no_command_line_arguments_with_network.yml similarity index 100% rename from detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml rename to detections/experimental/endpoint/dllhost_with_no_command_line_arguments_with_network.yml diff --git a/detections/endpoint/windows_vulnerable_driver_loaded.yml b/detections/experimental/endpoint/windows_vulnerable_driver_loaded.yml similarity index 100% rename from detections/endpoint/windows_vulnerable_driver_loaded.yml rename to detections/experimental/endpoint/windows_vulnerable_driver_loaded.yml diff --git a/tests/application/detect_risky_spl_using_pretrained_ml_model.test.yml b/tests/experimental/application/detect_risky_spl_using_pretrained_ml_model.test.yml similarity index 100% rename from tests/application/detect_risky_spl_using_pretrained_ml_model.test.yml rename to tests/experimental/application/detect_risky_spl_using_pretrained_ml_model.test.yml diff --git a/tests/application/splunk_xss_in_monitoring_console.test.yml b/tests/experimental/application/splunk_xss_in_monitoring_console.test.yml similarity index 100% rename from tests/application/splunk_xss_in_monitoring_console.test.yml rename to tests/experimental/application/splunk_xss_in_monitoring_console.test.yml diff --git a/tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml b/tests/experimental/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml similarity index 100% rename from tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml rename to tests/experimental/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml diff --git a/tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml b/tests/experimental/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml similarity index 100% rename from tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml rename to tests/experimental/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml diff --git a/tests/cloud/circle_ci_disable_security_step.test.yml b/tests/experimental/cloud/circle_ci_disable_security_step.test.yml similarity index 100% rename from tests/cloud/circle_ci_disable_security_step.test.yml rename to tests/experimental/cloud/circle_ci_disable_security_step.test.yml diff --git a/tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml b/tests/experimental/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml similarity index 100% rename from tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml rename to tests/experimental/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml diff --git a/tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml b/tests/experimental/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml similarity index 100% rename from tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml rename to tests/experimental/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml diff --git a/tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml b/tests/experimental/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml similarity index 100% rename from tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml rename to tests/experimental/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml diff --git a/tests/cloud/gsuite_drive_share_in_external_email.test.yml b/tests/experimental/cloud/gsuite_drive_share_in_external_email.test.yml similarity index 100% rename from tests/cloud/gsuite_drive_share_in_external_email.test.yml rename to tests/experimental/cloud/gsuite_drive_share_in_external_email.test.yml diff --git a/tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml b/tests/experimental/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml similarity index 100% rename from tests/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml rename to tests/experimental/endpoint/dllhost_with_no_command_line_arguments_with_network.test.yml diff --git a/tests/endpoint/windows_vulnerable_driver_loaded.test.yml b/tests/experimental/endpoint/windows_vulnerable_driver_loaded.test.yml similarity index 100% rename from tests/endpoint/windows_vulnerable_driver_loaded.test.yml rename to tests/experimental/endpoint/windows_vulnerable_driver_loaded.test.yml From ecda0cb289c7eb6aed25869c3a0b59a960c27273 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 3 Feb 2023 09:15:35 +0100 Subject: [PATCH 41/45] Update suspicious_process_file_path.yml --- detections/endpoint/suspicious_process_file_path.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index 03fc872956..4c86863b05 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -52,6 +52,7 @@ tags: - Chaos Ransomware - LockBit Ransomware - AsyncRAT + - Swift Slicer automated_detection_testing: passed confidence: 50 context: From af5c030cb37161cf33b2ce19e9b20a94ff12558b Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 3 Feb 2023 09:17:11 +0100 Subject: [PATCH 42/45] Update executables_or_script_creation_in_suspicious_path.yml --- .../executables_or_script_creation_in_suspicious_path.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index 90c96e45b9..0320a29342 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -53,6 +53,7 @@ tags: - Chaos Ransomware - LockBit Ransomware - AsyncRAT + - Swift Slicer automated_detection_testing: passed confidence: 50 context: From 192b93a110bf6e66c2c076e3cb66870020a343a4 Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 3 Feb 2023 10:53:26 -0500 Subject: [PATCH 43/45] adding required field --- .../azure_ad_successful_authentication_from_different_ips.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml index 22dc46ffe5..25bf663c49 100644 --- a/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml +++ b/detections/cloud/azure_ad_successful_authentication_from_different_ips.yml @@ -67,5 +67,6 @@ tags: - properties.authenticationDetails - properties.userPrincipalName - properties.ipAddress + - properties.appDisplayName risk_score: 56 security_domain: identity \ No newline at end of file From 621fe10dfd8b13ff56f035a628cfaaf4fbb7013f Mon Sep 17 00:00:00 2001 From: mvelazco Date: Fri, 3 Feb 2023 12:40:01 -0500 Subject: [PATCH 44/45] Delete test_config_bak.json --- .../test_config_bak.json | 123 ------------------ 1 file changed, 123 deletions(-) delete mode 100644 bin/docker_detection_tester/test_config_bak.json diff --git a/bin/docker_detection_tester/test_config_bak.json b/bin/docker_detection_tester/test_config_bak.json deleted file mode 100644 index e6e2354d16..0000000000 --- a/bin/docker_detection_tester/test_config_bak.json +++ /dev/null @@ -1,123 +0,0 @@ -{ - "apps": { - "ADD_ON_FOR_LINUX_SYSMON": { - "app_number": 6176, - "app_version": "1.0.4", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/add-on-for-linux-sysmon_104.tgz" - }, - "PYTHON_FOR_SCIENTIFIC_COMPUTING_FOR_LINUX_64_BIT": { - "app_number": 2882, - "app_version": "3.0.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/python-for-scientific-computing-for-linux-64-bit_302.tgz" - }, - "SPLUNK_ADD_ON_FOR_AMAZON_KINESIS_FIREHOSE": { - "app_number": 3719, - "app_version": "1.3.2", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-amazon-kinesis-firehose_132.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_OFFICE_365": { - "app_number": 4055, - "app_version": "2.2.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-office-365_220.tgz" - }, - "SPLUNK_ADD_ON_FOR_MICROSOFT_WINDOWS": { - "app_number": 742, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-windows_840.tgz" - }, - "SPLUNK_ADD_ON_FOR_NGINX": { - "app_number": 3258, - "app_version": "3.1.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-nginx_310.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_FORWARDERS": { - "app_number": 5238, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-forwarders_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_STREAM_WIRE_DATA": { - "app_number": 5234, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-stream-wire-data_801.tgz" - }, - "SPLUNK_ADD_ON_FOR_SYSMON": { - "app_number": 5709, - "app_version": "2.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-sysmon_200.tgz" - }, - "SPLUNK_ADD_ON_FOR_UNIX_AND_LINUX": { - "app_number": 833, - "app_version": "8.4.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-unix-and-linux_840.tgz" - }, - "SPLUNK_APP_FOR_STREAM": { - "app_number": 1809, - "app_version": "8.0.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-app-for-stream_801.tgz" - }, - "SPLUNK_COMMON_INFORMATION_MODEL": { - "app_number": 1621, - "app_version": "5.0.0", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-common-information-model-cim_500.tgz" - }, - "SPLUNK_ES_CONTENT_UPDATE": { - "app_number": 3449, - "app_version": null, - "local_path": null - }, - "SPLUNK_MACHINE_LEARNING_TOOLKIT": { - "app_number": 2890, - "app_version": "5.3.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_531.tgz" - }, - "SPLUNK_TA_FOR_ZEEK": { - "app_number": 5466, - "app_version": "1.0.5", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/ta-for-zeek_105.tgz" - }, - "SPLUNK_TA_MICROSOFT_CLOUD_SERVICES": { - "app_number": 3110, - "app_version": "4.5.1", - "http_path": "https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-add-on-for-microsoft-cloud-services_451.tgz" - } - }, - "branch": "TR-2326_migrate_password_spraying_xml", - "commit_hash": null, - "container_tag": "latest", - "detections_list": [ - "security_content/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml", - "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml", - "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml", - "security_content/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml", - "security_content/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml", - "security_content/detections/endpoint/windows_disabled_users_failing_to_authenticate_kerberos.yml", - "security_content/detections/endpoint/windows_invalid_users_failed_authentication_via_kerberos.yml", - "security_content/detections/endpoint/windows_users_authenticate_using_explicit_credentials.yml"], - "folders": [ - "endpoint", - "cloud", - "network", - "web", - "application" - ], - "interactive": true, - "local_base_container_name": "splunk_test_%d", - "mock": false, - "mode": "selected", - "no_interactive_failure": false, - "num_containers": 1, - "persist_security_content": true, - "pr_number": null, - "reuse_image": true, - "show_splunk_app_password": false, - "splunk_app_password": null, - - "splunk_container_apps_directory": "/opt/splunk/etc/apps", - "splunkbase_password": null, - "splunkbase_username": null, - "types": [ - "Anomaly", - "Hunting", - "TTP" - ] -} From 31413e3204fbd7f303d5ac19fb918839a053dcb0 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 6 Feb 2023 15:48:16 -0800 Subject: [PATCH 45/45] Update compromised_user_account.yml --- stories/compromised_user_account.yml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/stories/compromised_user_account.yml b/stories/compromised_user_account.yml index 74b5eea652..6124da49fe 100644 --- a/stories/compromised_user_account.yml +++ b/stories/compromised_user_account.yml @@ -9,7 +9,8 @@ references: - https://www.proofpoint.com/us/threat-reference/compromised-account tags: analytic_story: Compromised User Account - category: [] + category: + - Adversary Tactics product: - Splunk Enterprise - Splunk Enterprise Security