From 6e4a5bfdf548675703c1f0ba7814bdd1105127d2 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 8 Dec 2021 12:20:10 -0600 Subject: [PATCH 1/9] Create ssa___anomalous_usage_of_account_credentials.yml --- ...anomalous_usage_of_account_credentials.yml | 46 +++++++++++++++++++ 1 file changed, 46 insertions(+) create mode 100644 detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml diff --git a/detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml new file mode 100644 index 0000000000..191279fe48 --- /dev/null +++ b/detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml @@ -0,0 +1,46 @@ +name: Anomalous Usage of Account Credentials +id: 629cbf9e-5785-11ec-9611-acde48001122 +version: 1 +date: '2021-12-07' +author: Lou Stella, Splunk +type: Anomaly +datamodel: +- Authentication +description: This is an anomaly generating detection looking for multiple interactive logins within a specific time period. +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "integer", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "src_user/WINDOWS_ACCOUNT_NAME"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type=2 OR auth_type=11 | where reason = "success"| stats estdc(src_user) AS user_counter by device, span(timestamp, 1200s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' +how_to_implement: To successfully implement this detection, you need to be ingesting logon events from workstations. +known_false_positives: Shared workstations can cause false positives +references: +- https://attack.mitre.org/techniques/T1078/002/ +tags: + analytic_story: + - Insider Threat + kill_chain_phases: + - Privilege Escalation + - Lateral Movement + mitre_attack_id: + - T1078.002 + cis20: + - CIS 14 + nist: + - PR.AC + - DE.AE + product: + - Splunk Behavioral Analytics + required_fields: + - _time + security_domain: access + impact: 20 + confidence: 30 + risk_score: 6 + context: + - Source:Endpoint + - Stage:Credential Access + message: Multiple interactive logins detected on $device$ + risk_severity: low + observable: + - name: device + type: Hostname + role: + - Victim + From da2c9b74c3feb1c072e944bb8dca31cc35db62c7 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 8 Dec 2021 12:22:47 -0600 Subject: [PATCH 2/9] Update ssa___anomalous_usage_of_account_credentials.yml --- .../endpoint/ssa___anomalous_usage_of_account_credentials.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml index 191279fe48..85e7169ce4 100644 --- a/detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml +++ b/detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml @@ -6,7 +6,7 @@ author: Lou Stella, Splunk type: Anomaly datamodel: - Authentication -description: This is an anomaly generating detection looking for multiple interactive logins within a specific time period. +description: This is an anomaly generating detection looking for multiple interactive logins within a specific time period. An insider threat may attempt to steal colleagues credentials in low tech, undetectable methods, in order to gain access to additional information or to hide their own behavior. This should capture their attempted use of those credentials on a workstation. search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "integer", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "src_user/WINDOWS_ACCOUNT_NAME"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type=2 OR auth_type=11 | where reason = "success"| stats estdc(src_user) AS user_counter by device, span(timestamp, 1200s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this detection, you need to be ingesting logon events from workstations. known_false_positives: Shared workstations can cause false positives From 988f5d157a2049ea9816356af1f2513782eb745c Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Thu, 6 Jan 2022 16:08:08 -0600 Subject: [PATCH 3/9] Created test dataset & moved detection out of experimental --- .../ssa___anomalous_usage_of_account_credentials.yml | 4 +++- .../ssa___anomalous_usage_of_account_credentials.yml | 10 ++++++++++ 2 files changed, 13 insertions(+), 1 deletion(-) rename detections/{experimental => }/endpoint/ssa___anomalous_usage_of_account_credentials.yml (75%) create mode 100644 tests/endpoint/ssa___anomalous_usage_of_account_credentials.yml diff --git a/detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml similarity index 75% rename from detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml rename to detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml index 85e7169ce4..5b33b1093d 100644 --- a/detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml +++ b/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Authentication description: This is an anomaly generating detection looking for multiple interactive logins within a specific time period. An insider threat may attempt to steal colleagues credentials in low tech, undetectable methods, in order to gain access to additional information or to hide their own behavior. This should capture their attempted use of those credentials on a workstation. -search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "integer", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "src_user/WINDOWS_ACCOUNT_NAME"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type=2 OR auth_type=11 | where reason = "success"| stats estdc(src_user) AS user_counter by device, span(timestamp, 1200s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "integer", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "src_user/WINDOWS_ACCOUNT_NAME"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type=2 OR auth_type=11 | where reason = "success" | where src_user NOT in("DWM-*", "SYSTEM", "ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 1200s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this detection, you need to be ingesting logon events from workstations. known_false_positives: Shared workstations can cause false positives references: @@ -27,6 +27,8 @@ tags: - DE.AE product: - Splunk Behavioral Analytics + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log required_fields: - _time security_domain: access diff --git a/tests/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/tests/endpoint/ssa___anomalous_usage_of_account_credentials.yml new file mode 100644 index 0000000000..b1c41573f8 --- /dev/null +++ b/tests/endpoint/ssa___anomalous_usage_of_account_credentials.yml @@ -0,0 +1,10 @@ +name: Anomalous Usage of Account Credentials Unit Test +tests: + - name: Anomalous Usage of Account Credentials + file: endpoint/ssa___anomalous_usage_of_account_credentials.yml + pass_condition: '@count_gt(0)' + description: Test for Anomalous usage of Account Credentials + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078.002/account_login/windows-security.log + source: WinEventLog:Security From b1a285b483e856b486522a57c55c0f8711ba096f Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 11 Jan 2022 11:34:26 -0600 Subject: [PATCH 4/9] Renamed test --- ....yml => ssa___anomalous_usage_of_account_credentials.test.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename tests/endpoint/{ssa___anomalous_usage_of_account_credentials.yml => ssa___anomalous_usage_of_account_credentials.test.yml} (100%) diff --git a/tests/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/tests/endpoint/ssa___anomalous_usage_of_account_credentials.test.yml similarity index 100% rename from tests/endpoint/ssa___anomalous_usage_of_account_credentials.yml rename to tests/endpoint/ssa___anomalous_usage_of_account_credentials.test.yml From 0535389f2348b42145e0c00e3e44fb05ecc9775b Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 11 Jan 2022 12:44:08 -0600 Subject: [PATCH 5/9] Tweaked detection --- .../endpoint/ssa___anomalous_usage_of_account_credentials.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml index 5b33b1093d..f579c02a7f 100644 --- a/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml +++ b/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Authentication description: This is an anomaly generating detection looking for multiple interactive logins within a specific time period. An insider threat may attempt to steal colleagues credentials in low tech, undetectable methods, in order to gain access to additional information or to hide their own behavior. This should capture their attempted use of those credentials on a workstation. -search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "integer", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "src_user/WINDOWS_ACCOUNT_NAME"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type=2 OR auth_type=11 | where reason = "success" | where src_user NOT in("DWM-*", "SYSTEM", "ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 1200s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "src_user/WINDOWS_ACCOUNT_NAME"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type=2 OR auth_type=11 | where reason = "success" | where src_user NOT in("DWM-*", "SYSTEM", "ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 1200s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this detection, you need to be ingesting logon events from workstations. known_false_positives: Shared workstations can cause false positives references: From e7f1eff711893d735e366a899916ddb34427742c Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 11 Jan 2022 13:16:19 -0600 Subject: [PATCH 6/9] fixing field names --- .../endpoint/ssa___anomalous_usage_of_account_credentials.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml index f579c02a7f..ff041c1a3b 100644 --- a/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml +++ b/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Authentication description: This is an anomaly generating detection looking for multiple interactive logins within a specific time period. An insider threat may attempt to steal colleagues credentials in low tech, undetectable methods, in order to gain access to additional information or to hide their own behavior. This should capture their attempted use of those credentials on a workstation. -search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "src_user/WINDOWS_ACCOUNT_NAME"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type=2 OR auth_type=11 | where reason = "success" | where src_user NOT in("DWM-*", "SYSTEM", "ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 1200s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "endpoint_user_windows_account_names"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type="2" OR auth_type="11" | where reason = "success" | where src_user NOT in("DWM-*", "SYSTEM", "ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 1200s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this detection, you need to be ingesting logon events from workstations. known_false_positives: Shared workstations can cause false positives references: From 14461f46ffed04aaf995046d40ae91f36f1eb557 Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Tue, 11 Jan 2022 16:44:49 -0600 Subject: [PATCH 7/9] modifying window --- .../endpoint/ssa___anomalous_usage_of_account_credentials.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml index ff041c1a3b..beb82bc48b 100644 --- a/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml +++ b/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml @@ -7,7 +7,7 @@ type: Anomaly datamodel: - Authentication description: This is an anomaly generating detection looking for multiple interactive logins within a specific time period. An insider threat may attempt to steal colleagues credentials in low tech, undetectable methods, in order to gain access to additional information or to hide their own behavior. This should capture their attempted use of those credentials on a workstation. -search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "endpoint_user_windows_account_names"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type="2" OR auth_type="11" | where reason = "success" | where src_user NOT in("DWM-*", "SYSTEM", "ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 1200s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "integer", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type=2 OR auth_type=11 | where reason = "success" | where src_user NOT in("DWM-*", "SYSTEM", "ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 300s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this detection, you need to be ingesting logon events from workstations. known_false_positives: Shared workstations can cause false positives references: From 167574e8926a3db3fdcf83514d9640aed785c58d Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Wed, 19 Jan 2022 17:35:10 -0600 Subject: [PATCH 8/9] tweaked search --- .../endpoint/ssa___anomalous_usage_of_account_credentials.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml index beb82bc48b..8c74a30736 100644 --- a/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml +++ b/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml @@ -5,9 +5,9 @@ date: '2021-12-07' author: Lou Stella, Splunk type: Anomaly datamodel: -- Authentication +- Endpoint_Processes description: This is an anomaly generating detection looking for multiple interactive logins within a specific time period. An insider threat may attempt to steal colleagues credentials in low tech, undetectable methods, in order to gain access to additional information or to hide their own behavior. This should capture their attempted use of those credentials on a workstation. -search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "integer", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string", null), reason=ucast(map_get(input_event, "reason"), "string", null) | where auth_type=2 OR auth_type=11 | where reason = "success" | where src_user NOT in("DWM-*", "SYSTEM", "ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 300s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' +search: '| from read_ssa_enriched_events() | eval device=ucast(map_get(input_event, "dest_device_id"), "string", null), auth_type=ucast(map_get(input_event, "authentication_type"), "string", null), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), src_user=ucast(map_get(input_event, "dest_user_original_artifact"), "string", null), signature_id=ucast(map_get(input_event, "EventCode"), "string", null) | where signature_id="4624" | where auth_type="2" OR auth_type="11" | where NOT (src_user="SYSTEM") AND NOT (src_user="ANONYMOUS LOGON") | stats estdc(src_user) AS user_counter by device, span(timestamp, 600s, 300s) | where user_counter>=2 | rename window_end AS timestamp | eval start_time=window_start, end_time=timestamp, entities=mvappend(device), body=create_map(["user_counter", user_counter, "device", device]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this detection, you need to be ingesting logon events from workstations. known_false_positives: Shared workstations can cause false positives references: From 3ad47776fb219bb65329ee6a86921ac629fd3edb Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Fri, 21 Jan 2022 14:16:51 -0600 Subject: [PATCH 9/9] Moving to experimental --- .../endpoint/ssa___anomalous_usage_of_account_credentials.yml | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename detections/{ => experimental}/endpoint/ssa___anomalous_usage_of_account_credentials.yml (100%) diff --git a/detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml b/detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml similarity index 100% rename from detections/endpoint/ssa___anomalous_usage_of_account_credentials.yml rename to detections/experimental/endpoint/ssa___anomalous_usage_of_account_credentials.yml