From 3cb9e1a015d377daf8ea19dbfc731d246f090be5 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 7 Mar 2023 08:45:08 +0100 Subject: [PATCH] proposal --- ...ohibited_applications_spawning_cmd_exe.yml | 3 +- ...ssa___anomalous_usage_of_archive_tools.yml | 74 +++++-------------- 2 files changed, 18 insertions(+), 59 deletions(-) diff --git a/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml b/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml index 7a59fe231a..1217af1f43 100644 --- a/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml +++ b/dev_ssa/endpoint/ssa___detect_prohibited_applications_spawning_cmd_exe.yml @@ -23,7 +23,6 @@ search: - opera.exe - firefox.exe - powershell.exe - - selection2: parent_process_name: java.exe selection3: @@ -77,7 +76,7 @@ tags: - _time - dest_device_id - dest_user_id - - process + - cmd_line kill_chain_phases: - Exploitation risk_score: 35 diff --git a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml index aab93f37c9..1ff8e651f8 100644 --- a/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml +++ b/dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml @@ -3,60 +3,19 @@ id: 63614a58-10e2-4c6c-ae81-ea1113681439 version: 1 description: The following detection identifies the usage of archive tools from the command line. -search: ' | from read_ba_enriched_events() | eval timestamp = ucast(map_get(input_event,"time"),"long", - null) | eval metadata = ucast(map_get(input_event, "metadata"),"map", - null) | eval metadata_uid = ucast(map_get(metadata, "uid"),"string", null) | eval - process=ucast(map_get(input_event,"process"), "map", null) | eval process_pid=ucast(map_get(process,"pid"), - "string", null) | eval process_file=ucast(map_get(process,"file"), "map", null) | eval process_file_name=ucast(map_get(process_file,"name"), "string", - null) | eval process_cmd_line=ucast(map_get(process,"cmd_line"), "string", null) - | eval process_user=ucast(map_get(process,"user"), "map", null) | eval - process_user_name=ucast(map_get(process_user,"name"), "string", null) | eval actor=ucast(map_get(input_event,"actor"), - "map", null) | eval actor_process=ucast(map_get(actor,"process"), "map", null) | eval actor_process_pid=ucast(map_get(actor_process,"pid"), "string", - null) | eval actor_process_file=ucast(map_get(actor_process,"file"), "map", null) | eval actor_process_file_name=ucast(map_get(actor_process_file,"name"), - "string", null) | eval device=ucast(map_get(input_event,"device"), "map", null) | eval device_hostname=ucast(map_get(device,"hostname"), "string", - null) | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") +search: ' | from read_ba_enriched_events() + | where (process_file_name="WinRAR.exe" OR like(process_file_name, "7z%") OR like(process_file_name, "winzip%")) AND (like(actor_process_file_name, "%powershell.exe") OR like(actor_process_file_name, "%cmd.exe")) | eval body=create_map( - "activity_id", 1, - "analytic_stories", ["Cobalt Strike", "NOBELIUM Group", "Insider Threat"], - "cis_csc", [create_map("control", "CIS 10", "version", 7)], - "category_uid", 2, - "class_name", "Detection Report", - "class_uid", 102001, - "confidence", 60, - "confidence_id", 2, "devices", [ create_map( "hostname", device_hostname, "type_id", 0, "uuid", ucast(map_get(device,"uuid"), "string", null) ) ], - "duration", 0, - "time", timestamp, - "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name), - "impact", 70, - "impact_id", 4, - "kill_chain", [create_map("phase", "Exploitation", "phase_id", 4)], - "attacks", [create_map("tactics", [create_map("name", "Collection", "uid", "TA0009")], "technique", create_map("name", "Archive via Utility", "uid", "T1560.001"), "version", "12.1"), create_map("tactics", [create_map("name", "Collection", "uid", "TA0009")], "technique", create_map("name", "Archive Collected Data", "uid", "T1560"), "version", "12.1")], + "evidence", create_map("process.user.name", process_user_name, "device.hostname", device_hostname, "process.file.name", process_file_name, "process.cmd_line", process_cmd_line, "actor.process.file.name", actor_process_file_name), "message", concat("Anomalous usage of Archive Tools has been triggered on ", device_hostname, " by ", process_user_name, "."), - "metadata", create_map( - "product", create_map( - "name", "Behavioral Analytic Service", - "vendor_name", "Splunk" - ), - "version", "1.0.0" - ), - "nist", ["DE.AE"], "observables", [create_map("name", "process.user.name", "type_id", 4, "value", process_user_name), create_map("name", "device.hostname", "type_id", 1, "value", device_hostname), create_map("name", "process.file.name", "type_id", 7, "value", process_file_name), create_map("name", "process.cmd_line", "type_id", 99, "value", process_cmd_line), create_map("name", "actor.process.file.name", "type_id", 7, "value", actor_process_file_name)], - "risk_level", "Medium", - "risk_level_id", 2, - "risk_score", 42, - "severity_id", 4, - "type_uid", 10200101, "users", [ create_map( "name", process_user_name, "uuid", ucast(map_get(device,"uuid"), "string", null) @@ -72,19 +31,20 @@ known_false_positives: False positives can be ligitmate usage of archive tools f references: - https://attack.mitre.org/techniques/T1560/001/ tags: - analytic_story: - - Cobalt Strike - - NOBELIUM Group - - Insider Threat - cis20: - - CIS 10 - kill_chain_phases: - - Exploitation - mitre_attack_id: - - T1560.001 - - T1560 - nist: - - DE.AE + annotations: + analytic_story: + - Cobalt Strike + - NOBELIUM Group + - Insider Threat + cis20: + - CIS 10 + kill_chain_phases: + - Exploitation + mitre_attack_id: + - T1560.001 + - T1560 + nist: + - DE.AE required_fields: - process.user.name - device.hostname