From 3ce8c88dedbaf89ddd44df7c3bfa2177048586ce Mon Sep 17 00:00:00 2001 From: mvelazco Date: Tue, 21 Sep 2021 11:08:13 -0400 Subject: [PATCH] minor metdata fixes --- .../endpoint/adsisearcher_account_discovery.yml | 16 ++++++++-------- .../domain_account_discovery_with_dsquery.yml | 15 ++++++++------- .../domain_account_discovery_with_net_app.yml | 11 +++++------ .../domain_account_discovery_with_wmic.yml | 13 ++++++------- ...aultdomainpasswordpolicy_with_powershell.yml | 13 +++++++------ ...swordpolicy_with_powershell_script_block.yml | 15 ++++++++------- .../endpoint/get_aduser_with_powershell.yml | 17 +++++++++-------- .../get_aduser_with_powershell_script_block.yml | 17 +++++++++-------- ...rresultantpasswordpolicy_with_powershell.yml | 15 ++++++++------- ...swordpolicy_with_powershell_script_block.yml | 15 ++++++++------- .../get_domainpolicy_with_powershell.yml | 14 ++++++++------ ...omainpolicy_with_powershell_script_block.yml | 12 +++++++----- .../endpoint/get_domainuser_with_powershell.yml | 12 +++++++----- ..._domainuser_with_powershell_script_block.yml | 15 +++++++-------- .../getwmiobject_ds_user_with_powershell.yml | 14 ++++++++------ ...ect_ds_user_with_powershell_script_block.yml | 15 +++++++-------- .../password_policy_discovery_with_net.yml | 14 ++++++-------- detections/endpoint/wmic_group_discovery.yml | 4 ++-- 18 files changed, 128 insertions(+), 119 deletions(-) diff --git a/detections/endpoint/adsisearcher_account_discovery.yml b/detections/endpoint/adsisearcher_account_discovery.yml index 6165ebe501..efc136fcfb 100644 --- a/detections/endpoint/adsisearcher_account_discovery.yml +++ b/detections/endpoint/adsisearcher_account_discovery.yml @@ -2,15 +2,14 @@ name: AdsiSearcher Account Discovery id: de7fcadc-04f3-11ec-a241-acde48001122 version: 1 date: '2021-08-24' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a powershell command adsisearcher to do user - enumeration to the active directory. This command can be a normal query of a network - admin but since the output of this is not so much structure and cannot give a concrete - or specific information that admin may look upon this is still a good TTP to alert - some malicious activities. +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the `[Adsisearcher]` type accelerator being used to query Active Directory + for domain groups. Red Teams and adversaries may leverage `[Adsisearcher]` to enumerate + domain users for situational awareness and Active Directory Discovery. search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*objectcategory=user*" Message = "*.findAll()*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -18,10 +17,11 @@ search: '`powershell` EventCode=4104 Message = "*[adsisearcher]*" Message = "*ob how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: not commonly seen as a normal command from network admin but - possible noise may exist. +known_false_positives: Administrators or power users may use this command for troubleshooting. references: +- https://attack.mitre.org/techniques/T1087/002/ - https://www.blackhillsinfosec.com/red-blue-purple/ +- https://devblogs.microsoft.com/scripting/use-the-powershell-adsisearcher-type-accelerator-to-search-active-directory/ tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml index 604d2f8583..93e003059c 100644 --- a/detections/endpoint/domain_account_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -2,14 +2,15 @@ name: Domain Account Discovery with Dsquery id: b1a8ce04-04c2-11ec-bea7-acde48001122 version: 1 date: '2021-08-24' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: - Endpoint -description: This search is to detect a suspicious process commandline of dsquery - for enumerating users. This technique is commonly in attacker and red team to recon - on users in targetted machine. This command can also be used by network administrator - but not by a normal user. +description: This analytic looks for the execution of `dsquery.exe` with command-line + arguments utilized to discover domain users. The `user` argument returns a + list of all users registered in the domain. Red Teams and adversaries alike + engage in remote system discovery for situational awareness and Active Directory + Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="dsquery.exe" AND Processes.process = "*user*" by Processes.dest Processes.user Processes.parent_process @@ -20,10 +21,10 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: network administrator may use this command but not commonly - seen used by a user. +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +- https://attack.mitre.org/techniques/T1087/002/ tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index 0c6c7fa471..16dc51fe6e 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -2,14 +2,12 @@ name: Domain Account Discovery With Net App id: 98f6a534-04c2-11ec-96b2-acde48001122 version: 1 date: '2021-08-24' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a process command line for AD discovery. This - techique is using the windows built in net.exe application to query AD users in - the targetted machine. This techique was seen in several malware as part of there - recon and can be a good pivot of analysis. +description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. + Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process = "* user*" AND Processes.process @@ -21,9 +19,10 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: network operator can execute this command +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://docs.microsoft.com/en-us/defender-for-identity/playbook-domain-dominance +- https://attack.mitre.org/techniques/T1087/002/ tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index ed670116b5..391b7206b5 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -2,14 +2,13 @@ name: Domain Account Discovery with Wmic id: 383572e0-04c5-11ec-bdcc-acde48001122 version: 1 date: '2021-08-24' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a wmic command for enumerating user in active - directory. This technique was commonly used in pentesting, red-team and also by - some attacker to map all user in the targetted host. This search may also catch - this type of query made by network admin but not common in all the user in the network. +description: This analytic looks for the execution of `wmic.exe` with command-line + arguments utilized to query for domain users. Red Teams and adversaries alike + use wmic.exe to enumerate domain users for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="wmic.exe" AND Processes.process = "*/NAMESPACE:\\\\root\\directory\\ldap*" AND Processes.process @@ -22,9 +21,9 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: network admin may execute this command for listing users. +known_false_positives: Administrators or power users may use this command for troubleshooting. references: -- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +- https://attack.mitre.org/techniques/T1087/002/ tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index 118c2b2b59..46723ebe67 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -6,11 +6,10 @@ author: Teoderick Contreras, Splunk type: Hunting datamodel: - Endpoint -description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. - This command can be used by attacker to mapped all password policy in a target host. - This command may cause some noise especially in admin user that can execute this - for policy audit. This hunting query is a good pivot to start investigating possible - lateral movement or credential dumping as post attack. +description: This analytic looks for the execution of `powershell.exe` executing the + Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain. + Red Teams and adversaries alike may use PowerShell to enumerate domain policies + for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADDefaultDomainPasswordPolicy*" @@ -22,9 +21,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: network operator may use this command +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://attack.mitre.org/techniques/T1201/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml index 9e31234d0a..93e914d910 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell_script_block.yml @@ -2,15 +2,14 @@ name: Get ADDefaultDomainPasswordPolicy with Powershell Script Block id: 1ff7ccc8-065a-11ec-91e4-acde48001122 version: 1 date: '2021-08-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: - Endpoint -description: This analytics is to detect a commandline related to Get-ADDefaultDomainPasswordPolicy. - This command can be used by attacker to mapped all password policy in a target host. - This command may cause some noise especially in admin user that can execute this - for policy audit. This hunting query is a good pivot to start investigating possible - lateral movement or credential dumping as post attack. +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-ADDefaultDomainPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. + Red Teams and adversaries alike may use PowerShell to enumerate domain policies + for situational awareness and Active Directory Discovery. search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolicy*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -18,9 +17,11 @@ search: '`powershell` EventCode=4104 Message ="*Get-ADDefaultDomainPasswordPolic how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: network operator may use this command +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://attack.mitre.org/techniques/T1201/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-addefaultdomainpasswordpolicy?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index 1c726753be..01a7cec73a 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -2,15 +2,14 @@ name: Get ADUser with PowerShell id: 0b6ee3f4-04e3-11ec-a87d-acde48001122 version: 1 date: '2021-08-24' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: - Endpoint -description: This search is to detect a suspicious commandline that commonly uses - for enumerating users in active directory. This technique can be a good indicator - to hunt further TTPs to the machine to check further anomalies. Since this is a - hunt query expect some noise from administrator or some IT within the network that - may use this command. +description: This analytic looks for the execution of `powershell.exe` with command-line + arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns + a list of all domain users. Red Teams and adversaries alike may use this commandlet + to identify remote systems for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUser*" @@ -22,9 +21,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: network admin may use this command. +known_false_positives: Administrators or power users may use this command for troubleshooting. references: -- https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm +- https://www.blackhillsinfosec.com/red-blue-purple/ +- https://attack.mitre.org/techniques/T1087/002/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/get_aduser_with_powershell_script_block.yml b/detections/endpoint/get_aduser_with_powershell_script_block.yml index d1633bc4de..eb2d7f2541 100644 --- a/detections/endpoint/get_aduser_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduser_with_powershell_script_block.yml @@ -2,15 +2,15 @@ name: Get ADUser with PowerShell Script Block id: 21432e40-04f4-11ec-b7e6-acde48001122 version: 1 date: '2021-08-24' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: - Endpoint -description: This search is to detect a powershell command get-aduser function to - do user enumeration to the active directory. This command can be a normal query - of a network admin but since the output of this is not so much structure and cannot - give a concrete or specific information that admin may look upon this is still a - good TTP to alert some malicious activities. +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-AdGUser` commandlet. The `Get-AdUser` commandlet + is used to return a list of all domain users. Red Teams and adversaries may leverage + this commandlet to enumerate domain groups for situational awareness and Active + Directory Discovery. search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filter*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -18,10 +18,11 @@ search: '`powershell` EventCode=4104 Message = "*get-aduser*" Message = "*-filte how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: network admin may use this command and other IT operator to - check AD users. +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://www.blackhillsinfosec.com/red-blue-purple/ +- https://attack.mitre.org/techniques/T1087/002/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml index 8ca8a27288..4fb1475f4b 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -2,15 +2,14 @@ name: Get ADUserResultantPasswordPolicy with Powershell id: 8b5ef342-065a-11ec-b0fc-acde48001122 version: 1 date: '2021-08-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. - This command can be used by attacker to mapped all password policy in a target host. - This command may cause some noise especially in admin user that can execute this - for policy audit. This hunting query is a good pivot to start investigating possible - lateral movement or credential dumping as post attack. +description: This analytic looks for the execution of `powershell.exe` executing the + Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. + Red Teams and adversaries alike may use PowerShell to enumerate domain policies + for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-ADUserResultantPasswordPolicy*" @@ -22,9 +21,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: network operator or admin may use this command +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://attack.mitre.org/techniques/T1201/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml index c02be78bcf..0009f8cc37 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell_script_block.yml @@ -2,15 +2,14 @@ name: Get ADUserResultantPasswordPolicy with Powershell Script Block id: 737e1eb0-065a-11ec-921a-acde48001122 version: 1 date: '2021-08-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, MAuricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This analytics is to detect a commandline related to Get-ADUserResultantPasswordPolicy. - This command can be used by attacker to mapped all password policy in a target host. - This command may cause some noise especially in admin user that can execute this - for policy audit. This hunting query is a good pivot to start investigating possible - lateral movement or credential dumping as post attack. +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-ADUserResultantPasswordPolicy` commandlet used to obtain the password policy in a Windows domain. + Red Teams and adversaries alike may use PowerShell to enumerate domain policies + for situational awareness and Active Directory Discovery. search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolicy*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` @@ -18,9 +17,11 @@ search: '`powershell` EventCode=4104 Message ="*Get-ADUserResultantPasswordPolic how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: network operator may use this command +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://attack.mitre.org/techniques/T1201/ +- https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduserresultantpasswordpolicy?view=windowsserver2019-ps tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index 8cc1b2ed34..39825ce8f1 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -2,14 +2,14 @@ name: Get DomainPolicy with Powershell id: b8f9947e-065a-11ec-aafb-acde48001122 version: 1 date: '2021-08-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a possible execution of powerview pentesting - tool for domain controller recon. This search look for function Get-DomainPolicy - to parse the domain policy of the targeted host. This TTP may be a good pivot to - look for credential dumping technique or lateral movement. +description: This analytic looks for the execution of `powershell.exe` executing the + `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. + Red Teams and adversaries alike may use PowerShell to enumerate domain policies + for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainPolicy*" @@ -21,9 +21,11 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: network operator or admin may use this command +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ +- https://attack.mitre.org/techniques/T1201/ tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml index 00a8ac5b14..5122660b6c 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -6,19 +6,21 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a possible execution of powerview pentesting - tool for domain controller recon. This search look for function Get-DomainPolicy - to parse the domain policy of the targeted host. This TTP may be a good pivot to - look for credential dumping technique or lateral movement. +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get DomainPolicy` commandlet used to obtain the password policy in a Windows domain. + Red Teams and adversaries alike may use PowerShell to enumerate domain policies + for situational awareness and Active Directory Discovery. search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: unknown +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet +- https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainPolicy/ +- https://attack.mitre.org/techniques/T1201/ tags: analytic_story: - Active Directory Discovery diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index 2f65aba380..1dd28005b7 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -2,13 +2,15 @@ name: Get DomainUser with PowerShell id: 9a5a41d6-04e7-11ec-923c-acde48001122 version: 1 date: '2021-08-24' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a cmdlet Get-DomainUser that are common on powerview - or powersploit tool. This cmdlet is used to recon on the targetted machine to enumerate - all users in active directory. +description: This analytic looks for the execution of `powershell.exe` with command-line + arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, + a PowerShell tool used to perform enumeration on Windows domains. Red Teams and + adversaries alike may leverage PowerView to enumerate domain users for situational + awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*Get-DomainUser*" @@ -20,7 +22,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: unknown +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ tags: diff --git a/detections/endpoint/get_domainuser_with_powershell_script_block.yml b/detections/endpoint/get_domainuser_with_powershell_script_block.yml index 3f33a2c9ca..925aec9dca 100644 --- a/detections/endpoint/get_domainuser_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainuser_with_powershell_script_block.yml @@ -2,23 +2,22 @@ name: Get DomainUser with PowerShell Script Block id: 61994268-04f4-11ec-865c-acde48001122 version: 1 date: '2021-08-24' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: his search is to detect a powershell command Get-DomainUser to do user - enumeration to the active directory. This command is function seen in powerspoit - and powerview tool that are designed to pentest active directory or domain controller - for possible attack. This is a good TTP for alerting SOC if there is a pentest or - recon happening on the system. try to look for lateral movement technique or credential - dumping techniques in the system. +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-DomainUser` commandlet. `GetDomainUser` + is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. + Red Teams and adversaries alike may use PowerView to enumerate domain users + for situational awareness and Active Directory Discovery. search: '`powershell` EventCode=4104 Message = "*Get-DomainUser*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainuser_with_powershell_script_block_filter`' how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: unknown +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://powersploit.readthedocs.io/en/latest/Recon/Get-DomainUser/ tags: diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index 1618a5b92c..9ba8d47259 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -2,14 +2,16 @@ name: GetWmiObject DS User with PowerShell id: 22d3b118-04df-11ec-8fa3-acde48001122 version: 1 date: '2021-08-24' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a suspicious execution wmi process that enumerate - user in active directory. This technique can be used by attacker and pentester to - mapped all the users as part of its recon to the targetted host. Network Admin may - seen executing this command but not often and also not common to see in user events. +description: This analytic looks for the execution of `powershell.exe` with command-line + arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined + with the `-class ds_user` parameter can be used to return the full list of users + in a Windows domain. Red Teams and adversaries alike may leverage WMI in this case, + using PowerShell, to enumerate domain users for situational awareness and Active + Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="cmd.exe" OR Processes.process_name="powershell*") AND Processes.process = "*get-wmiobject*" @@ -22,7 +24,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives: network admin may execute this command. +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://jpcertcc.github.io/ToolAnalysisResultSheet/details/dsquery.htm tags: diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml index e3e639f57b..39ee2767ac 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell_script_block.yml @@ -2,15 +2,15 @@ name: GetWmiObject DS User with PowerShell Script Block id: fabd364e-04f3-11ec-b34b-acde48001122 version: 1 date: '2021-08-24' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a powershell command get-wmiobject function - to do user enumeration to the active directory. This command can be a normal query - of a network admin but since the output of this is not so much structure and cannot - give a concrete or specific information that admin may look upon this is still a - good TTP to alert some malicious activities. +description: The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) + to identify the execution of the `Get-WmiObject` commandlet. The `DS_User` class + parameter leverages WMI to query for all domain users. Red Teams and adversaries + may leverage this commandlet to enumerate domain users for situational awareness + and Active Directory Discovery. search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_user*" Message = "*-namespace*" Message = "*root\\directory\\ldap*" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` @@ -18,8 +18,7 @@ search: '`powershell` EventCode=4104 Message = "*get-wmiobject*" Message = "*ds_ how_to_implement: he following Hunting analytic requires PowerShell operational logs to be imported. Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, or PowerShell Script Block Logging. -known_false_positives: not commonly seen as a normal command from network admin but - possible noise may exist. +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://www.blackhillsinfosec.com/red-blue-purple/ - https://docs.microsoft.com/en-us/windows/win32/wmisdk/describing-the-ldap-namespace diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml index 6c953aa6d9..46365d9b38 100644 --- a/detections/endpoint/password_policy_discovery_with_net.yml +++ b/detections/endpoint/password_policy_discovery_with_net.yml @@ -1,16 +1,14 @@ -name: Password Policy Discovery with Net +name: id: 09336538-065a-11ec-8665-acde48001122 version: 1 date: '2021-08-26' -author: Teoderick Contreras, Splunk +author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: - Endpoint -description: This search is to detect a net application command to discover password - policy. This commandline can be used by IT and admin to list all account domain - policy but also can be use by attacker as part of recon. this hunting query can - be a good pivot to locate credential dumping or lateral movement as part of post - attack. +description: This analytic looks for the execution of `net.exe` or `net1.exe` + with command line arguments used to obtain the domain password policy. + Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory Discovery. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name="net.exe" OR Processes.process_name="net1.exe") AND Processes.process = "*accounts*" AND Processes.process @@ -22,7 +20,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used. -known_false_positives: network operator or admin may use this command +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet tags: diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index c171df7aca..ed7a0d3b88 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: Hunting datamodel: - Endpoint -description: 'The follow hunting analytic identifies the use of `wmic.exe` enumerating +description: 'The following hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of @@ -24,7 +24,7 @@ how_to_implement: To successfully implement this search you need to be ingesting your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. -known_false_positives: False positives may be present. Tune as needed. +known_false_positives: Administrators or power users may use this command for troubleshooting. references: - https://attack.mitre.org/techniques/T1069/001/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1069.001/T1069.001.md