mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge branch 'develop' into dependabot/pip/pyparsing-2.4.7
This commit is contained in:
P4T12ICK
@@ -262,8 +262,10 @@ jobs:
|
||||
- run:
|
||||
name: checkout repo
|
||||
command: |
|
||||
mkdir ~/latest
|
||||
tar -zxf ~/DA-ESS-ContentUpdate-latest.tar.gz -C ~/latest --strip-components=1
|
||||
mkdir ~/latest-escu
|
||||
tar -zxf ~/DA-ESS-ContentUpdate-latest.tar.gz -C ~/latest-escu --strip-components=1
|
||||
mkdir ~/latest-saaws
|
||||
tar -zxf ~/DA-ESS_AmazonWebServices_Content-latest.tar.gz -C ~/latest-saaws --strip-components=1
|
||||
if [ "${CIRCLE_BRANCH}" == "" ]; then
|
||||
git clone https://${GITHUB_TOKEN}@github.com/splunk/security-content.git
|
||||
else
|
||||
@@ -310,14 +312,16 @@ jobs:
|
||||
name: update github with new docs and package bits
|
||||
command: |
|
||||
cd security-content
|
||||
rm -rf package
|
||||
mv ~/latest package
|
||||
rm -rf dist
|
||||
mkdir dist
|
||||
mv ~/latest-escu dist/escu
|
||||
mv ~/latest-saaws dist/saaws
|
||||
# configure git to prep for commit
|
||||
git config credential.helper 'cache --timeout=120'
|
||||
git config user.email "research@splunk.com"
|
||||
git config user.name "research bot"
|
||||
git config --global push.default simple
|
||||
git add package/*
|
||||
git add dist/*
|
||||
git add docs/*
|
||||
git add detections/*
|
||||
git commit --allow-empty -m "updating docs and package bits [ci skip]"
|
||||
|
||||
@@ -114,3 +114,4 @@ venv.bak/
|
||||
package/bin/sftp-config.json
|
||||
package/default/sftp-config.json
|
||||
*.code-snippets
|
||||
notes
|
||||
|
||||
@@ -8,24 +8,10 @@ variables:
|
||||
SRCBRANCH: $CI_COMMIT_REF_NAME
|
||||
|
||||
stages:
|
||||
- ssa-validate
|
||||
- publish_smoketest_runner
|
||||
- publish_deployer
|
||||
- smoketest_staging
|
||||
|
||||
validate:
|
||||
stage: ssa-validate
|
||||
image: docker.repo.splunkdev.net/ci-cd/ci-container:alpine-3.11
|
||||
before_script:
|
||||
- apk add --update python3 python3-dev py-pip build-base openjdk8-jre zlib-dev jpeg-dev && pip install virtualenv && rm -rf /var/cache/apk/*
|
||||
- python3 -m pip install -U --force-reinstall pip && pip3 install -r requirements.txt
|
||||
script:
|
||||
- python3 bin/ssa_validate.py --skip-error detections/*/*
|
||||
- python3 bin/ssa_test.py --skip-error tests/*/*
|
||||
- python3 bin/testing_coverage.py --type streaming --min-coverage 1.0
|
||||
only:
|
||||
- /^ssa.*$/
|
||||
- develop
|
||||
|
||||
publish_deployer:
|
||||
stage: publish_deployer
|
||||
|
||||
@@ -13,7 +13,7 @@ azure-mgmt-core==1.2.1
|
||||
azure-mgmt-network==16.0.0
|
||||
azure-mgmt-resource==15.0.0
|
||||
bcrypt==3.2.0
|
||||
boto3==1.17.30
|
||||
boto3==1.17.42
|
||||
botocore==1.20.30
|
||||
certifi==2020.12.5
|
||||
cffi==1.14.5
|
||||
|
||||
+301
-364
@@ -67,7 +67,6 @@ def generate_collections_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
|
||||
return output_path
|
||||
|
||||
|
||||
def generate_savedsearches_conf(detections, response_tasks, baselines, deployments, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
'''
|
||||
@param detections: input list of individual YAML detections in detections/ directory
|
||||
@@ -77,6 +76,229 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
|
||||
@return: the savedsearches.conf file located in package/default/
|
||||
'''
|
||||
|
||||
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
|
||||
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
j2_env.filters['custom_jinja2_enrichment_filter'] = custom_jinja2_enrichment_filter
|
||||
template = j2_env.get_template('savedsearches.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/savedsearches.conf')
|
||||
output = template.render(detections=detections, baselines=baselines, response_tasks=response_tasks, time=utc_time)
|
||||
with open(output_path, 'w') as f:
|
||||
output = output.encode('ascii', 'ignore').decode('ascii')
|
||||
f.write(output)
|
||||
|
||||
return output_path
|
||||
|
||||
def generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
|
||||
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('analytic_stories.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/analytic_stories.conf')
|
||||
output = template.render(stories=stories, time=utc_time)
|
||||
with open(output_path, 'w', encoding="utf-8") as f:
|
||||
f.write(output)
|
||||
|
||||
return output_path
|
||||
|
||||
def generate_use_case_library_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
|
||||
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('use_case_library.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/use_case_library.conf')
|
||||
output = template.render(stories=stories, detections=detections,
|
||||
response_tasks=response_tasks,
|
||||
baselines=baselines, time=utc_time)
|
||||
with open(output_path, 'w', encoding="utf-8") as f:
|
||||
f.write(output)
|
||||
|
||||
return output_path
|
||||
|
||||
def generate_macros_conf(macros, detections, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
filter_macros = []
|
||||
for detection in detections:
|
||||
new_dict = {}
|
||||
new_dict['definition'] = 'search *'
|
||||
new_dict['description'] = 'Update this macro to limit the output results to filter out false positives. '
|
||||
new_dict['name'] = detection['name']. \
|
||||
replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter'
|
||||
filter_macros.append(new_dict)
|
||||
|
||||
all_macros = macros + filter_macros
|
||||
|
||||
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
|
||||
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('macros.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/macros.conf')
|
||||
output = template.render(macros=all_macros, time=utc_time)
|
||||
with open(output_path, 'w', encoding="utf-8") as f:
|
||||
f.write(output)
|
||||
|
||||
return output_path
|
||||
|
||||
def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
workbench_panel_objects = []
|
||||
for response_task in response_tasks:
|
||||
if 'search' in response_task:
|
||||
if 'inputs' in response_task:
|
||||
response_file_name = response_task['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
|
||||
response_file_name_xml = response_file_name + "___response_task.xml"
|
||||
response_task['lowercase_name'] = response_file_name
|
||||
workbench_panel_objects.append(response_task)
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('panel.j2')
|
||||
file_path = "default/data/ui/panels/workbench_panel_" + response_file_name_xml
|
||||
output_path = path.join(OUTPUT_PATH, file_path)
|
||||
response_task['search']= response_task['search'].replace(">",">")
|
||||
response_task['search']= response_task['search'].replace("<","<")
|
||||
|
||||
output = template.render(search=response_task['search'])
|
||||
with open(output_path, 'w') as f:
|
||||
f.write(output)
|
||||
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('es_investigations.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/es_investigations.conf')
|
||||
output = template.render(response_tasks=workbench_panel_objects, stories=stories)
|
||||
with open(output_path, 'w', encoding="utf-8") as f:
|
||||
f.write(output)
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('workflow_actions.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/workflow_actions.conf')
|
||||
output = template.render(response_tasks=workbench_panel_objects)
|
||||
with open(output_path, 'w', encoding="utf-8") as f:
|
||||
f.write(output)
|
||||
|
||||
return workbench_panel_objects
|
||||
|
||||
|
||||
def parse_data_models_from_search(search):
|
||||
match = re.search(r'from\sdatamodel\s?=\s?([^\s.]*)', search)
|
||||
if match is not None:
|
||||
return match.group(1)
|
||||
return False
|
||||
|
||||
def parse_author_company(story):
|
||||
match_author = re.search(r'^([^,]+)', story['author'])
|
||||
if match_author is None:
|
||||
match_author = 'no'
|
||||
else:
|
||||
match_author = match_author.group(1)
|
||||
|
||||
match_company = re.search(r',\s?(.*)$', story['author'])
|
||||
if match_company is None:
|
||||
match_company = 'no'
|
||||
else:
|
||||
match_company = match_company.group(1)
|
||||
|
||||
return match_author, match_company
|
||||
|
||||
|
||||
def get_deployments(object, deployments):
|
||||
matched_deployments = []
|
||||
|
||||
for deployment in deployments:
|
||||
|
||||
for tag in object['tags'].keys():
|
||||
if tag in deployment['tags'].keys():
|
||||
if type(object['tags'][tag]) is str:
|
||||
tag_array = [object['tags'][tag]]
|
||||
else:
|
||||
tag_array = object['tags'][tag]
|
||||
|
||||
for tag_value in tag_array:
|
||||
if type(deployment['tags'][tag]) is str:
|
||||
tag_array_deployment = [deployment['tags'][tag]]
|
||||
else:
|
||||
tag_array_deployment = deployment['tags'][tag]
|
||||
|
||||
for tag_value_deployment in tag_array_deployment:
|
||||
if tag_value == tag_value_deployment:
|
||||
# print("tag value: {}, matched deployment tag: {} on deployment: {}".format(tag_value,tag_value_deployment, deployment))
|
||||
matched_deployments.append(deployment)
|
||||
continue
|
||||
|
||||
# grab default for all stories if deployment not set
|
||||
if len(matched_deployments) == 0:
|
||||
for deployment in deployments:
|
||||
if 'analytic_story' in deployment['tags']:
|
||||
if deployment['tags']['analytic_story'] == 'all':
|
||||
last_deployment = deployment
|
||||
else:
|
||||
last_deployment = matched_deployments[-1]
|
||||
# last_deployment = replace_vars_in_deployment(last_deployment, object) # Not needed because of custom_jinja2_enrichment_filter
|
||||
|
||||
# print(last_deployment)
|
||||
return last_deployment
|
||||
|
||||
def get_nes_fields(search, deployment):
|
||||
nes_fields_matches = []
|
||||
if 'alert_action' in deployment:
|
||||
if 'notable' in deployment['alert_action']:
|
||||
if 'nes_fields' in deployment['alert_action']['notable']:
|
||||
for field in deployment['alert_action']['notable']['nes_fields']:
|
||||
if (search.find(field + ' ') != -1):
|
||||
nes_fields_matches.append(field)
|
||||
|
||||
return nes_fields_matches
|
||||
|
||||
|
||||
def map_response_tasks_to_stories(response_tasks):
|
||||
sto_res = {}
|
||||
for response_task in response_tasks:
|
||||
if 'tags' in response_task:
|
||||
if 'analytic_story' in response_task['tags']:
|
||||
for story in response_task['tags']['analytic_story']:
|
||||
if 'type' in response_task.keys():
|
||||
if response_task['type'] == 'response':
|
||||
task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
|
||||
else:
|
||||
task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
|
||||
if not (story in sto_res):
|
||||
sto_res[story] = {task_name}
|
||||
else:
|
||||
sto_res[story].add(task_name)
|
||||
return sto_res
|
||||
|
||||
def map_baselines_to_stories(baselines):
|
||||
sto_bas = {}
|
||||
for baseline in baselines:
|
||||
if 'tags' in baseline:
|
||||
if 'analytic_story' in baseline['tags']:
|
||||
for story in baseline['tags']['analytic_story']:
|
||||
if 'type' in baseline.keys():
|
||||
if baseline['type'] == 'batch':
|
||||
baseline_name = str('ESCU - ' + baseline['name'])
|
||||
else:
|
||||
baseline_name = str('ESCU - ' + baseline['name'])
|
||||
if not (story in sto_bas):
|
||||
sto_bas[story] = {baseline_name}
|
||||
else:
|
||||
sto_bas[story].add(baseline_name)
|
||||
return sto_bas
|
||||
|
||||
def custom_jinja2_enrichment_filter(string, object):
|
||||
customized_string = string
|
||||
for key in object.keys():
|
||||
[key.encode('utf-8') for key in object]
|
||||
customized_string = customized_string.replace("%" + key + "%", str(object[key]))
|
||||
|
||||
for key in object['tags'].keys():
|
||||
customized_string = customized_string.replace("%" + key + "%", str(object['tags'][key]))
|
||||
|
||||
return customized_string
|
||||
|
||||
|
||||
def prepare_detections(detections, deployments, OUTPUT_PATH):
|
||||
for detection in detections:
|
||||
# parse out data_models
|
||||
data_model = parse_data_models_from_search(detection['search'])
|
||||
@@ -127,8 +349,9 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
|
||||
if (OUTPUT_PATH) == 'dist/saaws':
|
||||
detection['disabled'] = 'false'
|
||||
|
||||
return detections
|
||||
|
||||
|
||||
def prepare_baselines(baselines, deployments, OUTPUT_PATH):
|
||||
for baseline in baselines:
|
||||
data_model = parse_data_models_from_search(baseline['search'])
|
||||
if data_model:
|
||||
@@ -139,332 +362,18 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen
|
||||
matched_deployment = get_deployments(baseline, deployments)
|
||||
baseline['deployment'] = matched_deployment
|
||||
|
||||
return baselines
|
||||
|
||||
def prepare_response_tasks(response_tasks):
|
||||
for response_task in response_tasks:
|
||||
if 'search' in response_task:
|
||||
data_model = parse_data_models_from_search(response_task['search'])
|
||||
if data_model:
|
||||
response_task['data_model'] = data_model
|
||||
|
||||
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
|
||||
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
j2_env.filters['custom_jinja2_enrichment_filter'] = custom_jinja2_enrichment_filter
|
||||
template = j2_env.get_template('savedsearches.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/savedsearches.conf')
|
||||
output = template.render(detections=detections, baselines=baselines, response_tasks=response_tasks, time=utc_time)
|
||||
with open(output_path, 'w') as f:
|
||||
output = output.encode('ascii', 'ignore').decode('ascii')
|
||||
f.write(output)
|
||||
|
||||
return output_path
|
||||
|
||||
|
||||
def generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
|
||||
sto_det = map_detection_to_stories(detections)
|
||||
|
||||
sto_res = map_response_tasks_to_stories(response_tasks)
|
||||
|
||||
sto_bas = map_baselines_to_stories(baselines)
|
||||
|
||||
for story in stories:
|
||||
if story['name'] in sto_det:
|
||||
story['detections'] = list(sto_det[story['name']])
|
||||
if story['name'] in sto_res:
|
||||
story['response_tasks'] = list(sto_res[story['name']])
|
||||
if story['name'] in sto_bas:
|
||||
story['baselines'] = list(sto_bas[story['name']])
|
||||
|
||||
stories = prepare_stories(stories, detections)
|
||||
|
||||
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
|
||||
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('analytic_stories.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/analytic_stories.conf')
|
||||
output = template.render(stories=stories, time=utc_time)
|
||||
with open(output_path, 'w', encoding="utf-8") as f:
|
||||
f.write(output)
|
||||
|
||||
return output_path
|
||||
|
||||
|
||||
def generate_use_case_library_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
|
||||
sto_det = map_detection_to_stories(detections)
|
||||
|
||||
sto_res = map_response_tasks_to_stories(response_tasks)
|
||||
|
||||
for story in stories:
|
||||
story['author_name'], story['author_company'] = parse_author_company(story)
|
||||
if story['name'] in sto_det:
|
||||
story['detections'] = list(sto_det[story['name']])
|
||||
|
||||
if story['name'] in sto_res:
|
||||
|
||||
story['response_tasks'] = list(sto_res[story['name']])
|
||||
story['searches'] = story['detections'] + story['response_tasks']
|
||||
else:
|
||||
story['searches'] = story['detections']
|
||||
|
||||
for detection in detections:
|
||||
|
||||
keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
|
||||
mappings = {}
|
||||
for key in keys:
|
||||
if key == 'mitre_attack':
|
||||
if 'mitre_attack_id' in detection['tags']:
|
||||
mappings[key] = detection['tags']['mitre_attack_id']
|
||||
else:
|
||||
if key in detection['tags']:
|
||||
mappings[key] = detection['tags'][key]
|
||||
detection['mappings'] = mappings
|
||||
|
||||
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
|
||||
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('use_case_library.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/use_case_library.conf')
|
||||
output = template.render(stories=stories, detections=detections,
|
||||
response_tasks=response_tasks,
|
||||
baselines=baselines, time=utc_time)
|
||||
with open(output_path, 'w', encoding="utf-8") as f:
|
||||
f.write(output)
|
||||
|
||||
return output_path
|
||||
|
||||
|
||||
def generate_macros_conf(macros, detections, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
filter_macros = []
|
||||
for detection in detections:
|
||||
new_dict = {}
|
||||
new_dict['definition'] = 'search *'
|
||||
new_dict['description'] = 'Update this macro to limit the output results to filter out false positives. '
|
||||
new_dict['name'] = detection['name']. \
|
||||
replace(' ', '_').replace('-', '_').replace('.', '_').replace('/', '_').lower() + '_filter'
|
||||
filter_macros.append(new_dict)
|
||||
|
||||
all_macros = macros + filter_macros
|
||||
|
||||
utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat()
|
||||
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('macros.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/macros.conf')
|
||||
output = template.render(macros=all_macros, time=utc_time)
|
||||
with open(output_path, 'w', encoding="utf-8") as f:
|
||||
f.write(output)
|
||||
|
||||
return output_path
|
||||
|
||||
|
||||
def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
|
||||
sto_res = map_response_tasks_to_stories(response_tasks)
|
||||
|
||||
for story in stories:
|
||||
if story['name'] in sto_res:
|
||||
response_task_names = list(sto_res[story['name']])
|
||||
story['workbench_panels'] = []
|
||||
for response_task_name in response_task_names:
|
||||
str = 'panel://workbench_panel_' + response_task_name[7:].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
|
||||
story['workbench_panels'].append(str)
|
||||
story['lowercase_name'] = story['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
|
||||
|
||||
workbench_panel_objects = []
|
||||
for response_task in response_tasks:
|
||||
if 'search' in response_task:
|
||||
if 'inputs' in response_task:
|
||||
response_file_name = response_task['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
|
||||
response_file_name_xml = response_file_name + "___response_task.xml"
|
||||
response_task['lowercase_name'] = response_file_name
|
||||
workbench_panel_objects.append(response_task)
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('panel.j2')
|
||||
file_path = "default/data/ui/panels/workbench_panel_" + response_file_name_xml
|
||||
output_path = path.join(OUTPUT_PATH, file_path)
|
||||
response_task['search']= response_task['search'].replace(">",">")
|
||||
response_task['search']= response_task['search'].replace("<","<")
|
||||
|
||||
output = template.render(search=response_task['search'])
|
||||
with open(output_path, 'w') as f:
|
||||
f.write(output)
|
||||
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('es_investigations.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/es_investigations.conf')
|
||||
output = template.render(response_tasks=workbench_panel_objects, stories=stories)
|
||||
with open(output_path, 'w', encoding="utf-8") as f:
|
||||
f.write(output)
|
||||
j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH),
|
||||
trim_blocks=True)
|
||||
template = j2_env.get_template('workflow_actions.j2')
|
||||
output_path = path.join(OUTPUT_PATH, 'default/workflow_actions.conf')
|
||||
output = template.render(response_tasks=workbench_panel_objects)
|
||||
with open(output_path, 'w', encoding="utf-8") as f:
|
||||
f.write(output)
|
||||
|
||||
return workbench_panel_objects
|
||||
|
||||
|
||||
def parse_data_models_from_search(search):
|
||||
match = re.search(r'from\sdatamodel\s?=\s?([^\s.]*)', search)
|
||||
if match is not None:
|
||||
return match.group(1)
|
||||
return False
|
||||
|
||||
|
||||
def parse_author_company(story):
|
||||
match_author = re.search(r'^([^,]+)', story['author'])
|
||||
if match_author is None:
|
||||
match_author = 'no'
|
||||
else:
|
||||
match_author = match_author.group(1)
|
||||
|
||||
match_company = re.search(r',\s?(.*)$', story['author'])
|
||||
if match_company is None:
|
||||
match_company = 'no'
|
||||
else:
|
||||
match_company = match_company.group(1)
|
||||
|
||||
return match_author, match_company
|
||||
|
||||
|
||||
def get_deployments(object, deployments):
|
||||
matched_deployments = []
|
||||
|
||||
for deployment in deployments:
|
||||
|
||||
for tag in object['tags'].keys():
|
||||
if tag in deployment['tags'].keys():
|
||||
if type(object['tags'][tag]) is str:
|
||||
tag_array = [object['tags'][tag]]
|
||||
else:
|
||||
tag_array = object['tags'][tag]
|
||||
|
||||
for tag_value in tag_array:
|
||||
if type(deployment['tags'][tag]) is str:
|
||||
tag_array_deployment = [deployment['tags'][tag]]
|
||||
else:
|
||||
tag_array_deployment = deployment['tags'][tag]
|
||||
|
||||
for tag_value_deployment in tag_array_deployment:
|
||||
if tag_value == tag_value_deployment:
|
||||
# print("tag value: {}, matched deployment tag: {} on deployment: {}".format(tag_value,tag_value_deployment, deployment))
|
||||
matched_deployments.append(deployment)
|
||||
continue
|
||||
|
||||
# grab default for all stories if deployment not set
|
||||
if len(matched_deployments) == 0:
|
||||
for deployment in deployments:
|
||||
if 'analytic_story' in deployment['tags']:
|
||||
if deployment['tags']['analytic_story'] == 'all':
|
||||
last_deployment = deployment
|
||||
else:
|
||||
last_deployment = matched_deployments[-1]
|
||||
last_deployment = replace_vars_in_deployment(last_deployment, object)
|
||||
|
||||
# print(last_deployment)
|
||||
return last_deployment
|
||||
|
||||
|
||||
def replace_vars_in_deployment(deployment, object):
|
||||
if 'alert_action' in deployment:
|
||||
if 'email' in deployment['alert_action']:
|
||||
deployment['alert_action']['email']['message']=re.sub(r'%([a-z_]+)%]', lambda x: object[x.group(1)], str(v))
|
||||
deployment['alert_action']['email']['subject']=re.sub(r'%([a-z_]+)%]', lambda x: object[x.group(1)], str(v))
|
||||
|
||||
if 'notable' in deployment:
|
||||
deployment['alert_action']['notable']['rule_description']=re.sub(r'%([a-z_]+)%]', lambda x: object[x.group(1)], str(v))
|
||||
deployment['alert_action']['notable']['rule_title']=re.sub(r'%([a-z_]+)%]', lambda x: object[x.group(1)], str(v))
|
||||
|
||||
return deployment
|
||||
|
||||
|
||||
def get_nes_fields(search, deployment):
|
||||
nes_fields_matches = []
|
||||
if 'alert_action' in deployment:
|
||||
if 'notable' in deployment['alert_action']:
|
||||
if 'nes_fields' in deployment['alert_action']['notable']:
|
||||
for field in deployment['alert_action']['notable']['nes_fields']:
|
||||
if (search.find(field + ' ') != -1):
|
||||
nes_fields_matches.append(field)
|
||||
|
||||
return nes_fields_matches
|
||||
|
||||
|
||||
def map_detection_to_stories(detections):
|
||||
sto_det = {}
|
||||
for detection in detections:
|
||||
if 'analytic_story' in detection['tags']:
|
||||
for story in detection['tags']['analytic_story']:
|
||||
if 'type' in detection.keys():
|
||||
if detection['type'] == 'batch':
|
||||
rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
|
||||
else:
|
||||
rule_name = str('ESCU - ' + detection['name'] + ' - Rule')
|
||||
if not (story in sto_det):
|
||||
sto_det[story] = {rule_name}
|
||||
else:
|
||||
sto_det[story].add(rule_name)
|
||||
return sto_det
|
||||
|
||||
|
||||
def map_response_tasks_to_stories(response_tasks):
|
||||
sto_res = {}
|
||||
for response_task in response_tasks:
|
||||
if 'tags' in response_task:
|
||||
if 'analytic_story' in response_task['tags']:
|
||||
for story in response_task['tags']['analytic_story']:
|
||||
if 'type' in response_task.keys():
|
||||
if response_task['type'] == 'response':
|
||||
task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
|
||||
else:
|
||||
task_name = str('ESCU - ' + response_task['name'] + ' - Response Task')
|
||||
if not (story in sto_res):
|
||||
sto_res[story] = {task_name}
|
||||
else:
|
||||
sto_res[story].add(task_name)
|
||||
return sto_res
|
||||
|
||||
|
||||
def map_baselines_to_stories(baselines):
|
||||
sto_bas = {}
|
||||
for baseline in baselines:
|
||||
if 'tags' in baseline:
|
||||
if 'analytic_story' in baseline['tags']:
|
||||
for story in baseline['tags']['analytic_story']:
|
||||
if 'type' in baseline.keys():
|
||||
if baseline['type'] == 'batch':
|
||||
baseline_name = str('ESCU - ' + baseline['name'])
|
||||
else:
|
||||
baseline_name = str('ESCU - ' + baseline['name'])
|
||||
if not (story in sto_bas):
|
||||
sto_bas[story] = {baseline_name}
|
||||
else:
|
||||
sto_bas[story].add(baseline_name)
|
||||
return sto_bas
|
||||
|
||||
def custom_jinja2_enrichment_filter(string, object):
|
||||
customized_string = string
|
||||
for key in object.keys():
|
||||
[key.encode('utf-8') for key in object]
|
||||
customized_string = customized_string.replace("%" + key + "%", str(object[key]))
|
||||
|
||||
for key in object['tags'].keys():
|
||||
customized_string = customized_string.replace("%" + key + "%", str(object['tags'][key]))
|
||||
|
||||
return customized_string
|
||||
|
||||
|
||||
def prepare_stories(stories, detections):
|
||||
return response_tasks
|
||||
|
||||
def prepare_stories(stories, detections, response_tasks, baselines):
|
||||
# enrich stories with information from detections: data_models, mitre_ids, kill_chain_phases, nists
|
||||
sto_to_data_models = {}
|
||||
sto_to_mitre_attack_ids = {}
|
||||
@@ -521,8 +430,14 @@ def prepare_stories(stories, detections):
|
||||
else:
|
||||
sto_to_nists[story] = set(detection['tags']['nist'])
|
||||
|
||||
sto_res = map_response_tasks_to_stories(response_tasks)
|
||||
sto_bas = map_baselines_to_stories(baselines)
|
||||
|
||||
for story in stories:
|
||||
story['author_name'], story['author_company'] = parse_author_company(story)
|
||||
story['lowercase_name'] = story['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
|
||||
story['detections'] = sorted(sto_to_det[story['name']])
|
||||
story['searches'] = story['detections']
|
||||
if story['name'] in sto_to_data_models:
|
||||
story['data_models'] = sorted(sto_to_data_models[story['name']])
|
||||
if story['name'] in sto_to_mitre_attack_ids:
|
||||
@@ -533,6 +448,16 @@ def prepare_stories(stories, detections):
|
||||
story['cis20'] = sorted(sto_to_ciss[story['name']])
|
||||
if story['name'] in sto_to_nists:
|
||||
story['nist'] = sorted(sto_to_nists[story['name']])
|
||||
if story['name'] in sto_res:
|
||||
story['response_tasks'] = sorted(list(sto_res[story['name']]))
|
||||
story['searches'] = story['searches'] + story['response_tasks']
|
||||
story['workbench_panels'] = []
|
||||
for response_task_name in story['response_tasks']:
|
||||
s = 'panel://workbench_panel_' + response_task_name[7:].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower()
|
||||
story['workbench_panels'].append(s)
|
||||
if story['name'] in sto_bas:
|
||||
story['baselines'] = sorted(list(sto_bas[story['name']]))
|
||||
|
||||
|
||||
keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist']
|
||||
mappings = {}
|
||||
@@ -572,29 +497,54 @@ def generate_mitre_lookup(OUTPUT_PATH):
|
||||
writer.writerows(csv_mitre_rows)
|
||||
|
||||
|
||||
def import_objects(VERBOSE, REPO_PATH):
|
||||
objects = {
|
||||
"stories": load_objects("stories/*.yml", VERBOSE, REPO_PATH),
|
||||
"macros": load_objects("macros/*.yml", VERBOSE, REPO_PATH),
|
||||
"lookups": load_objects("lookups/*.yml", VERBOSE, REPO_PATH),
|
||||
"baselines": load_objects("baselines/*.yml", VERBOSE, REPO_PATH),
|
||||
"responses": load_objects("responses/*.yml", VERBOSE, REPO_PATH),
|
||||
"response_tasks": load_objects("response_tasks/*.yml", VERBOSE, REPO_PATH),
|
||||
"deployments": load_objects("deployments/*.yml", VERBOSE, REPO_PATH),
|
||||
"detections": load_objects("detections/*/*.yml", VERBOSE, REPO_PATH),
|
||||
}
|
||||
objects["detections"].extend(load_objects("detections/*/*/*.yml", VERBOSE, REPO_PATH))
|
||||
|
||||
return objects
|
||||
|
||||
def compute_objects(objects, PRODUCT, OUTPUT_PATH):
|
||||
if PRODUCT == "SAAWS":
|
||||
objects["detections"] = [object for object in objects["detections"] if 'Splunk Security Analytics for AWS' in object['tags']['product']]
|
||||
objects["stories"] = [object for object in objects["stories"] if 'Splunk Security Analytics for AWS' in object['tags']['product']]
|
||||
objects["baselines"] = [object for object in objects["baselines"] if 'Splunk Security Analytics for AWS' in object['tags']['product']]
|
||||
objects["response_tasks"] = [object for object in objects["response_tasks"] if 'Splunk Security Analytics for AWS' in object['tags']['product']]
|
||||
|
||||
# only use ESCU detections to the configurations
|
||||
objects["detections"] = sorted(filter(lambda d: d['type'].lower() == 'batch', objects["detections"]), key=lambda d: d['name'])
|
||||
# only use ESCU stories to the configuration
|
||||
objects["stories"] = sorted(filter(lambda s: s['type'].lower() == 'batch', objects["stories"]), key=lambda s: s['name'])
|
||||
|
||||
objects["response_tasks"] = sorted(objects["response_tasks"], key=lambda i: i['name'])
|
||||
objects["baselines"] = sorted(objects["baselines"], key=lambda b: b['name'])
|
||||
objects["macros"] = sorted(objects["macros"], key=lambda m: m['name'])
|
||||
|
||||
objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], OUTPUT_PATH)
|
||||
objects["baselines"] = prepare_baselines(objects["baselines"], objects["deployments"], OUTPUT_PATH)
|
||||
objects["response_tasks"] = prepare_response_tasks(objects["response_tasks"])
|
||||
objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["response_tasks"], objects["baselines"])
|
||||
|
||||
return objects
|
||||
|
||||
def get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
|
||||
objects = import_objects(VERBOSE, REPO_PATH)
|
||||
objects = compute_objects(objects, PRODUCT, OUTPUT_PATH)
|
||||
return objects
|
||||
|
||||
def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
|
||||
|
||||
TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
|
||||
|
||||
stories = load_objects("stories/*.yml", VERBOSE, REPO_PATH)
|
||||
macros = load_objects("macros/*.yml", VERBOSE, REPO_PATH)
|
||||
lookups = load_objects("lookups/*.yml", VERBOSE, REPO_PATH)
|
||||
baselines = load_objects("baselines/*.yml", VERBOSE, REPO_PATH)
|
||||
responses = load_objects("responses/*.yml", VERBOSE, REPO_PATH)
|
||||
response_tasks = load_objects("response_tasks/*.yml", VERBOSE, REPO_PATH)
|
||||
deployments = load_objects("deployments/*.yml", VERBOSE, REPO_PATH)
|
||||
|
||||
# process all detections
|
||||
detections = []
|
||||
detections = load_objects("detections/*/*.yml", VERBOSE, REPO_PATH)
|
||||
detections.extend(load_objects("detections/*/*/*.yml", VERBOSE, REPO_PATH))
|
||||
|
||||
if PRODUCT == "SAAWS":
|
||||
detections = [object for object in detections if 'Splunk Security Analytics for AWS' in object['tags']['product']]
|
||||
stories = [object for object in stories if 'Splunk Security Analytics for AWS' in object['tags']['product']]
|
||||
baselines = [object for object in baselines if 'Splunk Security Analytics for AWS' in object['tags']['product']]
|
||||
response_tasks = [object for object in response_tasks if 'Splunk Security Analytics for AWS' in object['tags']['product']]
|
||||
objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
|
||||
|
||||
try:
|
||||
if VERBOSE:
|
||||
@@ -604,39 +554,26 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
|
||||
print('Error: ' + str(e))
|
||||
print("WARNING: Generation of Mitre lookup failed.")
|
||||
|
||||
lookups_path = generate_transforms_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH)
|
||||
lookups_path = generate_collections_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH)
|
||||
lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
|
||||
lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
|
||||
|
||||
detections = sorted(detections, key=lambda d: d['name'])
|
||||
detection_path = generate_savedsearches_conf(objects["detections"], objects["response_tasks"], objects["baselines"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
|
||||
|
||||
# only use ESCU detections to the configurations
|
||||
detections = [object for object in detections if object["type"].lower() == "batch"]
|
||||
story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], objects["response_tasks"], objects["baselines"], TEMPLATE_PATH, OUTPUT_PATH)
|
||||
|
||||
response_tasks = sorted(response_tasks, key=lambda i: i['name'])
|
||||
baselines = sorted(baselines, key=lambda b: b['name'])
|
||||
detection_path = generate_savedsearches_conf(detections, response_tasks, baselines, deployments, TEMPLATE_PATH, OUTPUT_PATH)
|
||||
use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], objects["response_tasks"], objects["baselines"], TEMPLATE_PATH, OUTPUT_PATH)
|
||||
|
||||
# only use ESCU stories to the configuration
|
||||
stories = sorted(filter(lambda s: s['type'].lower() == 'batch', stories), key=lambda s: s['name'])
|
||||
macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
|
||||
|
||||
|
||||
|
||||
story_path = generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH)
|
||||
|
||||
use_case_lib_path = generate_use_case_library_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH)
|
||||
|
||||
macros = sorted(macros, key=lambda m: m['name'])
|
||||
macros_path = generate_macros_conf(macros, detections, TEMPLATE_PATH, OUTPUT_PATH)
|
||||
|
||||
workbench_panels_objects = generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PATH)
|
||||
workbench_panels_objects = generate_workbench_panels(objects["response_tasks"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
|
||||
|
||||
|
||||
if VERBOSE:
|
||||
print("{0} stories have been successfully written to {1}".format(len(stories), story_path))
|
||||
print("{0} detections have been successfully written to {1}".format(len(detections), detection_path))
|
||||
print("{0} response tasks have been successfully written to {1}".format(len(response_tasks), detection_path))
|
||||
print("{0} baselines have been successfully written to {1}".format(len(baselines), detection_path))
|
||||
print("{0} macros have been successfully written to {1}".format(len(macros), macros_path))
|
||||
print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), story_path))
|
||||
print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
|
||||
print("{0} response tasks have been successfully written to {1}".format(len(objects["response_tasks"]), detection_path))
|
||||
print("{0} baselines have been successfully written to {1}".format(len(objects["baselines"]), detection_path))
|
||||
print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
|
||||
print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*"))
|
||||
print("security content generation completed..")
|
||||
|
||||
|
||||
@@ -66,7 +66,17 @@ All the detections shipped to different Splunk products. Below is a breakdown by
|
||||
|
||||
- **Product**: {{ detection.tags.product|join(', ') }}
|
||||
- **Datamodel**: {{ detection.datamodel|join(', ') }}
|
||||
- **ATT&CK**: {% for mitre_attack_id in detection.tags.mitre_attack_id %}[{{ mitre_attack_id }}](https://attack.mitre.org/techniques/{{ mitre_attack_id }}/){% if not loop.last %}, {% endif %}{% endfor %}
|
||||
- **ATT&CK**: {% for attack in detection.tags.mitre_attack_id -%}
|
||||
{%- if attack -%}
|
||||
{% set sub_technique = attack.split('.') %}
|
||||
{%- if sub_technique | length > 1 -%}
|
||||
[{{ attack}}](https://attack.mitre.org/techniques/{{sub_technique[0] }}/{{sub_technique[1]}}/)
|
||||
{%- else -%}
|
||||
[{{ attack}}](https://attack.mitre.org/techniques/{{ attack }}/)
|
||||
{%- endif -%}
|
||||
{%- endif -%}
|
||||
{% if not loop.last -%}, {% endif -%}
|
||||
{% endfor %}
|
||||
- **Last Updated**: {{ detection.date }}
|
||||
|
||||
<details>
|
||||
@@ -108,9 +118,11 @@ All the detections shipped to different Splunk products. Below is a breakdown by
|
||||
{{ detection.known_false_positives}}
|
||||
|
||||
#### Reference
|
||||
{% if detection.references %}
|
||||
{% for reference in detection.references %}
|
||||
* {{ reference }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
#### Test Dataset
|
||||
{% for dataset in detection.tags.dataset %}
|
||||
|
||||
@@ -11,7 +11,17 @@ All the detections shipped to different Splunk products. Below is a breakdown by
|
||||
|
||||
* '''Product''': {{ detection.tags.product|join(', ') }}
|
||||
* '''Datamodel''': {{ detection.datamodel|join(', ') }}
|
||||
* '''ATT&CK''': {% for attack in detection.mitre_attacks %}[https://attack.mitre.org/techniques/{{ attack.technique_id }}/ {{ attack.technique_id }}]{% if not loop.last %}, {% endif %}{% endfor %}
|
||||
* '''ATT&CK''': {% for attack in detection.mitre_attacks -%}
|
||||
{%- if attack.technique_id -%}
|
||||
{% set sub_technique = attack.technique_id.split('.') %}
|
||||
{%- if sub_technique | length > 1 -%}
|
||||
[https://attack.mitre.org/techniques/{{sub_technique[0] }}/{{sub_technique[1]}}/ {{ attack.technique_id }}]
|
||||
{%- else -%}
|
||||
[https://attack.mitre.org/techniques/{{attack.technique_id}}/ {{ attack.technique_id }}]
|
||||
{%- endif -%}
|
||||
{%- endif -%}
|
||||
{% if not loop.last -%}, {% endif -%}
|
||||
{% endfor %}
|
||||
* '''Last Updated''': {{ detection.date }}
|
||||
|
||||
<div class="toccolours mw-collapsible mw-collapsed">
|
||||
@@ -57,9 +67,11 @@ All the detections shipped to different Splunk products. Below is a breakdown by
|
||||
{{ detection.known_false_positives}}
|
||||
|
||||
====Reference====
|
||||
{% if detection.references %}
|
||||
{% for reference in detection.references %}
|
||||
* {{ reference }}
|
||||
{% endfor %}
|
||||
{% endif %}
|
||||
|
||||
====Test Dataset====
|
||||
{% for dataset in detection.tags.dataset %}
|
||||
@@ -75,10 +87,12 @@ All the detections shipped to different Splunk products. Below is a breakdown by
|
||||
|
||||
{% endfor %}
|
||||
|
||||
''#############''
|
||||
''# Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
|
||||
''# On Date: {{ time }} UTC''
|
||||
''# Author: Splunk Security Research''
|
||||
''# Contact: research@splunk.com''
|
||||
''#############''
|
||||
<pre>
|
||||
#############
|
||||
# Automatically generated by doc_gen.py in https://github.com/splunk/security_content''
|
||||
# On Date: {{ time }} UTC''
|
||||
# Author: Splunk Security Research''
|
||||
# Contact: research@splunk.com''
|
||||
#############
|
||||
</pre>
|
||||
|
||||
|
||||
@@ -56,12 +56,12 @@ All the Analytic Stories shipped to different Splunk products. Below is a breakd
|
||||
|
||||
{% endfor %}
|
||||
|
||||
''
|
||||
<pre>
|
||||
#############
|
||||
# Automatically generated by doc_gen.py in https://github.com/splunk/security_content
|
||||
# On Date: {{ time }} UTC
|
||||
# Author: Splunk Security Research
|
||||
# Contact: research@splunk.com
|
||||
#############
|
||||
''
|
||||
</pre>
|
||||
|
||||
|
||||
+2
-2
@@ -206,7 +206,7 @@ def detection_wizard(security_content_path,type,TEMPLATE_PATH):
|
||||
if answers['detection_type'] == 'batch':
|
||||
answers['products'] = ['Splunk Enterprise','Splunk Enterprise Security','Splunk Cloud']
|
||||
elif answers['detection_type'] == 'streaming':
|
||||
answers['products'] = ['UEBA for Security Cloud']
|
||||
answers['products'] = ['Splunk Behavioral Analytics']
|
||||
|
||||
# grab some vars for the test
|
||||
detection_kind = answers['detection_kind']
|
||||
@@ -384,7 +384,7 @@ def story_wizard(security_content_path,type, TEMPLATE_PATH):
|
||||
if answers['story_type'] == 'batch':
|
||||
answers['products'] = ['Splunk Enterprise','Splunk Enterprise Security','Splunk Cloud']
|
||||
elif answers['story_type'] == 'streaming':
|
||||
answers['products'] = ['UEBA for Security Cloud']
|
||||
answers['products'] = ['Splunk Behavioral Analytics']
|
||||
|
||||
template = j2_env.get_template('story.j2')
|
||||
story_name = answers['story_name']
|
||||
|
||||
@@ -56,6 +56,7 @@ def main(args):
|
||||
for test in tests:
|
||||
counter_tests=counter_tests+1
|
||||
|
||||
|
||||
detection_coverage = "{:.0%}".format(counter_tests/counter_detection)
|
||||
|
||||
TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates')
|
||||
|
||||
@@ -13,6 +13,6 @@
|
||||
<rect rx="3" width="105" height="20" fill="url(#a)"/>
|
||||
<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
|
||||
<text x="30" y="14">detections</text>
|
||||
<text x="83" y="14">357</text>
|
||||
<text x="83" y="14">440</text>
|
||||
</g>
|
||||
</svg>
|
||||
|
Before Width: | Height: | Size: 654 B After Width: | Height: | Size: 654 B |
@@ -13,6 +13,6 @@
|
||||
<rect rx="3" width="100" height="20" fill="url(#a)"/>
|
||||
<g fill="#fff" text-anchor="middle" font-family="DejaVu Sans,Verdana,Geneva,sans-serif" font-size="11">
|
||||
<text x="30" y="14">coverage</text>
|
||||
<text x="80" y="14">83%</text>
|
||||
<text x="80" y="14">100%</text>
|
||||
</g>
|
||||
</svg>
|
||||
|
Before Width: | Height: | Size: 652 B After Width: | Height: | Size: 653 B |
@@ -1,47 +1,28 @@
|
||||
# Running tests
|
||||
# SSA Testing
|
||||
The SSA testing job will test SSA detections with the staging tenant research. It will execute the following steps to test SSA detections:
|
||||
* Create a temporary index for results
|
||||
* Create a temporary pipeline and decorate it
|
||||
* Activate a temporary pipeline
|
||||
* Send raw data to the testing tenant
|
||||
* Collect the results from the temporary index
|
||||
* Tear down the test
|
||||
|
||||
You can run these tests using `pytest`. The required parameters a DSP `token`, the DSP `environment`, and the DSP `tenant`.
|
||||
# SSA Testing GitLab CI
|
||||
SSA testing job is configured as a GitLAB CI job, which will test all changed and newly created SSA detections in the given branch compared to the develop branch. For example, if you create two new SSA detections with its corrsponding test files, it will test these two SSA detections in the GitLab CI job. It can take up to 30 min until the GitLab CI job will start.
|
||||
The GitLab CI job is limited to branches with the prefix ssa*, therefore you need to name your branch ssa* in order to make the GitLab CI job work.
|
||||
|
||||
## Run all tests in `playground`
|
||||
|
||||
```angular2
|
||||
pytest --env playground --tenant research2 --token <YOUR_DSP_TOKEN>
|
||||
```
|
||||
|
||||
## Run all tests in `staging`
|
||||
|
||||
```angular2
|
||||
pytest --env staging --tenant research --token <YOUR_DSP_TOKEN>
|
||||
```
|
||||
|
||||
## Run specific tests
|
||||
|
||||
If you add the argument `-k` to pytest, then it can filter tests to run the tests specified.
|
||||
|
||||
```angular2
|
||||
pytest --env playground --tenant research2 --token <YOUR_DSP_TOKEN> -k test_data_ingestion_preview
|
||||
```
|
||||
|
||||
It also can run tests by category if naming conditions are maintained.
|
||||
|
||||
```angular2
|
||||
pytest --env playground --tenant research2 --token <YOUR_DSP_TOKEN> -k test_data_ingestion
|
||||
```
|
||||
|
||||
Will run tests `test_data_ingestion_preview` and `test_data_ingestion_index`.
|
||||
|
||||
## Best Practices
|
||||
|
||||
Save your token to an environment variable. Go to *playground* console and copy your token. Then..
|
||||
|
||||
```angular2
|
||||
export SCLOUD_TOKEN_PLAY=$(pbpaste)
|
||||
```
|
||||
|
||||
Go to your *staging* console and copy your token. Then..
|
||||
|
||||
```angular2
|
||||
export SCLOUD_TOKEN_STAGING=$(pbpaste)
|
||||
```
|
||||
|
||||
Now you can easily run tests on both playground, and staging.
|
||||
# SSA Testing Manual
|
||||
Additional to the GitLab CI testing, you can do ad-hoc testing during SSA detection development. First you need, to prepare your virtualenv:
|
||||
````
|
||||
cd bin/ssa-end-to-end-testing
|
||||
virtualenv -p python3 venv && source venv/bin/activate && pip3 install -r requirements.txt
|
||||
````
|
||||
Then you can run the SSA detection test (please consider that your detections needs to be pushed to the GitHub repository):
|
||||
````
|
||||
python run_ssa_smoketest.py -e staging -s research -b [your_branch] -t [your_token]
|
||||
````
|
||||
The token can be derived from the SSA tenant.
|
||||
In order to only test a single detection, you can run the following command:
|
||||
````
|
||||
python run_ssa_smoketest.py -e staging -s research -b [your_branch] -tf endpoint/ssa___detect_pass_hash.test.yml -t [your_token]
|
||||
````
|
||||
@@ -34,6 +34,7 @@ def main(args):
|
||||
# Parsed file is a SSA detection
|
||||
log(logging.INFO, "Validating %s" % detection['name'])
|
||||
cur_status = validate_tags(detection)
|
||||
cur_status = cur_status & validate_required_fields(detection)
|
||||
status = status & cur_status
|
||||
if cur_status:
|
||||
passed_validations.append(detection_file)
|
||||
|
||||
@@ -103,6 +103,9 @@ def validate_fields(object):
|
||||
if 'security_domain' not in object['tags']:
|
||||
errors.append("ERROR: a `security_domain` tag is required for object: %s" % object['name'])
|
||||
|
||||
if object['type'] == 'streaming' and 'risk_severity' not in object['tags']:
|
||||
errors.append("ERROR: a `risk_severity` tag is required for object: %s" % object['name'])
|
||||
|
||||
return errors
|
||||
|
||||
|
||||
@@ -118,6 +121,9 @@ def validate_standard_fields(object, uuids):
|
||||
else:
|
||||
uuids.append(object['id'])
|
||||
|
||||
if (object['type']) == 'batch' and len(object['name']) > 75:
|
||||
errors.append('ERROR: Search name is longer than 75 characters: %s' % (object['name']))
|
||||
|
||||
# if object['name'].endswith(" "):
|
||||
# errors.append(
|
||||
# "ERROR: name has trailing spaces: '%s'" %
|
||||
|
||||
@@ -22,8 +22,11 @@ tags:
|
||||
analytic_story:
|
||||
- AWS User Monitoring
|
||||
asset_type: AWS Account
|
||||
automated_detection_testing: passed
|
||||
cis20:
|
||||
- CIS 13
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack_id:
|
||||
@@ -48,6 +51,3 @@ tags:
|
||||
risk_object_type: system
|
||||
risk_score: 20
|
||||
security_domain: network
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1526/aws_security_scanner/aws_security_scanner.json
|
||||
|
||||
@@ -0,0 +1,47 @@
|
||||
name: AWS IAM AccessDenied Discovery Events
|
||||
id: 3e1f1568-9633-11eb-a69c-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-05'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel: []
|
||||
description: The following detection identifies excessive AccessDenied events within
|
||||
an hour timeframe. It is possible that an access key to AWS may have been stolen
|
||||
and is being misused to perform discovery events. In these instances, the access
|
||||
is not available with the key stolen therefore these events will be generated.
|
||||
search: '`cloudtrail` (errorCode = "AccessDenied") user_type=IAMUser (userAgent!=*.amazonaws.com)
|
||||
| bucket _time span=1h | stats count as failures min(_time) as firstTime max(_time)
|
||||
as lastTime, dc(eventName) as methods, dc(eventSource) as sources values(userIdentity.arn)
|
||||
by src_ip, userIdentity.arn, _time | where failures >= 5 and methods >= 1 and sources
|
||||
>= 1 | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `aws_iam_accessdenied_discovery_events_filter`'
|
||||
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
|
||||
this data. The search requires AWS Cloudtrail logs.
|
||||
known_false_positives: It is possible to start this detection will need to be tuned
|
||||
by source IP or user. In addition, change the count values to an upper threshold
|
||||
to restrict false positives.
|
||||
references:
|
||||
- https://aws.amazon.com/premiumsupport/knowledge-center/troubleshoot-iam-permission-errors/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Suspicious Cloud User Activities
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_accessdenied_discovery_events/aws_iam_accessdenied_discovery_events.json
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1580
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
- Splunk Security Analytics for AWS
|
||||
required_fields:
|
||||
- _time
|
||||
- eventName
|
||||
- eventSource
|
||||
- userAgent
|
||||
- errorCode
|
||||
- userIdentity.type
|
||||
security_domain: access
|
||||
@@ -0,0 +1,52 @@
|
||||
name: AWS IAM Assume Role Policy Brute Force
|
||||
id: f19e09b0-9308-11eb-b7ec-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-01'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel: []
|
||||
description: The following detection identifies any malformed policy document exceptions
|
||||
with a status of `failure`. A malformed policy document exception occurs in instances
|
||||
where roles are attempted to be assumed, or brute forced. In a brute force attempt,
|
||||
using a tool like CloudSploit or Pacu, an attempt will look like `arn:aws:iam::111111111111:role/aws-service-role/rds.amazonaws.com/AWSServiceRoleForRDS`. Meaning,
|
||||
when an adversary is attempting to identify a role name, multiple failures will
|
||||
occur. This detection focuses on the errors of a remote attempt that is failing.
|
||||
search: '`cloudtrail` (errorCode=MalformedPolicyDocumentException) status=failure
|
||||
(userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
|
||||
lastTime values(requestParameters.policyName) as policy_name by src eventName eventSource
|
||||
aws_account_id errorCode requestParameters.policyDocument userAgent eventID awsRegion
|
||||
userIdentity.principalId user_arn | where count >= 2 | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `aws_iam_assume_role_policy_brute_force_filter`'
|
||||
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
|
||||
this data. The search requires AWS Cloudtrail logs. Set the `where count` greater
|
||||
than a value to identify suspicious activity in your environment.
|
||||
known_false_positives: This detection will require tuning to provide high fidelity
|
||||
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
|
||||
or by groups of users.
|
||||
references:
|
||||
- https://www.praetorian.com/blog/aws-iam-assume-role-vulnerabilities
|
||||
- https://rhinosecuritylabs.com/aws/assume-worst-aws-assume-role-enumeration/
|
||||
- https://www.elastic.co/guide/en/security/current/aws-iam-brute-force-of-assume-role-policy.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- AWS IAM Privilege Escalation
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1580/aws_iam_assume_role_policy_brute_force/aws_iam_assume_role_policy_brute_force.json
|
||||
kill_chain_phases:
|
||||
- Reconnaissance
|
||||
mitre_attack_id:
|
||||
- T1580
|
||||
- T1110
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
- Splunk Security Analytics for AWS
|
||||
required_fields:
|
||||
- _time
|
||||
- eventName
|
||||
- userAgent
|
||||
- errorCode
|
||||
- requestParameters.policyName
|
||||
security_domain: access
|
||||
@@ -0,0 +1,49 @@
|
||||
name: AWS IAM Delete Policy
|
||||
id: ec3a9362-92fe-11eb-99d0-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-01'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel: []
|
||||
description: The following detection identifes when a policy is deleted on AWS. This
|
||||
does not identify whether successful or failed, but the error messages tell a story
|
||||
of suspicious attempts. There is a specific process to follow when deleting a policy.
|
||||
First, detach the policy from all users, groups, and roles that the policy is attached
|
||||
to, using DetachUserPolicy , DetachGroupPolicy , or DetachRolePolicy.
|
||||
search: '`cloudtrail` eventName=DeletePolicy (userAgent!=*.amazonaws.com) | stats
|
||||
count min(_time) as firstTime max(_time) as lastTime values(requestParameters.policyArn)
|
||||
as policyArn by src eventName eventSource aws_account_id errorCode errorMessage
|
||||
userAgent eventID awsRegion userIdentity.principalId userIdentity.arn | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `aws_iam_delete_policy_filter`'
|
||||
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
|
||||
this data. The search requires AWS Cloudtrail logs.
|
||||
known_false_positives: This detection will require tuning to provide high fidelity
|
||||
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
|
||||
or by groups of users. Not every user with AWS access should have permission to
|
||||
delete policies (least privilege). In addition, this may be saved seperately and
|
||||
tuned for failed or success attempts only.
|
||||
references:
|
||||
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeletePolicy.html
|
||||
- https://docs.aws.amazon.com/cli/latest/reference/iam/delete-policy.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- AWS IAM Privilege Escalation
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_delete_policy/aws_iam_delete_policy.json
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack_id:
|
||||
- T1098
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
- Splunk Security Analytics for AWS
|
||||
required_fields:
|
||||
- _time
|
||||
- eventName
|
||||
- userAgent
|
||||
- errorCode
|
||||
- requestParameters.policyArn
|
||||
security_domain: access
|
||||
@@ -0,0 +1,49 @@
|
||||
name: AWS IAM Failure Group Deletion
|
||||
id: 723b861a-92eb-11eb-93b8-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-01'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel: []
|
||||
description: This detection identifies failure attempts to delete groups. We want
|
||||
to identify when a group is attempting to be deleted, but either access is denied,
|
||||
there is a conflict or there is no group. This is indicative of administrators performing
|
||||
an action, but also could be suspicious behavior occurring. Review parallel IAM
|
||||
events - recently added users, new groups and so forth.
|
||||
search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode
|
||||
IN (NoSuchEntityException,DeleteConflictException, AccessDenied) (userAgent!=*.amazonaws.com)
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime values(requestParameters.groupName)
|
||||
as group_name by src eventName eventSource aws_account_id errorCode errorMessage
|
||||
userAgent eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `aws_iam_failure_group_deletion_filter`'
|
||||
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
|
||||
this data. The search requires AWS Cloudtrail logs.
|
||||
known_false_positives: This detection will require tuning to provide high fidelity
|
||||
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
|
||||
or by groups of users. Not every user with AWS access should have permission to
|
||||
delete groups (least privilege).
|
||||
references:
|
||||
- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
|
||||
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- AWS IAM Privilege Escalation
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_failure_group_deletion/aws_iam_failure_group_deletion.json
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack_id:
|
||||
- T1098
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
- Splunk Security Analytics for AWS
|
||||
required_fields:
|
||||
- _time
|
||||
- eventName
|
||||
- userAgent
|
||||
- errorCode
|
||||
- requestParameters.groupName
|
||||
security_domain: identity
|
||||
@@ -0,0 +1,48 @@
|
||||
name: AWS IAM Successful Group Deletion
|
||||
id: e776d06c-9267-11eb-819b-acde48001122
|
||||
version: 1
|
||||
date: '2021-03-31'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel: []
|
||||
description: The following query uses IAM events to track the success of a group being
|
||||
deleted on AWS. This is typically not indicative of malicious behavior, but a precurser
|
||||
to additional events thay may unfold. Review parallel IAM events - recently added
|
||||
users, new groups and so forth. Inversely, review failed attempts in a similar manner.
|
||||
search: '`cloudtrail` eventSource=iam.amazonaws.com eventName=DeleteGroup errorCode=success
|
||||
(userAgent!=*.amazonaws.com) | stats count min(_time) as firstTime max(_time) as
|
||||
lastTime values(requestParameters.groupName) by src eventName eventSource errorCode
|
||||
user_agent awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `aws_iam_successful_group_deletion_filter`'
|
||||
how_to_implement: The Splunk AWS Add-on and Splunk App for AWS is required to utilize
|
||||
this data. The search requires AWS Cloudtrail logs.
|
||||
known_false_positives: This detection will require tuning to provide high fidelity
|
||||
detection capabilties. Tune based on src addresses (corporate offices, VPN terminations)
|
||||
or by groups of users. Not every user with AWS access should have permission to
|
||||
delete groups (least privilege).
|
||||
references:
|
||||
- https://awscli.amazonaws.com/v2/documentation/api/latest/reference/iam/delete-group.html
|
||||
- https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteGroup.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- AWS IAM Privilege Escalation
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/aws_iam_successful_group_deletion/aws_iam_successful_group_deletion.json
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack_id:
|
||||
- T1069.003
|
||||
- T1098
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
- Splunk Security Analytics for AWS
|
||||
required_fields:
|
||||
- _time
|
||||
- eventName
|
||||
- userAgent
|
||||
- errorCode
|
||||
- requestParameters.groupName
|
||||
security_domain: identity
|
||||
@@ -23,6 +23,7 @@ references: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows File Extension and Association Abuse
|
||||
- Masquerading - Rename System Utilities
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 3
|
||||
|
||||
+1
-1
@@ -71,7 +71,7 @@ tags:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- parent_process_name
|
||||
@@ -0,0 +1,56 @@
|
||||
name: Account Discovery With Net App
|
||||
id: 339805ce-ac30-11eb-b87d-acde48001122
|
||||
version: 1
|
||||
date: '2021-05-03'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: this search is to detect a potential account discovery series of command
|
||||
used by several malware or attack to recon the target machine. This technique is
|
||||
also seen in some note worthy malware like trickbot where it runs a cmd process,
|
||||
or even drop its module that will execute the said series of net command. This series
|
||||
of command are good correlation search and indicator of attacker recon if seen in
|
||||
the machines within a none technical user or department (HR, finance, ceo and etc)
|
||||
network.
|
||||
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
|
||||
values(Processes.parent_process) as parent_process values(Processes.process_id)
|
||||
as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND
|
||||
(Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view
|
||||
/all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name
|
||||
| where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed rundll32.exe may be used.
|
||||
known_false_positives: admin or power user may used this series of command.
|
||||
references:
|
||||
- https://labs.vipre.com/trickbot-and-its-modules/
|
||||
- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Trickbot
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1087.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process_id
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
- Processes.process_guid
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
|
||||
@@ -0,0 +1,56 @@
|
||||
name: Anomalous usage of 7zip
|
||||
id: 9364ee8e-a39a-11eb-8f1d-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-22'
|
||||
author: Michael Haag, Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following detection identifies a 7z.exe spawned from `Rundll32.exe`
|
||||
or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`.
|
||||
It has been observed where an adversary will rename `7z.exe`. Additional coverage
|
||||
may be required to identify the behavior of renamed instances of `7z.exe`. During
|
||||
triage, identify the source of injection into `Rundll32.exe` or `Dllhost.exe`. Capture
|
||||
any files written to disk and analyze as needed. Review parallel processes for additional
|
||||
behaviors. Typically, archiving files will result in exfiltration.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
|
||||
IN ("rundll32.exe", "dllhost.exe") Processes.process_name=*7z* by Processes.dest
|
||||
Processes.user Processes.parent_process Processes.process_name Processes.process
|
||||
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `anomalous_usage_of_7zip_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
known_false_positives: False positives should be limited as this behavior is not normal
|
||||
for `rundll32.exe` or `dllhost.exe` to spawn and run 7zip.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1560/001/
|
||||
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
|
||||
- https://thedfirreport.com/2021/01/31/bazar-no-ryuk/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Cobalt Strike
|
||||
- NOBELIUM Group
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_utility/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Actions on Objective
|
||||
mitre_attack_id:
|
||||
- T1560.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
security_domain: endpoint
|
||||
@@ -31,6 +31,7 @@ references: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- Disabling Security Tools
|
||||
- Trickbot
|
||||
asset_type: Endpoint
|
||||
automated_detection_testing: passed
|
||||
cis20:
|
||||
|
||||
@@ -9,8 +9,10 @@ datamodel:
|
||||
description: The following query identifies Microsoft Background Intelligent Transfer
|
||||
Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint.
|
||||
The query identifies the parameters used to create, resume or add a file to a BITS
|
||||
job. Typically seen combined in a oneliner or ran in sequence. If identified, review the BITS job created and capture any files written to disk. It is possible for BITS to be used to upload files and this may require further network data analysis to identify. You can use `bitsadmin /list /verbose`
|
||||
to list out the jobs during investigation.
|
||||
job. Typically seen combined in a oneliner or ran in sequence. If identified, review
|
||||
the BITS job created and capture any files written to disk. It is possible for BITS
|
||||
to be used to upload files and this may require further network data analysis to
|
||||
identify. You can use `bitsadmin /list /verbose` to list out the jobs during investigation.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe
|
||||
Processes.process IN (*create*, *addfile*, *setnotifyflags*, *setnotifycmdline*,
|
||||
@@ -32,6 +34,7 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- BITS Jobs
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
@@ -50,4 +53,3 @@ tags:
|
||||
- Processes.user
|
||||
- Processes.dest
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
|
||||
@@ -38,6 +38,7 @@ tags:
|
||||
analytic_story:
|
||||
- Ingress Tool Transfer
|
||||
- BITS Jobs
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
@@ -57,4 +58,3 @@ tags:
|
||||
- Processes.user
|
||||
- Processes.dest
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
|
||||
@@ -39,6 +39,7 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Cobalt Strike
|
||||
- Trickbot
|
||||
asset_type: Endpoint
|
||||
automated_detection_testing: passed
|
||||
cis20:
|
||||
|
||||
@@ -26,6 +26,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -42,8 +47,3 @@ tags:
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -28,6 +28,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -45,8 +50,3 @@ tags:
|
||||
- Registry.dest
|
||||
- Registry.registry_value_nam
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -28,6 +28,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -44,8 +49,3 @@ tags:
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -26,6 +26,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -42,8 +47,3 @@ tags:
|
||||
- Registry.dest
|
||||
- Registry.registry_value_nam
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -25,6 +25,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -41,8 +46,3 @@ tags:
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -24,6 +24,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -40,8 +45,3 @@ tags:
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -26,6 +26,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -45,8 +50,3 @@ tags:
|
||||
- Processes.process_id
|
||||
- Processes.parent_process_id
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -26,6 +26,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -42,8 +47,3 @@ tags:
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -27,6 +27,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -43,8 +48,3 @@ tags:
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -27,6 +27,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -43,8 +48,3 @@ tags:
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -26,6 +26,11 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Defense Evasion Tactics
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
@@ -42,8 +47,3 @@ tags:
|
||||
- Registry.dest
|
||||
- Registry.registry_value_name
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-security.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-system.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1562.001/win_app_defender_disabling/windows-sysmon.log
|
||||
|
||||
@@ -0,0 +1,54 @@
|
||||
name: DLLHost with no Command Line Arguments with Network
|
||||
id: f1c07594-a141-11eb-8407-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-19'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies DLLHost.exe with no command line arguments
|
||||
with a network connection. It is unusual for DLLHost.exe to execute with no command
|
||||
line arguments present. This particular behavior is common with malicious software,
|
||||
including Cobalt Strike. During investigation, triage any network connections and
|
||||
parallel processes. Identify any suspicious module loads related to credential dumping
|
||||
or file writes. DLLHost.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64.
|
||||
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
|
||||
where Processes.process_name=dllhost.exe by _time span=1h Processes.process_id
|
||||
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| regex process="(dllhost\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly`
|
||||
count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id
|
||||
Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC]
|
||||
| table _time dest parent_process_name process_name process_path process process_id
|
||||
connection_to_CNC dest_port | `dllhost_with_no_command_line_arguments_with_network_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
|
||||
known_false_positives: Although unlikely, some legitimate third party applications
|
||||
may use a moved copy of dllhost, triggering a false positive.
|
||||
references:
|
||||
- https://raw.githubusercontent.com/threatexpress/malleable-c2/c3385e481159a759f79b8acfe11acf240893b830/jquery-c2.4.2.profile
|
||||
- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Cobalt Strike
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_dllhost.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventID
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest_port
|
||||
- process_path
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,56 @@
|
||||
name: DNS Exfiltration Using Nslookup App
|
||||
id: 2452e632-9e0d-11eb-bacd-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-15'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: this search is to detect potential DNS exfiltration using nslookup application.
|
||||
This technique are seen in couple of malware and APT group to exfiltrated collected
|
||||
data in a infected machine or infected network. This detection is looking for unique
|
||||
use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
|
||||
commonly used by attacker and also the retry parameter which is designed to query
|
||||
C2 DNS multiple tries.
|
||||
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
|
||||
values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process
|
||||
count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.process_name = "nslookup.exe" Processes.process = "*-querytype=*"
|
||||
OR Processes.process="*-qt=*" OR Processes.process="*-q=*" OR Processes.process="-type=*"
|
||||
OR Processes.process="*-retry=*" by Processes.dest Processes.user Processes.process_name |
|
||||
`drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `dns_exfiltration_using_nslookup_app_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
|
||||
known_false_positives: admin nslookup usage
|
||||
references:
|
||||
- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
|
||||
- https://www.varonis.com/blog/dns-tunneling/
|
||||
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Suspicious DNS Traffic
|
||||
- Dynamic DNS
|
||||
- Command and Control
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1048
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
security_domain: endpoint
|
||||
@@ -10,7 +10,7 @@ description: 'The following analytic identifies "dsquery.exe" execution with arg
|
||||
looking for `TrustedDomain` query directly on the command-line. This is typically
|
||||
indicative of an Administrator or adversary perform domain trust discovery. Note
|
||||
that this query does not identify any other variations of "Dsquery.exe" usage.\
|
||||
|
||||
|
||||
Within this detection, it is assumed `dsquery.exe` is not moved or renamed.\
|
||||
|
||||
The search will return the first time and last time these command-line arguments
|
||||
@@ -46,6 +46,7 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Domain Trust Discovery
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1482/atomic_red_team/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
@@ -63,4 +64,3 @@ tags:
|
||||
- Processes.user
|
||||
- Processes.dest
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
name: Excel Spawning PowerShell
|
||||
id: 42d40a22-9be3-11eb-8f08-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-12'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following detection identifies Microsoft Excel spawning PowerShell.
|
||||
Typically, this is not common behavior and not default with Excel.exe. Excel.exe
|
||||
will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16`
|
||||
(version will vary). PowerShell spawning from Excel.exe is common for a spearphishing
|
||||
attachment and is actively used. Albeit, the command executed will most likely be
|
||||
encoded and captured via another detection. During triage, review parallel processes
|
||||
and identify any files that may have been written.
|
||||
search: '| tstats `security_content_summariesonly` count values(Processes.process)
|
||||
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.parent_process_name="excel.exe" Processes.process_name IN ("powershell.exe",
|
||||
"pwsh.exe") by Processes.parent_process Processes.process_name Processes.user Processes.dest
|
||||
| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
|
||||
| `excel_spawning_powershell_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
known_false_positives: False positives should be limited, but if any are present,
|
||||
filter as needed.
|
||||
references:
|
||||
- https://redcanary.com/threat-detection-report/techniques/powershell/
|
||||
- https://attack.mitre.org/techniques/T1566/001/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1003.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest
|
||||
- user
|
||||
- parent_process_id
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,56 @@
|
||||
name: Excel Spawning Windows Script Host
|
||||
id: 57fe880a-9be3-11eb-9bf3-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-12'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following detection identifies Microsoft Excel spawning Windows Script
|
||||
Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and
|
||||
not default with Excel.exe. Excel.exe will generally be found in the following path
|
||||
`C:\Program Files\Microsoft Office\root\Office16` (version will vary). `cscript.exe`
|
||||
or `wscript.exe` default location is `c:\windows\system32\` or c:windows\syswow64`.
|
||||
`cscript.exe` or `wscript.exe` spawning from Excel.exe is common for a spearphishing
|
||||
attachment and is actively used. Albeit, the command-line executed will most likely
|
||||
be obfuscated and captured via another detection. During triage, review parallel
|
||||
processes and identify any files that may have been written. Review the reputation
|
||||
of the remote destination and block accordingly.
|
||||
search: '| tstats `security_content_summariesonly` count values(Processes.process)
|
||||
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.parent_process_name="excel.exe" Processes.process_name IN ("cscript.exe",
|
||||
"wscript.exe") by Processes.parent_process Processes.process_name Processes.user
|
||||
Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
|
||||
| `excel_spawning_windows_script_host_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
known_false_positives: False positives should be limited, but if any are present,
|
||||
filter as needed. In some instances, `cscript.exe` is used for legitimate business
|
||||
practices.
|
||||
references:
|
||||
- https://app.any.run/tasks/8ecfbc29-03d0-421c-a5bf-3905d29192a2/
|
||||
- https://attack.mitre.org/techniques/T1566/001/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1003.002
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest
|
||||
- user
|
||||
- parent_process_id
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,54 @@
|
||||
name: Excessive Usage of NSLOOKUP App
|
||||
id: 0a69fdaa-a2b8-11eb-b16d-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-21'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: this search is to detect potential DNS exfiltration using nslookup application.
|
||||
This technique are seen in couple of malware and APT group to exfiltrated collected
|
||||
data in a infected machine or infected network. This detection is looking for unique
|
||||
use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are
|
||||
commonly used by attacker and also the retry parameter which is designed to query
|
||||
C2 DNS multiple tries.
|
||||
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
|
||||
values(Processes.process_id) as process_id values(Processes.parent_process) as parent_process
|
||||
count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where Processes.process_name = "nslookup.exe" by Processes.dest Processes.user Processes.process_name
|
||||
| where count >= 30 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`| `excessive_usage_of_nslookup_app_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances of nslookup.exe may be used.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
|
||||
- https://www.varonis.com/blog/dns-tunneling/
|
||||
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Suspicious DNS Traffic
|
||||
- Dynamic DNS
|
||||
- Command and Control
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1048
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.process_id
|
||||
security_domain: endpoint
|
||||
@@ -24,6 +24,7 @@ references: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows File Extension and Association Abuse
|
||||
- Masquerading - Rename System Utilities
|
||||
asset_type: Endpoint
|
||||
automated_detection_testing: passed
|
||||
cis20:
|
||||
|
||||
@@ -0,0 +1,55 @@
|
||||
name: GPUpdate with no Command Line Arguments with Network
|
||||
id: 2c853856-a140-11eb-a5b5-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-19'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies gpupdate.exe with no command line arguments
|
||||
and with a network connection. It is unusual for gpupdate.exe to execute with no
|
||||
command line arguments present. This particular behavior is common with malicious
|
||||
software, including Cobalt Strike. During investigation, triage any network connections
|
||||
and parallel processes. Identify any suspicious module loads related to credential
|
||||
dumping or file writes. gpupdate.exe is natively found in C:\Windows\system32 and
|
||||
C:\Windows\syswow64.
|
||||
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
|
||||
where Processes.process_name=gpupdate.exe by _time span=1h Processes.process_id
|
||||
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| regex process="(gpupdate\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly`
|
||||
count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id
|
||||
Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC]
|
||||
| table _time dest parent_process_name process_name process_path process process_id
|
||||
connection_to_CNC dest_port | `gpupdate_with_no_command_line_arguments_with_network_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
known_false_positives: Limited false positives may be present in small environments.
|
||||
Tuning may be required based on parent process.
|
||||
references:
|
||||
- https://raw.githubusercontent.com/xx0hcd/Malleable-C2-Profiles/0ef8cf4556e26f6d4190c56ba697c2159faa5822/crimeware/trick_ryuk.profile
|
||||
- https://blog.cobaltstrike.com/2021/02/09/learn-pipe-fitting-for-all-of-your-offense-projects/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Cobalt Strike
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventID
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest_port
|
||||
- process_path
|
||||
security_domain: endpoint
|
||||
@@ -26,6 +26,7 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- Malicious Powershell
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1569.002/atomic_red_team/windows-system.log
|
||||
kill_chain_phases:
|
||||
@@ -46,4 +47,3 @@ tags:
|
||||
- Service_Account
|
||||
- user
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
|
||||
@@ -0,0 +1,52 @@
|
||||
name: Office Application Spawn rundll32 process
|
||||
id: 958751e4-9c5f-11eb-b103-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-13'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: this detection was designed to identifies suspicious spawned process
|
||||
of known MS office application due to macro or malicious code. this technique can
|
||||
be seen in so many malware like trickbot that used MS office as its weapon or attack
|
||||
vector to initially infect the machines.
|
||||
search: '| tstats `security_content_summariesonly` count values(Processes.process)
|
||||
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
|
||||
where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name
|
||||
= "excel.exe" OR Processes.parent_process_name = "powerpnt.exe")
|
||||
Processes.process_name=rundll32.exe by Processes.parent_process
|
||||
Processes.process_name Processes.process_id Processes.process_guid Processes.user
|
||||
Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
|
||||
| `office_application_spawn_rundll32_process_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://any.run/malware-trends/trickbot
|
||||
- https://any.run/report/47561b4e949041eff0a0f4693c59c81726591779fe21183ae9185b5eb6a69847/aba3722a-b373-4dae-8273-8730fb40cdbe
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
- Trickbot
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1566.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- Processes.process
|
||||
- Processes.parent_process_name
|
||||
- _time
|
||||
- Processes.process_name
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.process_id
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,59 @@
|
||||
name: Office Document Creating Schedule Task
|
||||
id: cc8b7b74-9d0f-11eb-8342-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-14'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: this search detects a potential malicious office document that create
|
||||
schedule task entry through macro VBA api or through loading taskschd.dll. This
|
||||
technique was seen in so many malicious macro malware that create persistence ,
|
||||
beaconing using task schedule malware entry The search will return the first time
|
||||
and last time the task was registered, as well as the `Command` to be executed,
|
||||
`Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe
|
||||
is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following
|
||||
DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`.
|
||||
If found loaded by another process, it's possible a scheduled task is being registered
|
||||
within that process context in memory. Upon triage, identify the task scheduled
|
||||
source. Was it schtasks.exe or via TaskService? Review the job created and the Command
|
||||
to be executed. Capture any artifacts on disk and review. Identify any parallel
|
||||
processes within the same timeframe to identify source.'
|
||||
search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
|
||||
ImageLoaded = "*\\taskschd.dll" | stats min(_time) as firstTime
|
||||
max(_time) as lastTime values(ImageLoaded) as AllImageLoaded count by Computer EventCode
|
||||
Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)` |
|
||||
`security_content_ctime(lastTime)` | `office_document_creating_schedule_task_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
|
||||
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
Also be sure to include those monitored dll to your own sysmon config.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/
|
||||
- https://redcanary.com/threat-detection-report/techniques/scheduled-task-job/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1566.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- ImageLoaded
|
||||
- AllImageLoaded
|
||||
- Computer
|
||||
- EventCode
|
||||
- Image
|
||||
- process_name
|
||||
- ProcessId
|
||||
- ProcessGuid
|
||||
- _time
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,53 @@
|
||||
name: Office Document Executing Macro Code
|
||||
id: b12c89bc-9d06-11eb-a592-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-14'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: this detection was designed to identifies suspicious office documents
|
||||
that using macro code. Macro code is known to be one of the prevalent weaponization
|
||||
or attack vector of threat actor. This malicious macro code is embed to a office
|
||||
document as an attachment that may execute malicious payload, download malware payload
|
||||
or other malware component. It is really good practice to disable macro by default
|
||||
to avoid automatically execute macro code while opening or closing a office document
|
||||
files.
|
||||
search: '`sysmon` EventCode=7 process_name IN ("WINWORD.EXE", "EXCEL.EXE", "POWERPNT.EXE")
|
||||
ImageLoaded IN ("*\\VBE7INTL.DLL","*\\VBE7.DLL", "*\\VBEUI.DLL")
|
||||
| stats min(_time) as firstTime max(_time) as lastTime values(ImageLoaded) as AllImageLoaded
|
||||
count by Computer EventCode Image process_name ProcessId ProcessGuid | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `office_document_executing_macro_code_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name and ImageLoaded (Like sysmon EventCode 7) from your endpoints.
|
||||
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
|
||||
Also be sure to include those monitored dll to your own sysmon config.
|
||||
known_false_positives: Normal Office Document macro use for automation
|
||||
references:
|
||||
- https://www.joesandbox.com/analysis/386500/0/html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
- Trickbot
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1566.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- ImageLoaded
|
||||
- AllImageLoaded
|
||||
- Computer
|
||||
- EventCode
|
||||
- Image
|
||||
- process_name
|
||||
- ProcessId
|
||||
- ProcessGuid
|
||||
- _time
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,52 @@
|
||||
name: Office Document Spawned Child Process To Download
|
||||
id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3
|
||||
version: 1
|
||||
date: '2021-04-16'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: this search is to detect potential malicious office document executing
|
||||
lolbin child process to download payload or other malware. Since most of the attacker
|
||||
abused the capability of office document to execute living on land application to
|
||||
blend it to the normal noise in the infected machine to cover its track.
|
||||
search: '`sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe",
|
||||
"excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName
|
||||
IN("*\\firefox.exe", "*\\chrome.exe","*\\iexplore.exe","*\\msedge.exe")) | stats
|
||||
min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name
|
||||
parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode
|
||||
| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances office application and browser may be
|
||||
used.
|
||||
known_false_positives: default browser not in the filter list
|
||||
references:
|
||||
- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/#
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/datasets2/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1566.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- parent_process_name
|
||||
- process_name
|
||||
- parent_process
|
||||
- cmdline
|
||||
- process_id
|
||||
- OriginalFileName
|
||||
- ProcessGuid
|
||||
- Computer
|
||||
- EventCode
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,54 @@
|
||||
name: Office Product Spawning BITSAdmin
|
||||
id: e8c591f4-a6d7-11eb-8cf7-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-26'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following detection identifies the latest behavior utilized by different
|
||||
malware families (including TA551, IcedID). This detection identifies any Windows
|
||||
Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line
|
||||
of `bitsadmin.exe` will contain a URL to a remote destination or similar command-line
|
||||
arguments as transfer, Download, priority, Foreground. In addition, Threat Research
|
||||
has released a detections identifying suspicious use of `bitsadmin.exe`. In this
|
||||
instance, we narrow our detection down to the Office suite as a parent process.
|
||||
During triage, review all file modifications. Capture and analyze any artifacts
|
||||
on disk. The Office Product, or `bitsadmin.exe` will have reached out to a remote
|
||||
destination, capture and block the IPs or domain. Review additional parallel processes
|
||||
for further activity.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
|
||||
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=bitsadmin.exe
|
||||
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_bitsadmin_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
known_false_positives: No false positives known. Filter as needed.
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1197/T1197.md
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1566.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest
|
||||
- user
|
||||
- parent_process_id
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,54 @@
|
||||
name: Office Product Spawning CertUtil
|
||||
id: 6925fe72-a6d5-11eb-9e17-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-26'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following detection identifies the latest behavior utilized by different
|
||||
malware families (including TA551, IcedID). This detection identifies any Windows
|
||||
Office Product spawning `certutil.exe`. In malicious instances, the command-line
|
||||
of `certutil.exe` will contain a URL to a remote destination. In addition, Threat
|
||||
Research has released a detections identifying suspicious use of `certutil.exe`.
|
||||
In this instance, we narrow our detection down to the Office suite as a parent process.
|
||||
During triage, review all file modifications. Capture and analyze any artifacts
|
||||
on disk. The Office Product, or `certutil.exe` will have reached out to a remote
|
||||
destination, capture and block the IPs or domain. Review additional parallel processes
|
||||
for further activity.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
|
||||
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=certutil.exe
|
||||
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_certutil_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
known_false_positives: No false positives known. Filter as needed.
|
||||
references:
|
||||
- https://redcanary.com/threat-detection-report/threats/TA551/
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1105/T1105.md
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1566.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest
|
||||
- user
|
||||
- parent_process_id
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,53 @@
|
||||
name: Office Product Spawning MSHTA
|
||||
id: 6078fa20-a6d2-11eb-b662-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-26'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following detection identifies the latest behavior utilized by different
|
||||
malware families (including TA551, IcedID). This detection identifies any Windows
|
||||
Office Product spawning `mshta.exe`. In malicious instances, the command-line of
|
||||
`mshta.exe` will contain the `hta` file locally, or a URL to the remote destination.
|
||||
In addition, Threat Research has released a detections identifying suspicious use
|
||||
of `mshta.exe`. In this instance, we narrow our detection down to the Office suite
|
||||
as a parent process. During triage, review all file modifications. Capture and analyze
|
||||
any artifacts on disk. The Office Product, or `mshta.exe` will have reached out
|
||||
to a remote destination, capture and block the IPs or domain. Review additional
|
||||
parallel processes for further activity.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
|
||||
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=mshta.exe
|
||||
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_mshta_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
known_false_positives: No false positives known. Filter as needed.
|
||||
references:
|
||||
- https://redcanary.com/threat-detection-report/threats/TA551/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1566.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest
|
||||
- user
|
||||
- parent_process_id
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,57 @@
|
||||
name: Office Product Spawning Rundll32 with no DLL
|
||||
id: c661f6be-a38c-11eb-be57-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-22'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following detection identifies the latest behavior utilized by IcedID
|
||||
malware family. This detection identifies any Windows Office Product spawning `rundll32.exe`
|
||||
without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe`
|
||||
will look like `rundll32 ..\oepddl.igk2,DllRegisterServer`. In addition, Threat
|
||||
Research has released a detection identifying the use of `DllRegisterServer` on
|
||||
the command-line of `rundll32.exe`. In this instance, we narrow our detection down
|
||||
to the Office suite as a parent process. During triage, review all file modifications.
|
||||
Capture and analyze the `DLL` that was dropped to disk. The Office Product will
|
||||
have reached out to a remote destination, capture and block the IPs or domain. Review
|
||||
additional parallel processes for further activity.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
|
||||
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=rundll32.exe
|
||||
(Processes.process!=*.dll*) by Processes.dest Processes.user Processes.parent_process
|
||||
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
|
||||
| `office_product_spawning_rundll32_with_no_dll_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
known_false_positives: False positives should be limited, but if any are present,
|
||||
filter as needed.
|
||||
references:
|
||||
- https://www.joesandbox.com/analysis/395471/0/html
|
||||
- https://app.any.run/tasks/cef4b8ba-023c-4b3b-b2ef-6486a44f6ed9/
|
||||
- https://any.run/malware-trends/icedid
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_icedid.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1566.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest
|
||||
- user
|
||||
- parent_process_id
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,55 @@
|
||||
name: Office Product Spawning Wmic
|
||||
id: ffc236d6-a6c9-11eb-95f1-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-26'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following detection identifies the latest behavior utilized by Ursnif
|
||||
malware family. This detection identifies any Windows Office Product spawning `wmic.exe`.
|
||||
In malicious instances, the command-line of `wmic.exe` will contain `wmic process
|
||||
call create`. In addition, Threat Research has released a detection identifying
|
||||
the use of `wmic process call create` on the command-line of `wmic.exe`. In this
|
||||
instance, we narrow our detection down to the Office suite as a parent process.
|
||||
During triage, review all file modifications. Capture and analyze any artifacts
|
||||
on disk. The Office Product, or `wmic.exe` will have reached out to a remote destination,
|
||||
capture and block the IPs or domain. Review additional parallel processes for further
|
||||
activity.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name
|
||||
IN ("winword.exe","excel.exe","powerpnt.exe","mspub.exe","visio.exe") Processes.process_name=wmic.exe
|
||||
by Processes.dest Processes.user Processes.parent_process Processes.process_name
|
||||
Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
|
||||
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `office_product_spawning_wmic_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
known_false_positives: No false positives known. Filter as needed.
|
||||
references:
|
||||
- https://app.any.run/tasks/fb894ab8-a966-4b72-920b-935f41756afd/
|
||||
- https://attack.mitre.org/techniques/T1047/
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.md
|
||||
tags:
|
||||
analytic_story:
|
||||
- Spearphishing Attachments
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1566.001/macro/windows-sysmon_macros.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1566.001
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest
|
||||
- user
|
||||
- parent_process_id
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,53 @@
|
||||
name: Powershell Remote Thread To Known Windows Process
|
||||
id: ec102cb2-a0f5-11eb-9b38-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-19'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: this search is designed to detect suspicious powershell process that
|
||||
tries to inject code and to known/critical windows process and execute it using
|
||||
CreateRemoteThread. This technique is seen in several malware like trickbot and
|
||||
offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to
|
||||
execute reverse shell to c2 and download another payload
|
||||
search: '`sysmon` EventCode = 8 process_name IN ("powershell_ise.exe", "powershell.exe")
|
||||
TargetImage IN ("*\\svchost.exe","*\\csrss.exe" "*\\gpupdate.exe", "*\\explorer.exe","*\\services.exe","*\\winlogon.exe","*\\smss.exe","*\\wininit.exe","*\\userinit.exe","*\\spoolsv.exe","*\\taskhost.exe")
|
||||
| stats min(_time) as firstTime max(_time) as lastTime count by SourceImage process_name
|
||||
SourceProcessId SourceProcessGuid TargetImage TargetProcessId NewThreadId StartAddress
|
||||
Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `powershell_remote_thread_to_known_windows_process_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, Create Remote thread from your endpoints. If you are
|
||||
using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter
|
||||
known instances of create remote thread may be used.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://thedfirreport.com/2021/01/11/trickbot-still-alive-and-well/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Trickbot
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- SourceImage
|
||||
- process_name
|
||||
- SourceProcessId
|
||||
- SourceProcessGuid
|
||||
- TargetImage
|
||||
- TargetProcessId
|
||||
- NewThreadId
|
||||
- StartAddress
|
||||
- Computer
|
||||
- EventCode
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/infection/windows-sysmon.log
|
||||
@@ -31,6 +31,7 @@ references:
|
||||
tags:
|
||||
analytic_story:
|
||||
- BITS Jobs
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1197/atomic_red_team/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
@@ -49,4 +50,3 @@ tags:
|
||||
- Processes.user
|
||||
- Processes.dest
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
|
||||
@@ -30,7 +30,7 @@ references:
|
||||
- https://www.trendmicro.com/en_us/research/17/e/rising-trend-attackers-using-lnk-files-download-malware.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Phishing Payloads
|
||||
- Spearphishing Attachments
|
||||
asset_type: Endpoint
|
||||
automated_detection_testing: passed
|
||||
cis20:
|
||||
|
||||
@@ -0,0 +1,58 @@
|
||||
name: Rundll32 with no Command Line Arguments with Network
|
||||
id: 35307032-a12d-11eb-835f-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-19'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies rundll32.exe with no command line arguments
|
||||
and performing a network connection. It is unusual for rundll32.exe to execute with
|
||||
no command line arguments present. This particular behavior is common with malicious
|
||||
software, including Cobalt Strike. During investigation, triage any network connections
|
||||
and parallel processes. Identify any suspicious module loads related to credential
|
||||
dumping or file writes. Rundll32.exe is natively found in C:\Windows\system32 and
|
||||
C:\Windows\syswow64.
|
||||
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
|
||||
where Processes.process_name=rundll32.exe by _time span=1h Processes.process_id
|
||||
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| regex process="(rundll32\.exe.{0,4}$)" | join process_id [| tstats `security_content_summariesonly`
|
||||
count FROM datamodel=Endpoint.Ports where Ports.dest_port !="0" by Ports.process_id
|
||||
Ports.dest Ports.dest_port| `drop_dm_object_name(Ports)` | rename dest as connection_to_CNC]
|
||||
| table _time dest parent_process_name process_name process_path process process_id
|
||||
connection_to_CNC dest_port | `rundll32_with_no_command_line_arguments_with_network_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` and `port` node.
|
||||
known_false_positives: Although unlikely, some legitimate applications may use a moved
|
||||
copy of rundll32, triggering a false positive.
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1218/011/
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.011/T1218.011.md
|
||||
- https://lolbas-project.github.io/lolbas/Binaries/Rundll32
|
||||
- https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Suspicious Rundll32 Activity
|
||||
- Cobalt Strike
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1218.011
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventID
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest_port
|
||||
- process_path
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,56 @@
|
||||
name: Schedule Task with HTTP Command Arguments
|
||||
id: 523c2684-a101-11eb-916b-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-19'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following query utilizes Windows Security EventCode 4698, `A scheduled
|
||||
task was created`, to identify suspicious tasks registered on Windows either via
|
||||
schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry
|
||||
of malware or attack that uses lolbin to download other file or payload to the infected
|
||||
machine. The search will return the first time and last time the task was registered,
|
||||
as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
|
||||
it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and
|
||||
`C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService
|
||||
is launched -`taskschd.dll`. If found loaded by another process, it is possible
|
||||
a scheduled task is being registered within that process context in memory. Upon
|
||||
triage, identify the task scheduled source. Was it schtasks.exe or via TaskService?
|
||||
Review the job created and the Command to be executed. Capture any artifacts on
|
||||
disk and review. Identify any parallel processes within the same timeframe to identify
|
||||
source.'
|
||||
search: '`wineventlog_security` EventCode=4698 | xmlkv Message| search Arguments IN
|
||||
("*http*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
|
||||
Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `schedule_task_with_http_command_arguments_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
|
||||
filter known instances of Task schedule used in your environment.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://app.any.run/tasks/92d7ef61-bfd7-4c92-bc15-322172b4ebec/
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1053.005/tasksched/windows-security.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1053
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- dest
|
||||
- Task_Name
|
||||
- Command
|
||||
- Author
|
||||
- Enabled
|
||||
- Hidden
|
||||
- Arguments
|
||||
security_domain: endpoint
|
||||
@@ -0,0 +1,58 @@
|
||||
name: Schedule Task with Rundll32 Command Trigger
|
||||
id: 75b00fd8-a0ff-11eb-8b31-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-19'
|
||||
author: Teoderick Contreras, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following query utilizes Windows Security EventCode 4698, `A scheduled
|
||||
task was created`, to identify suspicious tasks registered on Windows either via
|
||||
schtasks.exe OR TaskService with a command to be executed with a Rundll32. This
|
||||
technique is common in new trickbot that uses rundll32 to load is trickbot downloader.
|
||||
The search will return the first time and last time the task was registered, as
|
||||
well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether
|
||||
it is `Hidden` or not.\ schtasks.exe is natively found in `C:\Windows\system32`
|
||||
and `C:\Windows\syswow64`.\ The following DLL(s) are loaded when schtasks.exe or
|
||||
TaskService is launched -`taskschd.dll`. If found loaded by another process, it
|
||||
is possible a scheduled task is being registered within that process context in
|
||||
memory.\ Upon triage, identify the task scheduled source. Was it schtasks.exe or
|
||||
via TaskService? Review the job created and the Command to be executed. Capture
|
||||
any artifacts on disk and review. Identify any parallel processes within the same
|
||||
timeframe to identify source.'
|
||||
search: '`wineventlog_security` EventCode=4698 | xmlkv Message | search Command IN
|
||||
("*rundll32*") | stats count min(_time) as firstTime max(_time) as lastTime by dest,
|
||||
Task_Name, Command, Author, Enabled, Hidden, Arguments | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)` | `schedule_task_with_rundll32_command_trigger_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the task schedule (Exa. Security Log EventCode 4698) endpoints. Tune and
|
||||
filter known instances of Task schedule used in your environment.
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://labs.vipre.com/trickbot-and-its-modules/
|
||||
- https://blog.whitehat.eu/2019/05/incident-trickbot-ryuk-2.html
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
- Trickbot
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1053
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- dest
|
||||
- Task_Name
|
||||
- Command
|
||||
- Author
|
||||
- Enabled
|
||||
- Hidden
|
||||
- Arguments
|
||||
security_domain: endpoint
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/trickbot/tasksched/windows-security.log
|
||||
@@ -0,0 +1,53 @@
|
||||
name: SearchProtocolHost with no Command Line with Network
|
||||
id: b690df8c-a145-11eb-a38b-acde48001122
|
||||
version: 1
|
||||
date: '2021-04-19'
|
||||
author: Michael Haag, Splunk
|
||||
type: batch
|
||||
datamodel:
|
||||
- Endpoint
|
||||
description: The following analytic identifies searchprotocolhost.exe with no command
|
||||
line arguments and with a network connection. It is unusual for searchprotocolhost.exe
|
||||
to execute with no command line arguments present. This particular behavior is common
|
||||
with malicious software, including Cobalt Strike. During investigation, identify
|
||||
any network connections and parallel processes. Identify any suspicious module loads
|
||||
related to credential dumping or file writes. searchprotocolhost.exe is natively
|
||||
found in C:\Windows\system32 and C:\Windows\syswow64.
|
||||
search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes
|
||||
where Processes.process_name=searchprotocolhost.exe by _time span=1h Processes.process_id
|
||||
Processes.process_name Processes.dest Processes.process_path Processes.process Processes.parent_process_name
|
||||
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| regex process="(searchprotocolhost\.exe.{0,4}$)" | join process_id [| tstats
|
||||
`security_content_summariesonly` count FROM datamodel=Endpoint.Ports where Ports.dest_port
|
||||
!="0" by Ports.process_id Ports.dest Ports.dest_port | `drop_dm_object_name(Ports)`
|
||||
| rename dest as connection_to_CNC] | table _time dest parent_process_name process_name
|
||||
process_path process process_id connection_to_CNC dest_port | `searchprotocolhost_with_no_command_line_with_network_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` and `ports` node.
|
||||
known_false_positives: Limited false positives may be present in small environments.
|
||||
Tuning may be required based on parent process.
|
||||
references:
|
||||
- https://github.com/fireeye/red_team_tool_countermeasures/blob/master/rules/PGF/supplemental/hxioc/SUSPICIOUS%20EXECUTION%20OF%20SEARCHPROTOCOLHOST%20(METHODOLOGY).ioc
|
||||
tags:
|
||||
analytic_story:
|
||||
- Cobalt Strike
|
||||
automated_detection_testing: passed
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1055/cobalt_strike/windows-sysmon_searchprotocolhost.log
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- process_name
|
||||
- process_id
|
||||
- parent_process_name
|
||||
- dest_port
|
||||
- process_path
|
||||
security_domain: endpoint
|
||||
+2
-2
@@ -1,4 +1,4 @@
|
||||
name: Attempt To Set Default PowerShell Execution Policy To Unrestricted or Bypass
|
||||
name: Set Default PowerShell Execution Policy To Unrestricted or Bypass
|
||||
id: c2590137-0b08-4985-9ec5-6ae23d92f63d
|
||||
version: 6
|
||||
date: '2020-11-06'
|
||||
@@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime
|
||||
Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted
|
||||
OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name
|
||||
Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`|`security_content_ctime(lastTime)`
|
||||
| `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
|
||||
| `set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`'
|
||||
how_to_implement: You must be ingesting data that records process activity from your
|
||||
hosts to populate the Endpoint data model in the Registry node. You must also be
|
||||
ingesting logs with the fields registry_path, registry_key_name, and registry_value_name
|
||||
@@ -7,17 +7,15 @@ type: streaming
|
||||
datamodel: []
|
||||
description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
|
||||
attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null) | where cmd_line
|
||||
!= null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
|
||||
/(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
|
||||
null) | where cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true
|
||||
OR match_regex(cmd_line, /(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
|
||||
OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -51,7 +49,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
@@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -53,7 +53,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
@@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -41,7 +41,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
|
||||
@@ -18,7 +18,8 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
|
||||
OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true OR match_regex(cmd_line,
|
||||
/(?i)HKEY_LOCAL_MACHINE\\SAM/)=true OR match_regex(cmd_line, /(?i)HKEY_LOCAL_MACHINE\\System/)=true
|
||||
) | eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
|
||||
dest_user_id), body = "TBD" | into write_ssa_detected_events(); '
|
||||
dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
|
||||
| into write_ssa_detected_events(); '
|
||||
how_to_implement: You must be ingesting windows endpoint data that tracks process
|
||||
activity, including parent-child relationships from your endpoints.
|
||||
known_false_positives: None identified.
|
||||
@@ -39,7 +40,7 @@ tags:
|
||||
nist:
|
||||
- DE.CM
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _time
|
||||
|
||||
@@ -26,7 +26,8 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -49,7 +50,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
|
||||
@@ -27,7 +27,8 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -50,7 +51,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
|
||||
@@ -24,7 +24,8 @@ search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
|
||||
"parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -46,7 +47,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
|
||||
@@ -22,7 +22,8 @@ search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -44,7 +45,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
|
||||
@@ -20,7 +20,7 @@ search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -42,7 +42,7 @@ tags:
|
||||
- PR.IP
|
||||
- PR.AC
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
@@ -18,7 +18,7 @@ search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -40,7 +40,7 @@ tags:
|
||||
- PR.IP
|
||||
- PR.AC
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
@@ -22,7 +22,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -45,7 +45,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
@@ -23,7 +23,8 @@ search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name,
|
||||
"parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: Although unlikely, using debuggers this way may be indicative
|
||||
@@ -49,7 +50,7 @@ tags:
|
||||
- PR.IP
|
||||
- PR.AC
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- parent_process_name
|
||||
|
||||
@@ -20,7 +20,8 @@ search: ' | from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: Although unlikely, using debuggers this way may be indicative
|
||||
@@ -45,7 +46,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _time
|
||||
|
||||
@@ -23,7 +23,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -46,7 +46,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
@@ -14,7 +14,7 @@ search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_eve
|
||||
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)) |
|
||||
where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(machine),
|
||||
body = "TBD" | into write_ssa_detected_events();'
|
||||
body=create_map(["process_name", process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting endpoint data that tracks process activity,
|
||||
including Windows command line logging. You can see how we test this with [Event
|
||||
Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
|
||||
@@ -36,7 +36,7 @@ tags:
|
||||
nist:
|
||||
- DE.CM
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _tenant
|
||||
|
||||
@@ -14,8 +14,10 @@ search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_
|
||||
"service_id") | where EventCode="4769" AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17"
|
||||
| first_time_event input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
|
||||
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
|
||||
| eval start_time=_time, end_time=_time, body="TBD", entities="TBD" | select start_time,
|
||||
end_time, entities, body | into write_null(); '
|
||||
| eval start_time=_time, end_time=_time, body=create_map(["EventCode", EventCode,
|
||||
"ServiceName", ServiceName, "TicketOptions", TicketOptions, "TicketEncryptionType",
|
||||
TicketEncryptionType]), entities="TBD" | select start_time, end_time, entities,
|
||||
body | into write_null(); '
|
||||
how_to_implement: The test data is converted from Windows Security Event logs generated
|
||||
from Attach Range simulation and used in SPL search and extended to SPL2
|
||||
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
|
||||
@@ -35,7 +37,7 @@ tags:
|
||||
nist:
|
||||
- DE.CM
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- service_name
|
||||
- _time
|
||||
|
||||
@@ -20,7 +20,8 @@ search: ' | from read_ssa_enriched_events()
|
||||
AND authentication_method="seclogo")
|
||||
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
|
||||
dest_user_id), body="TBD" | into write_ssa_detected_events();'
|
||||
dest_user_id), body=create_map(["authentication_type", authentication_type, "authentication_method",
|
||||
authentication_method]) | into write_ssa_detected_events();'
|
||||
how_to_implement: The test data is converted from Windows Security Event logs generated
|
||||
from Attach Range simulation and used in SPL search and extended to SPL2
|
||||
known_false_positives: Legitimate logon activity by authorized NTLM systems may be
|
||||
@@ -44,7 +45,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- signature_id
|
||||
- authentication_type
|
||||
|
||||
@@ -22,7 +22,8 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
|
||||
""), /.* \/[cC] .*/)=true | select cmd_line, cmd_line_norm, timestamp, dest_device_id,
|
||||
dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
|
||||
dest_user_id), body = "TBD" | into write_ssa_detected_events();'
|
||||
dest_user_id), body=create_map(["cmd_line", cmd_line, "process_name", process_name])
|
||||
| into write_ssa_detected_events();'
|
||||
how_to_implement: You must be populating the endpoint data model for SSA and specifically
|
||||
the process_name and the process fields
|
||||
known_false_positives: Legitimate programs can also use command-line arguments to
|
||||
@@ -48,7 +49,7 @@ tags:
|
||||
- DE.CM
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _time
|
||||
|
||||
@@ -20,7 +20,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -46,7 +46,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
@@ -15,7 +15,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -38,7 +38,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
+2
-2
@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -40,7 +40,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -39,7 +39,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
+2
-2
@@ -18,7 +18,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -43,7 +43,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
+2
-2
@@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -44,7 +44,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
+2
-2
@@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -45,7 +45,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -40,7 +40,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
+2
-2
@@ -19,7 +19,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map(["cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -44,7 +44,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
+2
-2
@@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -53,7 +53,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
|
||||
+2
-2
@@ -17,7 +17,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -39,7 +39,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
|
||||
@@ -24,7 +24,8 @@ search: '| from read_ssa_enriched_events()
|
||||
OR field0="java.exe" OR field0="powershell.exe"
|
||||
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
|
||||
dest_user_id), body="TBD" | into write_ssa_detected_events();'
|
||||
dest_user_id), body=create_map([ "process_name", process_name, "parent_process_name",
|
||||
parent_process_name]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting sysmon logs. This search has been modified
|
||||
to process raw sysmon data from attack_range's nxlogs on DSP.
|
||||
known_false_positives: There are circumstances where an application may legitimately
|
||||
@@ -47,7 +48,7 @@ tags:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- parent_process_name
|
||||
|
||||
+2
-2
@@ -28,7 +28,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -54,7 +54,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
|
||||
+2
-2
@@ -37,7 +37,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -60,7 +60,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
|
||||
@@ -16,7 +16,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -39,7 +39,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
|
||||
+2
-2
@@ -27,7 +27,7 @@ search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body = "TBD" | into write_ssa_detected_events();'
|
||||
"string", null)), body=create_map([ "cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
known_false_positives: None identified.
|
||||
@@ -52,7 +52,7 @@ tags:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
product:
|
||||
- UEBA for Security Cloud
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user