From db3605c7535b43bb0246ffbc5a41a3dc76cce8bb Mon Sep 17 00:00:00 2001 From: d1vious Date: Fri, 18 Feb 2022 14:26:17 -0500 Subject: [PATCH 1/5] adding ssa detection --- ...ting_interpreter_outbound_ldap_traffic.yml | 82 +++++++++++++++++++ ...rpreter_outbound_ldap_traffic.yml.test.yml | 10 +++ 2 files changed, 92 insertions(+) create mode 100644 detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml create mode 100644 tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml diff --git a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml new file mode 100644 index 0000000000..c9ff63df3d --- /dev/null +++ b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -0,0 +1,82 @@ +name: Windows Command and Scripting Interpreter Outbound LDAP Traffic +id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449 +version: 1 +date: '2022-02-17' +author: Jose Hernandez, Michael Haag, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. +Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. +This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like + (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on network traffic, specifically data that populates the Network_Traffic datamodel. + To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic events. +known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. +Please check those servers to verify if the activity is legitimate. +references: +- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ +- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html +- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a +tags: + analytic_story: + - Log4Shell CVE-2021-44228 + cis20: + - CIS 13 + confidence: 70 + context: + - Scope:Outbound + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log + impact: 50 + kill_chain_phases: + - Execution + message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$ + mitre_attack_id: + - T1059 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + risk_severity: low + security_domain: network diff --git a/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml b/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml new file mode 100644 index 0000000000..b8276b1001 --- /dev/null +++ b/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml @@ -0,0 +1,10 @@ +name: Windows Powershell DownloadFile Unit Test +tests: +- name: Windows Powershell DownloadFile + file: endpoint/ssa___windows_powershell_downloadfile.yml + pass_condition: '@count_gt(0)' + description: Test Windows Powershell DownloadFile detections + attack_data: + - file_name: downloadfile_windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log + source: WinEventLog:Security From ba97944d046162d3f42a72b0dccd74c54f3b3be8 Mon Sep 17 00:00:00 2001 From: d1vious Date: Fri, 18 Feb 2022 17:39:23 -0500 Subject: [PATCH 2/5] adding ldap detection --- ...ting_interpreter_outbound_ldap_traffic.yml | 11 +- ...ting_interpreter_outbound_ldap_traffic.yml | 103 ++++++++++++++++++ ...rpreter_outbound_ldap_traffic.yml.test.yml | 10 -- ...interpreter_outbound_ldap_traffic.test.yml | 11 ++ 4 files changed, 118 insertions(+), 17 deletions(-) create mode 100644 dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml delete mode 100644 tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml create mode 100644 tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml diff --git a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index c9ff63df3d..612039120b 100644 --- a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -1,4 +1,4 @@ -name: Windows Command and Scripting Interpreter Outbound LDAP Traffic +name: TCP Command and Scripting Interpreter Outbound LDAP Traffic id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449 version: 1 date: '2022-02-17' @@ -6,9 +6,7 @@ author: Jose Hernandez, Michael Haag, Splunk type: Anomaly datamodel: - Endpoint_Processes -description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. -Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. -This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. +description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), @@ -26,8 +24,7 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map how_to_implement: To successfully implement this search you need to be ingesting information on network traffic, specifically data that populates the Network_Traffic datamodel. To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic events. -known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. -Please check those servers to verify if the activity is legitimate. +known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. Please check those servers to verify if the activity is legitimate. references: - https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ - https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html @@ -43,7 +40,7 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt impact: 50 kill_chain_phases: - Execution diff --git a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml new file mode 100644 index 0000000000..5d7bb37e09 --- /dev/null +++ b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -0,0 +1,103 @@ +author: Jose Hernandez, Michael Haag, Splunk +datamodel: +- Endpoint_Processes +date: '2022-02-17' +description: Malicious actors often abuse misconfigured LDAP servers or applications + that use the LDAP servers in organizations. Outbound LDAP traffic should not be + allowed outbound through your perimeter firewall. This search will help determine + if you have any LDAP connections to IP addresses outside of private (RFC1918) address + space. +how_to_implement: To successfully implement this search you need to be ingesting information + on network traffic, specifically data that populates the Network_Traffic datamodel. + To develop this analytic we used specifically Zeek/Bro conn.log and PAN Traffic + events. +id: 4d16a90c-d1a9-4d17-8156-d0db0c73c449 +known_false_positives: Unknown at this moment. Outbound LDAP traffic should not be + allowed outbound through your perimeter firewall. Please check those servers to + verify if the activity is legitimate. +name: TCP Command and Scripting Interpreter Outbound LDAP Traffic +product: +- Splunk Behavioral Analytics +references: +- https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/ +- https://www.splunk.com/en_us/blog/security/simulating-detecting-and-responding-to-log4shell-with-splunk.html +- https://www.cisa.gov/uscert/ncas/alerts/aa21-356a +risk_message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting + to dest ip $dest_ip$ +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like + (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +tags: + analytic_story: + - Log4Shell CVE-2021-44228 + cis20: + - CIS 13 + confidence: 70 + context: + - Scope:Outbound + - Source:Endpoint + - Stage:Execution + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + impact: 50 + kill_chain_phases: + - Execution + message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting + to dest ip $dest_ip$ + mitre_attack_id: + - T1059 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + role: + - Victim + type: User + - name: dest_device_id + role: + - Victim + type: Hostname + - name: parent_process_name + role: + - Parent Process + type: Parent Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + risk_severity: low + security_domain: network +test: + name: TCP Command and Scripting Interpreter Outbound LDAP Traffic Unit Test + tests: + - attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + file_name: pantraffic.txt + source: pan:traffic + sourcetype: pan:traffic + description: Test PAN Traffic Logs LDAP outbound connection + file: network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml + name: PAN Traffic Logs + pass_condition: '@count_gt(0)' +type: Anomaly +version: 1 diff --git a/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml b/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml deleted file mode 100644 index b8276b1001..0000000000 --- a/tests/endpoint/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml.test.yml +++ /dev/null @@ -1,10 +0,0 @@ -name: Windows Powershell DownloadFile Unit Test -tests: -- name: Windows Powershell DownloadFile - file: endpoint/ssa___windows_powershell_downloadfile.yml - pass_condition: '@count_gt(0)' - description: Test Windows Powershell DownloadFile detections - attack_data: - - file_name: downloadfile_windows-security.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log - source: WinEventLog:Security diff --git a/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml b/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml new file mode 100644 index 0000000000..5b4a1868c4 --- /dev/null +++ b/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml @@ -0,0 +1,11 @@ +name: TCP Command and Scripting Interpreter Outbound LDAP Traffic Unit Test +tests: +- name: PAN Traffic Logs + file: network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml + pass_condition: '@count_gt(0)' + description: Test PAN Traffic Logs LDAP outbound connection + attack_data: + - file_name: pantraffic.txt + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + source: pan:traffic + sourcetype: pan:traffic From 6a50f02ff475b074a80e192b314275c65f5140ce Mon Sep 17 00:00:00 2001 From: d1vious Date: Thu, 24 Feb 2022 23:05:31 -0500 Subject: [PATCH 3/5] working detection --- detections/endpoint/ssa___windows_powersh.yml | 94 +++++++++++++++++++ ...ting_interpreter_outbound_ldap_traffic.yml | 18 ++-- ...ting_interpreter_outbound_ldap_traffic.yml | 24 ++--- ...interpreter_outbound_ldap_traffic.test.yml | 2 +- 4 files changed, 111 insertions(+), 27 deletions(-) create mode 100644 detections/endpoint/ssa___windows_powersh.yml diff --git a/detections/endpoint/ssa___windows_powersh.yml b/detections/endpoint/ssa___windows_powersh.yml new file mode 100644 index 0000000000..939778867e --- /dev/null +++ b/detections/endpoint/ssa___windows_powersh.yml @@ -0,0 +1,94 @@ +name: Windows Powershell DownloadFile +id: 46440222-81d5-44b1-a376-19dcd70d1b08 +version: 1 +date: '2022-02-11' +author: Jose Hernandez, Michael Haag, Splunk +type: Anomaly +datamodel: +- Endpoint_Processes +description: The following analytic identifies the use of PowerShell downloading a + file using `DownloadFile` method. This particular method is utilized in many different + PowerShell frameworks to download files and output to disk. Identify the source + (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell + transaction logs are available, review for further details of the implant. +search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, + "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), + "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), + "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", + null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", + null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where + cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" + OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" + OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like + (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), + "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", + process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + | into write_ssa_detected_events();' +how_to_implement: To successfully implement this search you need to be ingesting information + on process that include the name of the process responsible for the changes from + your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, + confirm the latest CIM App 4.20 or higher is installed and the latest TA for the + endpoint product. +known_false_positives: False positives may be present and filtering will need to occur + by parent process or command line argument. It may be required to modify this query + to an EDR product for more granular coverage. +references: +- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 +- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md +tags: + analytic_story: + - Malicious PowerShell + - Ingress Tool Transfer + - Log4Shell CVE-2021-44228 + cis20: + - CIS 8 + confidence: 70 + context: + - Source:Endpoint + - Stage:LateralMovement + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log + impact: 50 + kill_chain_phases: + - Lateral Movement + message: An instance of $parent_process_name$ spawning $process_name$ was identified + on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile + within PowerShell. + mitre_attack_id: + - T1020 + nist: + - PR.PT + - DE.CM + observable: + - name: dest_user_id + type: User + role: + - Victim + - name: dest_device_id + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process + product: + - Splunk Behavioral Analytics + required_fields: + - _time + - dest_device_id + - process_name + - parent_process_name + - process_path + - dest_user_id + - process + - cmd_line + risk_score: 35 + risk_severity: low + security_domain: endpoint diff --git a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index 612039120b..91e98d560d 100644 --- a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -8,18 +8,12 @@ datamodel: - Endpoint_Processes description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" - OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" - OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like - (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_primary_artifact"), "string", null) + | where dest_port=389 OR dest_port=1389 OR dest_port=636 + | where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) + "string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port, "dest_ip", dest_ip]) | into write_ssa_detected_events();' how_to_implement: To successfully implement this search you need to be ingesting information on network traffic, specifically data that populates the Network_Traffic datamodel. @@ -40,7 +34,7 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log impact: 50 kill_chain_phases: - Execution diff --git a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index 5d7bb37e09..4136fd59e8 100644 --- a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -25,19 +25,15 @@ references: risk_message: An outbound LDAP connection from $src_ip$ in your infrastructure connecting to dest ip $dest_ip$ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" - OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" - OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like - (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, + "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, + "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_primary_artifact"), + "string", null) | where dest_port=389 OR dest_port=1389 OR dest_port=636 | where + NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, + cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12")) + | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' + "string", null)), body=create_map(["event_id", event_id, "dest_port", dest_port, + "dest_ip", dest_ip]) | into write_ssa_detected_events();' tags: analytic_story: - Log4Shell CVE-2021-44228 @@ -49,7 +45,7 @@ tags: - Source:Endpoint - Stage:Execution dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log impact: 50 kill_chain_phases: - Execution @@ -91,7 +87,7 @@ test: name: TCP Command and Scripting Interpreter Outbound LDAP Traffic Unit Test tests: - attack_data: - - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log file_name: pantraffic.txt source: pan:traffic sourcetype: pan:traffic diff --git a/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml b/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml index 5b4a1868c4..41564782d6 100644 --- a/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml +++ b/tests/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.test.yml @@ -6,6 +6,6 @@ tests: description: Test PAN Traffic Logs LDAP outbound connection attack_data: - file_name: pantraffic.txt - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.txt + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059/log4shell_ldap_traffic/pantraffic.log source: pan:traffic sourcetype: pan:traffic From f14eec3bd7aacf4a852eebc093f6b71d6ba0e549 Mon Sep 17 00:00:00 2001 From: d1vious Date: Thu, 24 Feb 2022 23:07:52 -0500 Subject: [PATCH 4/5] cleaning up a mistakenly added file --- detections/endpoint/ssa___windows_powersh.yml | 94 ------------------- 1 file changed, 94 deletions(-) delete mode 100644 detections/endpoint/ssa___windows_powersh.yml diff --git a/detections/endpoint/ssa___windows_powersh.yml b/detections/endpoint/ssa___windows_powersh.yml deleted file mode 100644 index 939778867e..0000000000 --- a/detections/endpoint/ssa___windows_powersh.yml +++ /dev/null @@ -1,94 +0,0 @@ -name: Windows Powershell DownloadFile -id: 46440222-81d5-44b1-a376-19dcd70d1b08 -version: 1 -date: '2022-02-11' -author: Jose Hernandez, Michael Haag, Splunk -type: Anomaly -datamodel: -- Endpoint_Processes -description: The following analytic identifies the use of PowerShell downloading a - file using `DownloadFile` method. This particular method is utilized in many different - PowerShell frameworks to download files and output to disk. Identify the source - (IP/domain) and destination file and triage appropriately. If AMSI logging or PowerShell - transaction logs are available, review for further details of the implant. -search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), - "string", null)), process_name=lower(ucast(map_get(input_event, "process_name"), - "string", null)), process_path=ucast(map_get(input_event, "process_path"), "string", - null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", - null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where - cmd_line IS NOT NULL AND process_name IS NOT NULL | where process_name="pwsh.exe" - OR process_name="pwsh.exe" OR process_name="sqlps.exe" OR process_name="sqltoolsps.exe" - OR process_name="powershell.exe" OR process_name="powershell_ise.exe" | where (like - (cmd_line, "%downloadfile%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, - "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), - "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", - process_name, "parent_process_name", parent_process_name, "process_path", process_path]) - | into write_ssa_detected_events();' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. -known_false_positives: False positives may be present and filtering will need to occur - by parent process or command line argument. It may be required to modify this query - to an EDR product for more granular coverage. -references: -- https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient.downloadfile?view=net-5.0 -- https://blog.malwarebytes.com/malwarebytes-news/2021/02/lazyscripter-from-empire-to-double-rat/ -- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1059.001/T1059.001.md -tags: - analytic_story: - - Malicious PowerShell - - Ingress Tool Transfer - - Log4Shell CVE-2021-44228 - cis20: - - CIS 8 - confidence: 70 - context: - - Source:Endpoint - - Stage:LateralMovement - dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/atomic_red_team/downloadfile_windows-security.log - impact: 50 - kill_chain_phases: - - Lateral Movement - message: An instance of $parent_process_name$ spawning $process_name$ was identified - on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile - within PowerShell. - mitre_attack_id: - - T1020 - nist: - - PR.PT - - DE.CM - observable: - - name: dest_user_id - type: User - role: - - Victim - - name: dest_device_id - type: Hostname - role: - - Victim - - name: parent_process_name - type: Parent Process - role: - - Parent Process - - name: process_name - type: Process - role: - - Child Process - product: - - Splunk Behavioral Analytics - required_fields: - - _time - - dest_device_id - - process_name - - parent_process_name - - process_path - - dest_user_id - - process - - cmd_line - risk_score: 35 - risk_severity: low - security_domain: endpoint From 47dbc6b946360faae5e8d823ee9756ec49294375 Mon Sep 17 00:00:00 2001 From: d1vious Date: Sat, 26 Feb 2022 13:39:28 -0500 Subject: [PATCH 5/5] using a different field --- ...mand_and_scripting_interpreter_outbound_ldap_traffic.yml | 2 +- ...mand_and_scripting_interpreter_outbound_ldap_traffic.yml | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index 91e98d560d..790077c1d4 100644 --- a/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/detections/network/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -8,7 +8,7 @@ datamodel: - Endpoint_Processes description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space. search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, - "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_primary_artifact"), "string", null) + "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"), "collection", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636 | where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, diff --git a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml index 4136fd59e8..5fe63a798b 100644 --- a/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml +++ b/dist/ssa/srs/ssa___tcp_command_and_scripting_interpreter_outbound_ldap_traffic.yml @@ -26,9 +26,9 @@ risk_message: An outbound LDAP connection from $src_ip$ in your infrastructure c to dest ip $dest_ip$ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), dest_port=map_get(input_event, "dest_port"), event_id=ucast(map_get(input_event, - "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_primary_artifact"), - "string", null) | where dest_port=389 OR dest_port=1389 OR dest_port=636 | where - NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, + "event_id"), "string", null), dest_ip=ucast(map_get(input_event, "dest_device_ips"), + "collection", [])[0] | where dest_port=389 OR dest_port=1389 OR dest_port=636 + | where NOT (cidrmatch(ip: dest_ip, cidr_range: "10.0.0.0/8") OR cidrmatch(ip: dest_ip, cidr_range: "192.168.0.0/16") OR cidrmatch(ip: dest_ip, cidr_range: "172.16.0.0/12")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),