From 44bf41a67898b80fade2c2a2efbac32b5eb822ca Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 18 Jan 2021 15:22:05 +0100 Subject: [PATCH] new test file --- .../clients_connecting_to_multiple_dns_servers.yml | 0 ...etect_web_traffic_to_dynamic_domain_providers.yml | 3 ++- ...h_volume_of_network_traffic_from_email_server.yml | 0 .../network/prohibited_network_traffic_allowed.yml | 0 .../network/protocol_or_port_mismatch.yml | 0 ...protocols_passing_authentication_in_cleartext.yml | 0 .../web/sql_injection_with_long_urls.yml | 0 ...dns_query_length_with_high_standard_deviation.yml | 6 +++--- ...uery_length_with_high_standard_deviation.test.yml | 12 ++++++++++++ 9 files changed, 17 insertions(+), 4 deletions(-) rename detections/{network => deprecated}/clients_connecting_to_multiple_dns_servers.yml (100%) rename detections/{web => deprecated}/detect_web_traffic_to_dynamic_domain_providers.yml (95%) rename detections/{ => experimental}/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml (100%) rename detections/{ => experimental}/network/prohibited_network_traffic_allowed.yml (100%) rename detections/{ => experimental}/network/protocol_or_port_mismatch.yml (100%) rename detections/{ => experimental}/network/protocols_passing_authentication_in_cleartext.yml (100%) rename detections/{ => experimental}/web/sql_injection_with_long_urls.yml (100%) create mode 100644 tests/network/dns_query_length_with_high_standard_deviation.test.yml diff --git a/detections/network/clients_connecting_to_multiple_dns_servers.yml b/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml similarity index 100% rename from detections/network/clients_connecting_to_multiple_dns_servers.yml rename to detections/deprecated/clients_connecting_to_multiple_dns_servers.yml diff --git a/detections/web/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml similarity index 95% rename from detections/web/detect_web_traffic_to_dynamic_domain_providers.yml rename to detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml index 81d069ad2d..f54409a169 100644 --- a/detections/web/detect_web_traffic_to_dynamic_domain_providers.yml +++ b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml @@ -19,7 +19,8 @@ how_to_implement: 'This search requires you to be ingesting web-traffic logs. Yo **Label:** IsDynamicDNS, **Field:** isDynDNS\ Detailed documentation on how to create a new field within Incident Review may be - found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details`' + found here: `https://docs.splunk.com/Documentation/ES/5.3.0/Admin/Customizenotables#Add_a_field_to_the_notable_event_details` + Deprecated because duplicate.' type: ESCU references: [] author: Bhavin Patel, Splunk diff --git a/detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml similarity index 100% rename from detections/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml rename to detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml diff --git a/detections/network/prohibited_network_traffic_allowed.yml b/detections/experimental/network/prohibited_network_traffic_allowed.yml similarity index 100% rename from detections/network/prohibited_network_traffic_allowed.yml rename to detections/experimental/network/prohibited_network_traffic_allowed.yml diff --git a/detections/network/protocol_or_port_mismatch.yml b/detections/experimental/network/protocol_or_port_mismatch.yml similarity index 100% rename from detections/network/protocol_or_port_mismatch.yml rename to detections/experimental/network/protocol_or_port_mismatch.yml diff --git a/detections/network/protocols_passing_authentication_in_cleartext.yml b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml similarity index 100% rename from detections/network/protocols_passing_authentication_in_cleartext.yml rename to detections/experimental/network/protocols_passing_authentication_in_cleartext.yml diff --git a/detections/web/sql_injection_with_long_urls.yml b/detections/experimental/web/sql_injection_with_long_urls.yml similarity index 100% rename from detections/web/sql_injection_with_long_urls.yml rename to detections/experimental/web/sql_injection_with_long_urls.yml diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 6b26d7f894..45c4909b04 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -1,7 +1,7 @@ name: DNS Query Length With High Standard Deviation id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 -version: 2 -date: '2020-07-21' +version: 3 +date: '2021-01-18' description: This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. @@ -11,7 +11,7 @@ type: ESCU references: [] author: Bhavin Patel, Splunk search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution - by DNS.query DNS.record_type | `drop_dm_object_name("DNS")` | eval query_length + by DNS.query | `drop_dm_object_name("DNS")` | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev | `dns_query_length_with_high_standard_deviation_filter` ' diff --git a/tests/network/dns_query_length_with_high_standard_deviation.test.yml b/tests/network/dns_query_length_with_high_standard_deviation.test.yml new file mode 100644 index 0000000000..fd304f15fe --- /dev/null +++ b/tests/network/dns_query_length_with_high_standard_deviation.test.yml @@ -0,0 +1,12 @@ +name: DNS Query Length With High Standard Deviation Unit Test +tests: + - name: DNS Query Length With High Standard Deviation + file: network/dns_query_length_with_high_standard_deviation.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/long_dns_queries/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog