Branch was auto-updated.

detections/endpoint/excessive_usage_of_nslookup_app.yml

@@ -1,7 +1,7 @@
 name: Excessive Usage of NSLOOKUP App
 id: 0a69fdaa-a2b8-11eb-b16d-acde48001122
-version: 1
-date: '2021-04-21'
+version: 2
+date: '2022-06-03'
 author: Teoderick Contreras, Stanislav Miskovic, Splunk
 type: Anomaly
 datamodel:
@@ -12,12 +12,16 @@ description: This search is to detect potential DNS exfiltration using nslookup
   use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are
   commonly used by attacker and also the retry parameter which is designed to query
   C2 DNS multiple tries.
-search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" |  bucket _time span=15m
-  | stats count as numNsLookup by Computer, _time |  eventstats avg(numNsLookup) as
-  avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer |  eval
-  upperThreshold=(avgNsLookup + stdNsLookup *3) |  eval isOutlier=if(avgNsLookup >
-  20 and avgNsLookup >= upperThreshold, 1, 0) |  search isOutlier=1 | `security_content_ctime(firstTime)`
-  | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`'
+search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" 
+  | bucket _time span=1m 
+  | stats count as numNsLookup by Computer, _time 
+  | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer 
+  | eval upperThreshold=(avgNsLookup + stdNsLookup *3) 
+  | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0) 
+  | search isOutlier=1 
+  | `security_content_ctime(firstTime)` 
+  | `security_content_ctime(lastTime)` 
+  | `excessive_usage_of_nslookup_app_filter`'
 how_to_implement: To successfully implement this search, you need to be ingesting
   logs with the process name, parent process, and command-line executions from your
   endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
@@ -39,6 +43,7 @@ tags:
   - Scope:Local
   - Stage:Exfiltration
   dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log
   - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
   impact: 40
   kill_chain_phases:

detections/endpoint/linux_iptables_firewall_modification.yml

@@ -1,7 +1,7 @@
 name: Linux Iptables Firewall Modification
 id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7
-version: 2
-date: '2022-04-30'
+version: 3
+date: '2022-06-03'
 author: Teoderick Contreras, Splunk
 type: Anomaly
 datamodel:
@@ -12,10 +12,11 @@ description: This analytic looks for suspicious commandline that modify the ipta
 search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
   where  Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*"
   AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*"))
-  by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest
+  by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest _time span=10s
   Processes.user Processes.parent_process_name  Processes.parent_process_path Processes.process_path
   | rex field=Processes.process "--dport (?<port>3269|636|989|994|995|8443)"
-  | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3
+  | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count 
+  by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path | where port_count >=3
   | `drop_dm_object_name(Processes)`
   | `security_content_ctime(firstTime)`
   | `security_content_ctime(lastTime)`

tests/endpoint/excessive_usage_of_nslookup_app.test.yml

@@ -6,7 +6,7 @@ tests:
   earliest_time: -24h
   latest_time: now
   attack_data:
-  - file_name: windows-sysmon.log
-    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
+  - file_name: sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log
     source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
     sourcetype: xmlwineventlog