diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 2a9fc6e0b7..892c8587e5 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -1,7 +1,7 @@ name: Excessive Usage of NSLOOKUP App id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 -version: 1 -date: '2021-04-21' +version: 2 +date: '2022-06-03' author: Teoderick Contreras, Stanislav Miskovic, Splunk type: Anomaly datamodel: @@ -12,12 +12,16 @@ description: This search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=15m - | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as - avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval - upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(avgNsLookup > - 20 and avgNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`' +search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" + | bucket _time span=1m + | stats count as numNsLookup by Computer, _time + | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer + | eval upperThreshold=(avgNsLookup + stdNsLookup *3) + | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0) + | search isOutlier=1 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -39,6 +43,7 @@ tags: - Scope:Local - Stage:Exfiltration dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log impact: 40 kill_chain_phases: diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index cec01c4d5e..d5ee4e0533 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,7 +1,7 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: 2 -date: '2022-04-30' +version: 3 +date: '2022-06-03' author: Teoderick Contreras, Splunk type: Anomaly datamodel: @@ -12,10 +12,11 @@ description: This analytic looks for suspicious commandline that modify the ipta search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest _time span=10s Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" - | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3 + | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count + by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/tests/endpoint/excessive_usage_of_nslookup_app.test.yml b/tests/endpoint/excessive_usage_of_nslookup_app.test.yml index 2822fb969c..d580a2f675 100644 --- a/tests/endpoint/excessive_usage_of_nslookup_app.test.yml +++ b/tests/endpoint/excessive_usage_of_nslookup_app.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog