From 6dddbfaee815b7a4eeefba88be34252ce2cff667 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 3 Jun 2022 12:55:23 +0200 Subject: [PATCH 1/3] detection-fix-due-to-splunk-time --- .../endpoint/linux_iptables_firewall_modification.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/linux_iptables_firewall_modification.yml b/detections/endpoint/linux_iptables_firewall_modification.yml index cec01c4d5e..d5ee4e0533 100644 --- a/detections/endpoint/linux_iptables_firewall_modification.yml +++ b/detections/endpoint/linux_iptables_firewall_modification.yml @@ -1,7 +1,7 @@ name: Linux Iptables Firewall Modification id: 309d59dc-1e1b-49b2-9800-7cf18d12f7b7 -version: 2 -date: '2022-04-30' +version: 3 +date: '2022-06-03' author: Teoderick Contreras, Splunk type: Anomaly datamodel: @@ -12,10 +12,11 @@ description: This analytic looks for suspicious commandline that modify the ipta search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*iptables *" AND Processes.process = "* --dport *" AND Processes.process = "* ACCEPT*" AND Processes.process = "*&>/dev/null*" AND Processes.process = "* tcp *" AND NOT(Processes.parent_process_path IN("/bin/*", "/lib/*", "/usr/bin/*", "/sbin/*")) - by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest + by Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_guid Processes.dest _time span=10s Processes.user Processes.parent_process_name Processes.parent_process_path Processes.process_path | rex field=Processes.process "--dport (?3269|636|989|994|995|8443)" - | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path firstTime lastTime | where port_count >=3 + | stats values(Processes.process) as processes_exec values(port) as ports values(Processes.process_guid) as guids values(Processes.process_id) as pids dc(port) as port_count count + by Processes.process_name Processes.parent_process_name Processes.parent_process_id Processes.dest Processes.user Processes.parent_process_path Processes.process_path | where port_count >=3 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` From 136a3a1b923eb643fb5806bf449ffa435297be94 Mon Sep 17 00:00:00 2001 From: tccontre Date: Fri, 3 Jun 2022 16:30:32 +0200 Subject: [PATCH 2/3] detection-fix-due-to-splunk-time --- .../excessive_usage_of_nslookup_app.yml | 21 ++++++++++++------- .../excessive_usage_of_nslookup_app.test.yml | 4 ++-- 2 files changed, 15 insertions(+), 10 deletions(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 2a9fc6e0b7..2788083721 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -1,7 +1,7 @@ name: Excessive Usage of NSLOOKUP App id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 -version: 1 -date: '2021-04-21' +version: 2 +date: '2022-06-03' author: Teoderick Contreras, Stanislav Miskovic, Splunk type: Anomaly datamodel: @@ -12,12 +12,16 @@ description: This search is to detect potential DNS exfiltration using nslookup use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" | bucket _time span=15m - | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as - avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval - upperThreshold=(avgNsLookup + stdNsLookup *3) | eval isOutlier=if(avgNsLookup > - 20 and avgNsLookup >= upperThreshold, 1, 0) | search isOutlier=1 | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` | `excessive_usage_of_nslookup_app_filter`' +search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" + | bucket _time span=15m + | stats count as numNsLookup by Computer, _time + | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer + | eval upperThreshold=(avgNsLookup + stdNsLookup *3) + | eval isOutlier=if(numNsLookup > 20 and numNsLookup >= upperThreshold, 1, 0) + | search isOutlier=1 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `excessive_usage_of_nslookup_app_filter`' how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the @@ -39,6 +43,7 @@ tags: - Scope:Local - Stage:Exfiltration dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log impact: 40 kill_chain_phases: diff --git a/tests/endpoint/excessive_usage_of_nslookup_app.test.yml b/tests/endpoint/excessive_usage_of_nslookup_app.test.yml index 2822fb969c..d580a2f675 100644 --- a/tests/endpoint/excessive_usage_of_nslookup_app.test.yml +++ b/tests/endpoint/excessive_usage_of_nslookup_app.test.yml @@ -6,7 +6,7 @@ tests: earliest_time: -24h latest_time: now attack_data: - - file_name: windows-sysmon.log - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log + - file_name: sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/sysmon.log source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational sourcetype: xmlwineventlog From ad992a4d88fd8ee2d61018a1a53b3d3962ae2d08 Mon Sep 17 00:00:00 2001 From: tccontre <26181693+tccontre@users.noreply.github.com> Date: Fri, 3 Jun 2022 16:33:18 +0200 Subject: [PATCH 3/3] Update excessive_usage_of_nslookup_app.yml --- detections/endpoint/excessive_usage_of_nslookup_app.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 2788083721..892c8587e5 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -13,7 +13,7 @@ description: This search is to detect potential DNS exfiltration using nslookup commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. search: '`sysmon` EventCode = 1 process_name = "nslookup.exe" - | bucket _time span=15m + | bucket _time span=1m | stats count as numNsLookup by Computer, _time | eventstats avg(numNsLookup) as avgNsLookup, stdev(numNsLookup) as stdNsLookup, count as numSlots by Computer | eval upperThreshold=(avgNsLookup + stdNsLookup *3)