Branch was auto-updated.

detections/cloud/aws_saml_access_by_provider_user_and_principal.yml

@@ -0,0 +1,38 @@
+author: Rod Soto, Splunk
+date: '2021-01-26'
+description: This search provides specific SAML access from specific Service Provider,
+  user and targeted principal at AWS. This search provides specific information to
+  detect abnormal access or potential credential hijack or forgery, specially in federated
+  environments using SAML protocol inside the perimeter or cloud provider.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs
+id: bbe23980-6019-11eb-ae93-0242ac130002
+known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries
+  are very difficult to detect as accessing cloud providers with these assertions
+  looks exactly like normal access, however things such as source IP sourceIPAddress
+  user, and principal targeted at receiving cloud provider along with endpoint credential
+  access and abuse detection searches can provide the necessary context to detect
+  these attacks.
+name: AWS SAML Access by Provider User and Principal
+references:
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
+search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime
+  max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn
+  requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress
+  userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  |`aws_saml_access_by_provider_user_and_principal_filter`'
+tags:
+  analytics_story:
+  - Cloud Federated Credential Abuse
+  asset_type: AWS Federated Account
+  mitre_attack_id:
+  - T1078
+  security_domain: threat
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json
+type: ESCU
+version: 1

detections/cloud/aws_saml_update_identity_provider.yml

@@ -0,0 +1,34 @@
+author: Rod Soto, Splunk
+date: '2021-01-26'
+description: This search provides detection of updates to SAML provider in AWS. Updates
+  to SAML provider need to be monitored closely as they may indicate possible perimeter
+  compromise of federated credentials, or backdoor access from another cloud provider
+  set by attacker.
+how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
+  search works with cloudtrail logs.
+id: 2f0604c6-6030-11eb-ae93-0242ac130002
+known_false_positives: Updating a SAML provider or creating a new one may not necessarily
+  be malicious however it needs to be closely monitored.
+name: AWS SAML Update identity provider
+references:
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
+search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime
+  max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn
+  userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId
+  userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  |`aws_saml_update_identity_provider_filter`'
+tags:
+  analytics_story:
+  - Cloud Federated Credential Abuse
+  asset_type: AWS Federated Account
+  mitre_attack_id:
+  - T1078
+  security_domain: threat
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json
+type: ESCU
+version: 1

detections/cloud/o365_add_app_role_assignment_grant_user.yml

@@ -0,0 +1,34 @@
+author: Rod Soto, Splunk
+date: '2021-01-26'
+description: This search detects the creation of a new Federation setting by alerting
+  about an specific event related to its creation.
+how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
+  works with o365:management:activity
+id: b2c81cc6-6040-11eb-ae93-0242ac130002
+known_false_positives: The creation of a new Federation is not necessarily malicious,
+  however this events need to be followed closely, as it may indicate federated credential
+  abuse or backdoor via federated identities at a different cloud provider.
+name: O365 Add App Role Assignment Grant User
+references:
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app
+  role assignment grant to user." | stats count min(_time) as firstTime max(_time)
+  as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by
+  ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `o365_add_app_role_assignment_grant_user_filter`'
+tags:
+  analytics_story:
+  - Office 365 Detections
+  - Cloud Federated Credential Abuse
+  asset_type: Office 365
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1136.003
+  security_domain: threat
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation.json
+type: ESCU
+version: 1

detections/cloud/o365_added_service_principal.yml

@@ -0,0 +1,37 @@
+author: Rod Soto, Splunk
+date: '2021-01-26'
+description: This search detects the creation of a new Federation setting by alerting
+  about an specific event related to its creation.
+how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
+  works with o365:management:activity
+id: 1668812a-6047-11eb-ae93-0242ac130002
+known_false_positives: The creation of a new Federation is not necessarily malicious,
+  however these events need to be followed closely, as it may indicate federated credential
+  abuse or backdoor via federated identities at a different cloud provider.
+name: O365 Added Service Principal
+references:
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
+- https://www.sygnia.co/golden-saml-advisory
+search: '`o365_management_activity` Workload=AzureActiveDirectory signature="Add service
+  principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID)
+  as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue)
+  as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress
+  signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `o365_added_service_principal_filter`'
+tags:
+  analytics_story:
+  - Office 365 Detections
+  - Cloud Federated Credential Abuse
+  asset_type: Office 365
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1136.003
+  security_domain: threat
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.json
+type: ESCU
+version: 1

detections/cloud/o365_excessive_sso_logon_errors.yml

@@ -0,0 +1,32 @@
+author: Rod Soto, Splunk
+date: '2021-01-26'
+description: This search detects accounts with high number of Single Sign ON (SSO)
+  logon errors. Excessive logon errors may indicate attempts to bruteforce of password
+  or single sign on token hijack or reuse.
+how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
+  works with o365:management:activity
+id: 8158ccc4-6038-11eb-ae93-0242ac130002
+known_false_positives: Logon errors may not be malicious in nature however it may
+  indicate attempts to reuse a token or password obtained via credential access attack.
+name: O365 Excessive SSO logon errors
+references:
+- https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/
+search: '`o365_management_activity`  Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired
+  | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress
+  UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
+  | `o365_excessive_sso_logon_errors_filter`'
+tags:
+  analytics_story:
+  - Office 365 Detections
+  - Cloud Federated Credential Abuse
+  asset_type: Office 365
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1556
+  security_domain: threat
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors.json
+type: ESCU
+version: 1

detections/cloud/o365_new_federated_domain_added.yml

@@ -0,0 +1,36 @@
+author: Rod Soto, Splunk
+date: '2021-01-26'
+description: This search detects the addition of a new Federated domain.
+how_to_implement: You must install splunk Microsoft Office 365 add-on. This search
+  works with o365:management:activity.
+id: e155876a-6048-11eb-ae93-0242ac130002
+known_false_positives: The creation of a new Federated domain is not necessarily malicious,
+  however these events need to be followed closely, as it may indicate federated credential
+  abuse or backdoor via federated identities at a similar or different cloud provider.
+name: O365 New Federated Domain Added
+references:
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html
+- https://www.sygnia.co/golden-saml-advisory
+- https://o365blog.com/post/aadbackdoor/
+search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain"
+  | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value)
+  as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId
+  UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
+  | `o365_new_federated_domain_added_filter`'
+tags:
+  analytics_story:
+  - Office 365 Detections
+  - Cloud Federated Credential Abuse
+  asset_type: Office 365
+  kill_chain_phases:
+  - Actions on Objective
+  mitre_attack_id:
+  - T1136.003
+  security_domain: threat
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json
+type: ESCU
+version: 1

detections/deprecated/detect_mimikatz_using_loaded_images.yml

@@ -20,18 +20,22 @@ search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values(
   ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | rename
   Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_mimikatz_using_loaded_images_filter`'
+
+known_false_positives: Other tools can import the same DLLs. These tools should be
+  part of a whitelist.
 tags:
   analytics_story:
   - Credential Dumping
   - Detect Zerologon Attack
+  - Cloud Federated Credential Abuse
+  mitre_attack_id:
+  - T1003.001
+  kill_chain_phases:
+  - Actions on Objectives
   asset_type: Windows
   cis20:
   - CIS 6
   - CIS 8
-  kill_chain_phases:
-  - Actions on Objectives
-  mitre_attack_id:
-  - T1003.001
   nist:
   - DE.AE
   - DE.CM

detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml

@@ -23,6 +23,8 @@ search: '`wineventlog_security` signature_id=4703 Process_Name=*powershell.exe |
   | rename Process_Name as process |  `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
   | `detect_mimikatz_via_powershell_and_eventcode_4703_filter`'
 tags:
+  analytics_story:
+  - Cloud Federated Credential Abuse
   asset_type: Windows
   cis20:
   - CIS 3

detections/deprecated/uncommon_processes_on_endpoint.yml

@@ -22,7 +22,7 @@ tags:
   analytics_story:
   - Windows Privilege Escalation
   - Unusual Processes
-  asset_type: Endpoint
+  - Cloud Federated Credential Abuse
   cis20:
   - CIS 2
   kill_chain_phases:

detections/endpoint/certutil_exe_certificate_extraction.yml

@@ -0,0 +1,29 @@
+name: Certutil exe certificate extraction
+id: 337a46be-600f-11eb-ae93-0242ac130002
+version: 1
+date: '2021-01-26'
+description: This search looks for arguments to certutil.exe indicating the manipulation
+  or extraction of Certificate. This certificate can then be used to sign new authentication
+  tokens specially inside Federated environments such as Windows ADFS.
+type: ESCU
+references: []
+author: Rod Soto, Splunk
+search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process)
+  as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe
+  Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name
+  Processes.process Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`
+  |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`'
+known_false_positives: Unless there are specific use cases, manipulating or exporting
+  certificates using certutil is uncommon. Extraction of certificate has been observed
+  during attacks such as Golden SAML and other campaigns targeting Federated services.
+tags:
+  analytics_story:
+  - Windows Persistence Techniques
+  - Cloud Federated Credential Abuse
+  kill_chain_phases:
+  - Installation
+  security_domain: endpoint
+  asset_type: Endpoint
+  automated_detection_testing: passed
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log

detections/endpoint/detect_rare_executables.yml

@@ -28,6 +28,7 @@ tags:
   analytics_story:
   - 'Emotet Malware  DHS Report TA18-201A '
   - Unusual Processes
+  - Cloud Federated Credential Abuse
   asset_type: Endpoint
   cis20:
   - CIS 2

detections/endpoint/registry_keys_used_for_privilege_escalation.yml

@@ -26,7 +26,7 @@ tags:
   analytics_story:
   - Windows Privilege Escalation
   - Suspicious Windows Registry Activities
-  asset_type: Endpoint
+  - Cloud Federated Credential Abuse
   automated_detection_testing: passed
   cis20:
   - CIS 8

stories/cloud_federated_credential_abuse.yml

@@ -0,0 +1,25 @@
+name: Cloud Federated Credential Abuse
+id: cecdc1e7-0af2-4a55-8967-b9ea62c0317d
+version: 1
+date: '2021-01-26'
+description: This analytical story addresses events that indicate abuse of cloud federated credentials.
+ These credentials are usually extracted from endpoint desktop or servers specially those
+ servers that provide federation services such as Windows Active Directory Federation Services.
+ Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order
+ to provide seamless access between cloud and perimeter environments. If these objects are either
+ hijacked or forged then attackers will be able to pivot into victim's cloud environements.
+narrative: This story is composed of detection searches based on endpoint that addresses the use of
+ Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated
+ directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure)
+ related events are also addressed in specific cloud environment detection searches.
+author: Rod Soto, Splunk
+type: ESCU
+references:
+- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps
+- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf
+- https://us-cert.cisa.gov/ncas/alerts/aa21-008a
+tags:
+  analytics_story: Cloud Federated Credential Abuse
+  usecase: Security Monitoring
+  category:
+  - Cloud Security

tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml

@@ -0,0 +1,13 @@
+name: AWS SAML Access by Provider User and Principal Unit Test
+tests:
+- name: AWS SAML Access by Provider User and Principal
+  file: cloud/aws_saml_access_by_provider_user_and_principal.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True

tests/cloud/aws_saml_update_identity_provider.test.yml

@@ -0,0 +1,13 @@
+name: AWS SAML Update identity provider Unit Test
+tests:
+- name: AWS SAML Update identity provider
+  file: cloud/aws_saml_update_identity_provider.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: aws_cloudtrail_events.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json
+    sourcetype: aws:cloudtrail
+    source: aws_cloudtrail
+    update_timestamp: True

tests/cloud/o365_add_app_role_assignment_grant_user.test.yml

@@ -0,0 +1,12 @@
+name: O365 Add App Role Assignment Grant User Unit Test
+tests:
+- name: O365 Add App Role Assignment Grant User
+  file: cloud/o365_add_app_role_assignment_grant_user.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: o365_management_activity.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation.json
+    sourcetype: 'o365:management:activity'
+    source: 'o365'

tests/cloud/o365_added_service_principal.test.yml

@@ -0,0 +1,12 @@
+name: O365 Added Service Principal Unit Test
+tests:
+- name: O365 Added Service Principal
+  file: cloud/o365_added_service_principal.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: o365_management_activity.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.json
+    sourcetype: 'o365:management:activity'
+    source: 'o365'

tests/cloud/o365_excessive_sso_logon_errors.test.yml

@@ -0,0 +1,12 @@
+name: O365 Excessive SSO logon errors Unit Test
+tests:
+- name: O365 Excessive SSO logon errors
+  file: cloud/o365_excessive_sso_logon_errors.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: o365_management_activity.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors.json
+    sourcetype: 'o365:management:activity'
+    source: 'o365'

tests/cloud/o365_new_federated_domain_added.test.yml

@@ -0,0 +1,13 @@
+name: O365 New Federated Domain Added Unit Test
+tests:
+- name: O365 New Federated Domain Added
+  file: cloud/o365_new_federated_domain_added.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: o365_management_activity.json
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json
+    sourcetype: 'o365:management:activity'
+    source: 'exchange'
+    update_timestamp: True

tests/endpoint/certutil_exe_certificate_extraction.test.yml

@@ -0,0 +1,12 @@
+name: Certutil exe certificate extraction Unit Test
+tests:
+- name: Certutil exe certificate extraction
+  file: endpoint/certutil_exe_certificate_extraction.yml
+  pass_condition: '| stats count | where count > 0'
+  earliest_time: '-7d'
+  latest_time: 'now'
+  attack_data:
+  - file_name: windows-sysmon.log
+    data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log
+    source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+    sourcetype: xmlwineventlog