diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml new file mode 100644 index 0000000000..9ac60556e2 --- /dev/null +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -0,0 +1,38 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search provides specific SAML access from specific Service Provider, + user and targeted principal at AWS. This search provides specific information to + detect abnormal access or potential credential hijack or forgery, specially in federated + environments using SAML protocol inside the perimeter or cloud provider. +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with cloudtrail logs +id: bbe23980-6019-11eb-ae93-0242ac130002 +known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries + are very difficult to detect as accessing cloud providers with these assertions + looks exactly like normal access, however things such as source IP sourceIPAddress + user, and principal targeted at receiving cloud provider along with endpoint credential + access and abuse detection searches can provide the necessary context to detect + these attacks. +name: AWS SAML Access by Provider User and Principal +references: +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps +search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime + max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn + requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress + userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + |`aws_saml_access_by_provider_user_and_principal_filter`' +tags: + analytics_story: + - Cloud Federated Credential Abuse + asset_type: AWS Federated Account + mitre_attack_id: + - T1078 + security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json +type: ESCU +version: 1 diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml new file mode 100644 index 0000000000..8a7321ae2c --- /dev/null +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -0,0 +1,34 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search provides detection of updates to SAML provider in AWS. Updates + to SAML provider need to be monitored closely as they may indicate possible perimeter + compromise of federated credentials, or backdoor access from another cloud provider + set by attacker. +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with cloudtrail logs. +id: 2f0604c6-6030-11eb-ae93-0242ac130002 +known_false_positives: Updating a SAML provider or creating a new one may not necessarily + be malicious however it needs to be closely monitored. +name: AWS SAML Update identity provider +references: +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps +search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime + max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn + userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId + userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + |`aws_saml_update_identity_provider_filter`' +tags: + analytics_story: + - Cloud Federated Credential Abuse + asset_type: AWS Federated Account + mitre_attack_id: + - T1078 + security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json +type: ESCU +version: 1 diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml new file mode 100644 index 0000000000..4f393bbcb6 --- /dev/null +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -0,0 +1,34 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search detects the creation of a new Federation setting by alerting + about an specific event related to its creation. +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search + works with o365:management:activity +id: b2c81cc6-6040-11eb-ae93-0242ac130002 +known_false_positives: The creation of a new Federation is not necessarily malicious, + however this events need to be followed closely, as it may indicate federated credential + abuse or backdoor via federated identities at a different cloud provider. +name: O365 Add App Role Assignment Grant User +references: +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app + role assignment grant to user." | stats count min(_time) as firstTime max(_time) + as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by + ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `o365_add_app_role_assignment_grant_user_filter`' +tags: + analytics_story: + - Office 365 Detections + - Cloud Federated Credential Abuse + asset_type: Office 365 + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1136.003 + security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation.json +type: ESCU +version: 1 diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml new file mode 100644 index 0000000000..88e3123ed8 --- /dev/null +++ b/detections/cloud/o365_added_service_principal.yml @@ -0,0 +1,37 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search detects the creation of a new Federation setting by alerting + about an specific event related to its creation. +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search + works with o365:management:activity +id: 1668812a-6047-11eb-ae93-0242ac130002 +known_false_positives: The creation of a new Federation is not necessarily malicious, + however these events need to be followed closely, as it may indicate federated credential + abuse or backdoor via federated identities at a different cloud provider. +name: O365 Added Service Principal +references: +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html +- https://www.sygnia.co/golden-saml-advisory +search: '`o365_management_activity` Workload=AzureActiveDirectory signature="Add service + principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) + as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) + as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress + signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `o365_added_service_principal_filter`' +tags: + analytics_story: + - Office 365 Detections + - Cloud Federated Credential Abuse + asset_type: Office 365 + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1136.003 + security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.json +type: ESCU +version: 1 diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml new file mode 100644 index 0000000000..2195e7caf8 --- /dev/null +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -0,0 +1,32 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search detects accounts with high number of Single Sign ON (SSO) + logon errors. Excessive logon errors may indicate attempts to bruteforce of password + or single sign on token hijack or reuse. +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search + works with o365:management:activity +id: 8158ccc4-6038-11eb-ae93-0242ac130002 +known_false_positives: Logon errors may not be malicious in nature however it may + indicate attempts to reuse a token or password obtained via credential access attack. +name: O365 Excessive SSO logon errors +references: +- https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/ +search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired + | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress + UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | `o365_excessive_sso_logon_errors_filter`' +tags: + analytics_story: + - Office 365 Detections + - Cloud Federated Credential Abuse + asset_type: Office 365 + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1556 + security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors.json +type: ESCU +version: 1 diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml new file mode 100644 index 0000000000..949f8a081e --- /dev/null +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -0,0 +1,36 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search detects the addition of a new Federated domain. +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search + works with o365:management:activity. +id: e155876a-6048-11eb-ae93-0242ac130002 +known_false_positives: The creation of a new Federated domain is not necessarily malicious, + however these events need to be followed closely, as it may indicate federated credential + abuse or backdoor via federated identities at a similar or different cloud provider. +name: O365 New Federated Domain Added +references: +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html +- https://www.sygnia.co/golden-saml-advisory +- https://o365blog.com/post/aadbackdoor/ +search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" + | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) + as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId + UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | `o365_new_federated_domain_added_filter`' +tags: + analytics_story: + - Office 365 Detections + - Cloud Federated Credential Abuse + asset_type: Office 365 + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1136.003 + security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json +type: ESCU +version: 1 diff --git a/detections/deprecated/detect_mimikatz_using_loaded_images.yml b/detections/deprecated/detect_mimikatz_using_loaded_images.yml index f7970b7ca7..64df524f99 100644 --- a/detections/deprecated/detect_mimikatz_using_loaded_images.yml +++ b/detections/deprecated/detect_mimikatz_using_loaded_images.yml @@ -20,18 +20,22 @@ search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values( ImageLoaded=*hid.dll ImageLoaded=*samlib.dll ImageLoaded=*vaultcli.dll | rename Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mimikatz_using_loaded_images_filter`' + +known_false_positives: Other tools can import the same DLLs. These tools should be + part of a whitelist. tags: analytics_story: - Credential Dumping - Detect Zerologon Attack + - Cloud Federated Credential Abuse + mitre_attack_id: + - T1003.001 + kill_chain_phases: + - Actions on Objectives asset_type: Windows cis20: - CIS 6 - CIS 8 - kill_chain_phases: - - Actions on Objectives - mitre_attack_id: - - T1003.001 nist: - DE.AE - DE.CM diff --git a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml index a42009f498..7a7e9c5c62 100644 --- a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml +++ b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml @@ -23,6 +23,8 @@ search: '`wineventlog_security` signature_id=4703 Process_Name=*powershell.exe | | rename Process_Name as process | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mimikatz_via_powershell_and_eventcode_4703_filter`' tags: + analytics_story: + - Cloud Federated Credential Abuse asset_type: Windows cis20: - CIS 3 diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/detections/deprecated/uncommon_processes_on_endpoint.yml index 8456af0ab7..fb7b6b75d6 100644 --- a/detections/deprecated/uncommon_processes_on_endpoint.yml +++ b/detections/deprecated/uncommon_processes_on_endpoint.yml @@ -22,7 +22,7 @@ tags: analytics_story: - Windows Privilege Escalation - Unusual Processes - asset_type: Endpoint + - Cloud Federated Credential Abuse cis20: - CIS 2 kill_chain_phases: diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml new file mode 100644 index 0000000000..18539c0bf7 --- /dev/null +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -0,0 +1,29 @@ +name: Certutil exe certificate extraction +id: 337a46be-600f-11eb-ae93-0242ac130002 +version: 1 +date: '2021-01-26' +description: This search looks for arguments to certutil.exe indicating the manipulation + or extraction of Certificate. This certificate can then be used to sign new authentication + tokens specially inside Federated environments such as Windows ADFS. +type: ESCU +references: [] +author: Rod Soto, Splunk +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) + as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe + Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name + Processes.process Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`' +known_false_positives: Unless there are specific use cases, manipulating or exporting + certificates using certutil is uncommon. Extraction of certificate has been observed + during attacks such as Golden SAML and other campaigns targeting Federated services. +tags: + analytics_story: + - Windows Persistence Techniques + - Cloud Federated Credential Abuse + kill_chain_phases: + - Installation + security_domain: endpoint + asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml index ae3c35d28f..f321d3668c 100644 --- a/detections/endpoint/detect_rare_executables.yml +++ b/detections/endpoint/detect_rare_executables.yml @@ -28,6 +28,7 @@ tags: analytics_story: - 'Emotet Malware DHS Report TA18-201A ' - Unusual Processes + - Cloud Federated Credential Abuse asset_type: Endpoint cis20: - CIS 2 diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index aa01bc3d8a..a9276249bc 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -26,7 +26,7 @@ tags: analytics_story: - Windows Privilege Escalation - Suspicious Windows Registry Activities - asset_type: Endpoint + - Cloud Federated Credential Abuse automated_detection_testing: passed cis20: - CIS 8 diff --git a/stories/cloud_federated_credential_abuse.yml b/stories/cloud_federated_credential_abuse.yml new file mode 100644 index 0000000000..97ccec4b9d --- /dev/null +++ b/stories/cloud_federated_credential_abuse.yml @@ -0,0 +1,25 @@ +name: Cloud Federated Credential Abuse +id: cecdc1e7-0af2-4a55-8967-b9ea62c0317d +version: 1 +date: '2021-01-26' +description: This analytical story addresses events that indicate abuse of cloud federated credentials. + These credentials are usually extracted from endpoint desktop or servers specially those + servers that provide federation services such as Windows Active Directory Federation Services. + Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order + to provide seamless access between cloud and perimeter environments. If these objects are either + hijacked or forged then attackers will be able to pivot into victim's cloud environements. +narrative: This story is composed of detection searches based on endpoint that addresses the use of + Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated + directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) + related events are also addressed in specific cloud environment detection searches. +author: Rod Soto, Splunk +type: ESCU +references: +- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +tags: + analytics_story: Cloud Federated Credential Abuse + usecase: Security Monitoring + category: + - Cloud Security diff --git a/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml b/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml new file mode 100644 index 0000000000..ab99ac7fed --- /dev/null +++ b/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml @@ -0,0 +1,13 @@ +name: AWS SAML Access by Provider User and Principal Unit Test +tests: +- name: AWS SAML Access by Provider User and Principal + file: cloud/aws_saml_access_by_provider_user_and_principal.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_saml_update_identity_provider.test.yml b/tests/cloud/aws_saml_update_identity_provider.test.yml new file mode 100644 index 0000000000..2e5bc38378 --- /dev/null +++ b/tests/cloud/aws_saml_update_identity_provider.test.yml @@ -0,0 +1,13 @@ +name: AWS SAML Update identity provider Unit Test +tests: +- name: AWS SAML Update identity provider + file: cloud/aws_saml_update_identity_provider.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/o365_add_app_role_assignment_grant_user.test.yml b/tests/cloud/o365_add_app_role_assignment_grant_user.test.yml new file mode 100644 index 0000000000..9e1738fb4a --- /dev/null +++ b/tests/cloud/o365_add_app_role_assignment_grant_user.test.yml @@ -0,0 +1,12 @@ +name: O365 Add App Role Assignment Grant User Unit Test +tests: +- name: O365 Add App Role Assignment Grant User + file: cloud/o365_add_app_role_assignment_grant_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: o365_management_activity.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation.json + sourcetype: 'o365:management:activity' + source: 'o365' diff --git a/tests/cloud/o365_added_service_principal.test.yml b/tests/cloud/o365_added_service_principal.test.yml new file mode 100644 index 0000000000..b2ee0440f1 --- /dev/null +++ b/tests/cloud/o365_added_service_principal.test.yml @@ -0,0 +1,12 @@ +name: O365 Added Service Principal Unit Test +tests: +- name: O365 Added Service Principal + file: cloud/o365_added_service_principal.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: o365_management_activity.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.json + sourcetype: 'o365:management:activity' + source: 'o365' diff --git a/tests/cloud/o365_excessive_sso_logon_errors.test.yml b/tests/cloud/o365_excessive_sso_logon_errors.test.yml new file mode 100644 index 0000000000..3546060cfc --- /dev/null +++ b/tests/cloud/o365_excessive_sso_logon_errors.test.yml @@ -0,0 +1,12 @@ +name: O365 Excessive SSO logon errors Unit Test +tests: +- name: O365 Excessive SSO logon errors + file: cloud/o365_excessive_sso_logon_errors.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: o365_management_activity.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors.json + sourcetype: 'o365:management:activity' + source: 'o365' diff --git a/tests/cloud/o365_new_federated_domain_added.test.yml b/tests/cloud/o365_new_federated_domain_added.test.yml new file mode 100644 index 0000000000..7eb063af41 --- /dev/null +++ b/tests/cloud/o365_new_federated_domain_added.test.yml @@ -0,0 +1,13 @@ +name: O365 New Federated Domain Added Unit Test +tests: +- name: O365 New Federated Domain Added + file: cloud/o365_new_federated_domain_added.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-7d' + latest_time: 'now' + attack_data: + - file_name: o365_management_activity.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json + sourcetype: 'o365:management:activity' + source: 'exchange' + update_timestamp: True diff --git a/tests/endpoint/certutil_exe_certificate_extraction.test.yml b/tests/endpoint/certutil_exe_certificate_extraction.test.yml new file mode 100644 index 0000000000..12d4601c5c --- /dev/null +++ b/tests/endpoint/certutil_exe_certificate_extraction.test.yml @@ -0,0 +1,12 @@ +name: Certutil exe certificate extraction Unit Test +tests: +- name: Certutil exe certificate extraction + file: endpoint/certutil_exe_certificate_extraction.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-7d' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog