From af0fa08d34057541fb8f04c3afb497d141895bf9 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 26 Jan 2021 15:03:53 -0500 Subject: [PATCH 01/26] storyandfirstsearchcloudfederatedcredentialabuse --- .../certutil_exe_certificate_extraction.yml | 29 +++++++++++++++++++ stories/cloud_federated_credential_abuse.yml | 25 ++++++++++++++++ 2 files changed, 54 insertions(+) create mode 100644 detections/endpoint/certutil_exe_certificate_extraction.yml create mode 100644 stories/cloud_federated_credential_abuse.yml diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml new file mode 100644 index 0000000000..ee4c1ffb67 --- /dev/null +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -0,0 +1,29 @@ +name: Certutil exe certificate extraction +id: 337a46be-600f-11eb-ae93-0242ac130002 +version: 1 +date: '2021-01-26' +description: This search looks for arguments to certutil.exe indicating the manipulation + or extraction of Certificate. This certificate can then be used to sign new authentication + tokens specially inside Federated environments such as Windows ADFS. +type: ESCU +references: [] +author: Rod Soto, Splunk +search: 'source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" app="C:\\Windows\\System32\\certutil.exe" + CommandLine="certutil.exe -exportPFX powershellcert.pfx" | table User app CommandLine process_current_directory + | `certutil_exe_certificate_extraction_filter`' +known_false_positives: Unless there are specific use cases, manipulating or exporting certificates using certutil is + uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns + targeting Federated services. +tags: + analytics_story: + - Windows Persistence Techniques + - Cloud Federated Credential Abuse + mitre_attack_id: + - T1552.004 + kill_chain_phases: + - Installation + security_domain: endpoint + asset_type: Endpoint + automated_detection_testing: n/a + dataset: + - TBU diff --git a/stories/cloud_federated_credential_abuse.yml b/stories/cloud_federated_credential_abuse.yml new file mode 100644 index 0000000000..97ccec4b9d --- /dev/null +++ b/stories/cloud_federated_credential_abuse.yml @@ -0,0 +1,25 @@ +name: Cloud Federated Credential Abuse +id: cecdc1e7-0af2-4a55-8967-b9ea62c0317d +version: 1 +date: '2021-01-26' +description: This analytical story addresses events that indicate abuse of cloud federated credentials. + These credentials are usually extracted from endpoint desktop or servers specially those + servers that provide federation services such as Windows Active Directory Federation Services. + Identity Federation relies on objects such as Oauth2 tokens, cookies or SAML assertions in order + to provide seamless access between cloud and perimeter environments. If these objects are either + hijacked or forged then attackers will be able to pivot into victim's cloud environements. +narrative: This story is composed of detection searches based on endpoint that addresses the use of + Mimikatz, Escalation of Privileges and Abnormal processes that may indicate the extraction of Federated + directory objects such as passwords, Oauth2 tokens, certificates and keys. Cloud environment (AWS, Azure) + related events are also addressed in specific cloud environment detection searches. +author: Rod Soto, Splunk +type: ESCU +references: +- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +tags: + analytics_story: Cloud Federated Credential Abuse + usecase: Security Monitoring + category: + - Cloud Security From 5facbf0cf89fa1cd868093fa49bcfb174dcdf0c1 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 26 Jan 2021 16:59:56 -0500 Subject: [PATCH 02/26] awssamlaccessbyprovideruserandprincipal --- ..._access_by_provider_user_and_principal.yml | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) create mode 100644 detections/cloud/aws_saml_access_by_provider_user_and_principal.yml diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml new file mode 100644 index 0000000000..d9d9125dd7 --- /dev/null +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -0,0 +1,39 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. + This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially + in federated environments using SAML protocol inside the perimeter or cloud provider. +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with cloudtrail logs +id: bbe23980-6019-11eb-ae93-0242ac130002 +known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as + accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress + user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches + can provide the necessary context to detect these attacks. +name: AWS SAML access by provider user and principal +references: +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps +search: sourcetype="aws:cloudtrail" Assumerolewithsaml | spath "requestParameters.principalArn" | search "requestParameters.principalArn"=* + | spath "requestParameters.roleArn" | search "requestParameters.roleArn"=* | spath "requestParameters.roleSessionName" + | search "requestParameters.roleSessionName"=* | spath recipientAccountId | search recipientAccountId=* + | spath "responseElements.assumedRoleUser.arn" | search "responseElements.assumedRoleUser.arn"=* + | spath "responseElements.assumedRoleUser.assumedRoleId" | search "responseElements.assumedRoleUser.assumedRoleId"=* + | spath "responseElements.issuer" | search "responseElements.issuer"=* | spath sourceIPAddress | search sourceIPAddress=* + | spath userAgent | search userAgent=* + | table requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId recipientAccountId responseElements.issuer sourceIPAddress userAgent + |`aws_saml_access_by_provider_user_and_principal_filter`' +tags: + analytics_story: + - Cloud Federated Credential Abuse + asset_type: AWS Federated Account + mitre_attack_id: + - T1078 + security_domain: threat + automated_detection_testing: n/a + dataset: + - TBU +type: ESCU +version: 1 From d0a48bcb2f844435ee8c6711dc1a0b08a911fe83 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 26 Jan 2021 18:47:16 -0500 Subject: [PATCH 03/26] awssamlupdateidentityprovider --- .../aws_saml_update_identity_provider.yml | 30 +++++++++++++++++++ 1 file changed, 30 insertions(+) create mode 100644 detections/cloud/aws_saml_update_identity_provider.yml diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml new file mode 100644 index 0000000000..81dd39dec1 --- /dev/null +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -0,0 +1,30 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely + as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. +how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This + search works with cloudtrail logs. +id: 2f0604c6-6030-11eb-ae93-0242ac130002 +known_false_positives: Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. +name: AWS SAML access by provider user and principal +references: +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps +search: sourcetype="aws:cloudtrail" eventtype=aws_cloudtrail_iam_change federation | spath eventSource | search eventSource="iam.amazonaws.com" + | spath eventName | search eventName=UpdateSAMLProvider | spath "requestParameters.sAMLProviderArn" | search "*" + | spath "userIdentity.sessionContext.sessionIssuer.arn" | search "userIdentity.sessionContext.sessionIssuer.arn"="*" | spath "userIdentity.accessKeyId" | search "userIdentity.accessKeyId"=* | spath "userIdentity.principalId" | search "userIdentity.principalId"="*" | table eventType eventName requestParameters.sAMLProviderArn userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId userIdentity.principalId + |`aws_saml_update_identity_provider_filter`' +tags: + analytics_story: + - Cloud Federated Credential Abuse + asset_type: AWS Federated Account + mitre_attack_id: + - T1078 + security_domain: threat + automated_detection_testing: n/a + dataset: + - TBU +type: ESCU +version: 1 From 43ac587efbc08de14db788ea414380975a941c51 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 26 Jan 2021 20:30:37 -0500 Subject: [PATCH 04/26] o365ssologonerrors --- .../cloud/o365_excessive_sso_logon_errors.yml | 31 +++++++++++++++++++ 1 file changed, 31 insertions(+) create mode 100644 detections/cloud/o365_excessive_sso_logon_errors.yml diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml new file mode 100644 index 0000000000..c9f3f1bd6e --- /dev/null +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -0,0 +1,31 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors + may indicate attempts to bruteforce of password or single sign on token hijack or reuse. +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search + works with o365:management:activity +id: 8158ccc4-6038-11eb-ae93-0242ac130002 +known_false_positives: Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password + obtained via credential access attack. +name: O365 Excessive SSO logon errors +references: +- https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/ +search: sourcetype="o365:management:activity" Workload=AzureActiveDirectory ActorIpAddress=* UserAgent=* LogonError=SsoArtifactInvalidOrExpired + | spath UserId | search UserId="*" | table ActorIpAddress UserAgent LogonError UserId + |stats count by LogonError ActorIpAddress UserAgent UserId + | `o365_excessive_sso_logon_errors_filter`' +tags: + analytics_story: + - Office 365 Detections + - Cloud Federated Credential Abuse + asset_type: Office 365 + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1556 + security_domain: threat + automated_detection_testing: n/a + dataset: + - TBU +type: ESCU +version: 1 From 645e87f4618e31fcc727c0f2fb8faca72bbe90a0 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 26 Jan 2021 21:18:15 -0500 Subject: [PATCH 05/26] o365addapproleassignmentgrantuser --- ..._access_by_provider_user_and_principal.yml | 2 +- ...365_add_app_role_assignment_grant_user.yml | 30 +++++++++++++++++++ 2 files changed, 31 insertions(+), 1 deletion(-) create mode 100644 detections/cloud/o365_add_app_role_assignment_grant_user.yml diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index d9d9125dd7..e8a59351cd 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -10,7 +10,7 @@ known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. -name: AWS SAML access by provider user and principal +name: aws saml access by provider user and principal references: - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml new file mode 100644 index 0000000000..9160156fd8 --- /dev/null +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -0,0 +1,30 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search + works with o365:management:activity +id: b2c81cc6-6040-11eb-ae93-0242ac130002 +known_false_positives: The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, + as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. +name: o365 add app role assignment grant user +references: +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +search: sourcetype="o365:management:activity" Workload=AzureActiveDirectory | spath Operation | search Operation="Add app role assignment grant to user." + | table ActorIpAddress Actor{}.ID Actor{}.Type dest ResultStatus + | `o365_add_app_role_assignment_grant_user_filter`' +tags: + analytics_story: + - Office 365 Detections + - Cloud Federated Credential Abuse + asset_type: Office 365 + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1136 + security_domain: threat + automated_detection_testing: n/a + dataset: + - TBU +type: ESCU +version: 1 From e841476a3268ae21c62e245e1f9a8ac840d1862e Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 26 Jan 2021 21:30:39 -0500 Subject: [PATCH 06/26] o365addedserviceprincipal --- .../cloud/o365_added_service_principal.yml | 34 +++++++++++++++++++ 1 file changed, 34 insertions(+) create mode 100644 detections/cloud/o365_added_service_principal.yml diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml new file mode 100644 index 0000000000..138b036362 --- /dev/null +++ b/detections/cloud/o365_added_service_principal.yml @@ -0,0 +1,34 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search + works with o365:management:activity +id: 1668812a-6047-11eb-ae93-0242ac130002 +known_false_positives: The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, + as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. +name: o365 add app role assignment grant user +references: +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html +- https://www.sygnia.co/golden-saml-advisory +search: sourcetype="o365:management:activity" Workload=AzureActiveDirectory signature="Add service principal credentials." + | spath "Actor{}.ID" | search "Actor{}.ID"="*" | spath "ModifiedProperties{}.Name" | search "ModifiedProperties{}.Name"="TargetId.ServicePrincipalNames" + | spath "ExtendedProperties{}.Value" | search "ExtendedProperties{}.Value"=ServicePrincipal | spath "ModifiedProperties{}.NewValue" | search "ModifiedProperties{}.NewValue"="*" + | spath "Target{}.ID" | search "Target{}.ID"="*" | table ActorIpAddress Actor{}.ID signature ModifiedProperties{}.Name ModifiedProperties{}.NewValue Target{}.ID + | `o365_added_service_principal_filter`' +tags: + analytics_story: + - Office 365 Detections + - Cloud Federated Credential Abuse + asset_type: Office 365 + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1136 + security_domain: threat + automated_detection_testing: n/a + dataset: + - TBU +type: ESCU +version: 1 From 4c14ca7e2c62ab436f6ddc8c45474d20256a9082 Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Tue, 26 Jan 2021 21:43:48 -0500 Subject: [PATCH 07/26] o365newfederedateddomainadded --- .../cloud/o365_new_federated_domain_added.yml | 33 +++++++++++++++++++ 1 file changed, 33 insertions(+) create mode 100644 detections/cloud/o365_new_federated_domain_added.yml diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml new file mode 100644 index 0000000000..fb26bd8e87 --- /dev/null +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -0,0 +1,33 @@ +author: Rod Soto, Splunk +date: '2021-01-26' +description: This search detects the addition of a new Federated domain. +how_to_implement: You must install splunk Microsoft Office 365 add-on. This search + works with o365:management:activity +id: e155876a-6048-11eb-ae93-0242ac130002 +known_false_positives: The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, + as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. +name: o365 add app role assignment grant user +references: +- https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf +- https://us-cert.cisa.gov/ncas/alerts/aa21-008a +- https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html +- https://www.sygnia.co/golden-saml-advisory +- https://o365blog.com/post/aadbackdoor/ +search: sourcetype="o365:management:activity" Workload=Exchange | spath Operation | search Operation="Add-FederatedDomain" + | spath "Parameters{}.Value" | search "Parameters{}.Value"="*"| table ObjectId Operation OrganizationName OriginatingServer UserId UserKey Parameters{}.Value + | `o365_new_federated_domain_added_filter`' +tags: + analytics_story: + - Office 365 Detections + - Cloud Federated Credential Abuse + asset_type: Office 365 + kill_chain_phases: + - Actions on Objective + mitre_attack_id: + - T1136 + security_domain: threat + automated_detection_testing: n/a + dataset: + - TBU +type: ESCU +version: 1 From c35446dcc907919b097a8feb9191e5541a5c871e Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Wed, 27 Jan 2021 14:19:32 -0500 Subject: [PATCH 08/26] fix --- detections/cloud/o365_new_federated_domain_added.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index fb26bd8e87..1146d000e9 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -2,7 +2,7 @@ author: Rod Soto, Splunk date: '2021-01-26' description: This search detects the addition of a new Federated domain. how_to_implement: You must install splunk Microsoft Office 365 add-on. This search - works with o365:management:activity + works with o365:management:activity. id: e155876a-6048-11eb-ae93-0242ac130002 known_false_positives: The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. From b5befe9b5de3aa338c02f714217280e68635109f Mon Sep 17 00:00:00 2001 From: Rod Soto Date: Thu, 28 Jan 2021 14:00:36 -0500 Subject: [PATCH 09/26] tagsonsearchescloudfederated --- detections/cloud/o365_add_app_role_assignment_grant_user.yml | 2 +- detections/cloud/o365_added_service_principal.yml | 2 +- detections/cloud/o365_new_federated_domain_added.yml | 2 +- detections/deprecated/detect_mimikatz_using_loaded_images.yml | 3 ++- .../detect_mimikatz_via_powershell_and_eventcode_4703.yml | 2 ++ detections/deprecated/uncommon_processes_on_endpoint.yml | 1 + detections/endpoint/detect_rare_executables.yml | 1 + .../endpoint/registry_keys_used_for_privilege_escalation.yml | 1 + 8 files changed, 10 insertions(+), 4 deletions(-) diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 9160156fd8..a6afb6dc12 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -21,7 +21,7 @@ tags: kill_chain_phases: - Actions on Objective mitre_attack_id: - - T1136 + - T1136.003 security_domain: threat automated_detection_testing: n/a dataset: diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 138b036362..0691b9c7f5 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -25,7 +25,7 @@ tags: kill_chain_phases: - Actions on Objective mitre_attack_id: - - T1136 + - T1136.003 security_domain: threat automated_detection_testing: n/a dataset: diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 1146d000e9..9bcc518cac 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -24,7 +24,7 @@ tags: kill_chain_phases: - Actions on Objective mitre_attack_id: - - T1136 + - T1136.003 security_domain: threat automated_detection_testing: n/a dataset: diff --git a/detections/deprecated/detect_mimikatz_using_loaded_images.yml b/detections/deprecated/detect_mimikatz_using_loaded_images.yml index af7bfefbcb..8919cd6651 100644 --- a/detections/deprecated/detect_mimikatz_using_loaded_images.yml +++ b/detections/deprecated/detect_mimikatz_using_loaded_images.yml @@ -20,11 +20,12 @@ search: '`sysmon` EventCode=7 | stats values(ImageLoaded) as ImageLoaded values( Computer as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_mimikatz_using_loaded_images_filter`' known_false_positives: Other tools can import the same DLLs. These tools should be - part of a whtelist. + part of a whitelist. tags: analytics_story: - Credential Dumping - Detect Zerologon Attack + - Cloud Federated Credential Abuse mitre_attack_id: - T1003.001 kill_chain_phases: diff --git a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml index df72bec23d..656f6b8130 100644 --- a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml +++ b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml @@ -25,6 +25,8 @@ known_false_positives: The activity may be legitimate. PowerShell is often used in those cases. In these cases, false positives should be fairly obvious and you may need to tweak the search to eliminate noise. tags: + analytics_story: + - Cloud Federated Credential Abuse mitre_attack_id: - T1003.001 kill_chain_phases: diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/detections/deprecated/uncommon_processes_on_endpoint.yml index 57cf51b81b..e4e25dc322 100644 --- a/detections/deprecated/uncommon_processes_on_endpoint.yml +++ b/detections/deprecated/uncommon_processes_on_endpoint.yml @@ -24,6 +24,7 @@ tags: analytics_story: - Windows Privilege Escalation - Unusual Processes + - Cloud Federated Credential Abuse mitre_attack_id: - T1204.002 kill_chain_phases: diff --git a/detections/endpoint/detect_rare_executables.yml b/detections/endpoint/detect_rare_executables.yml index 0f4c970998..60bf02eef5 100644 --- a/detections/endpoint/detect_rare_executables.yml +++ b/detections/endpoint/detect_rare_executables.yml @@ -30,6 +30,7 @@ tags: analytics_story: - 'Emotet Malware DHS Report TA18-201A ' - Unusual Processes + - Cloud Federated Credential Abuse kill_chain_phases: - Installation - Command and Control diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 049395f3af..c06120593d 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -28,6 +28,7 @@ tags: analytics_story: - Windows Privilege Escalation - Suspicious Windows Registry Activities + - Cloud Federated Credential Abuse mitre_attack_id: - T1546.012 kill_chain_phases: From 1aa02ceb6fdb25871786aa97a26734be050fbbb7 Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 28 Jan 2021 15:10:37 -0800 Subject: [PATCH 10/26] update ymls to remove validation errors --- .../aws_saml_access_by_provider_user_and_principal.yml | 7 ++----- detections/cloud/aws_saml_update_identity_provider.yml | 7 ++----- .../cloud/o365_add_app_role_assignment_grant_user.yml | 7 ++----- detections/cloud/o365_added_service_principal.yml | 7 ++----- detections/cloud/o365_excessive_sso_logon_errors.yml | 5 +---- detections/cloud/o365_new_federated_domain_added.yml | 7 ++----- 6 files changed, 11 insertions(+), 29 deletions(-) diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index e8a59351cd..2cab991c65 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -10,13 +10,13 @@ known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches can provide the necessary context to detect these attacks. -name: aws saml access by provider user and principal +name: AWS SAML Access by Provider User and Principal references: - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps -search: sourcetype="aws:cloudtrail" Assumerolewithsaml | spath "requestParameters.principalArn" | search "requestParameters.principalArn"=* +search: '`cloudtrail` Assumerolewithsaml | spath "requestParameters.principalArn" | search "requestParameters.principalArn"=* | spath "requestParameters.roleArn" | search "requestParameters.roleArn"=* | spath "requestParameters.roleSessionName" | search "requestParameters.roleSessionName"=* | spath recipientAccountId | search recipientAccountId=* | spath "responseElements.assumedRoleUser.arn" | search "responseElements.assumedRoleUser.arn"=* @@ -32,8 +32,5 @@ tags: mitre_attack_id: - T1078 security_domain: threat - automated_detection_testing: n/a - dataset: - - TBU type: ESCU version: 1 diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index 81dd39dec1..723ffcad85 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -6,13 +6,13 @@ how_to_implement: You must install splunk AWS add on and Splunk App for AWS. Thi search works with cloudtrail logs. id: 2f0604c6-6030-11eb-ae93-0242ac130002 known_false_positives: Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. -name: AWS SAML access by provider user and principal +name: AWS SAML Update identity provider references: - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps -search: sourcetype="aws:cloudtrail" eventtype=aws_cloudtrail_iam_change federation | spath eventSource | search eventSource="iam.amazonaws.com" +search: '`cloudtrail` federation | spath eventSource | search eventSource="iam.amazonaws.com" | spath eventName | search eventName=UpdateSAMLProvider | spath "requestParameters.sAMLProviderArn" | search "*" | spath "userIdentity.sessionContext.sessionIssuer.arn" | search "userIdentity.sessionContext.sessionIssuer.arn"="*" | spath "userIdentity.accessKeyId" | search "userIdentity.accessKeyId"=* | spath "userIdentity.principalId" | search "userIdentity.principalId"="*" | table eventType eventName requestParameters.sAMLProviderArn userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId userIdentity.principalId |`aws_saml_update_identity_provider_filter`' @@ -23,8 +23,5 @@ tags: mitre_attack_id: - T1078 security_domain: threat - automated_detection_testing: n/a - dataset: - - TBU type: ESCU version: 1 diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index a6afb6dc12..a068606501 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -6,11 +6,11 @@ how_to_implement: You must install splunk Microsoft Office 365 add-on. This sear id: b2c81cc6-6040-11eb-ae93-0242ac130002 known_false_positives: The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. -name: o365 add app role assignment grant user +name: O365 Add App Role Assignment Grant User references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a -search: sourcetype="o365:management:activity" Workload=AzureActiveDirectory | spath Operation | search Operation="Add app role assignment grant to user." +search: '`o365_management_activity` Workload=AzureActiveDirectory | spath Operation | search Operation="Add app role assignment grant to user." | table ActorIpAddress Actor{}.ID Actor{}.Type dest ResultStatus | `o365_add_app_role_assignment_grant_user_filter`' tags: @@ -23,8 +23,5 @@ tags: mitre_attack_id: - T1136.003 security_domain: threat - automated_detection_testing: n/a - dataset: - - TBU type: ESCU version: 1 diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 0691b9c7f5..560614244b 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -6,13 +6,13 @@ how_to_implement: You must install splunk Microsoft Office 365 add-on. This sear id: 1668812a-6047-11eb-ae93-0242ac130002 known_false_positives: The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. -name: o365 add app role assignment grant user +name: O365 Added Service Principal references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.sygnia.co/golden-saml-advisory -search: sourcetype="o365:management:activity" Workload=AzureActiveDirectory signature="Add service principal credentials." +search: '`o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." | spath "Actor{}.ID" | search "Actor{}.ID"="*" | spath "ModifiedProperties{}.Name" | search "ModifiedProperties{}.Name"="TargetId.ServicePrincipalNames" | spath "ExtendedProperties{}.Value" | search "ExtendedProperties{}.Value"=ServicePrincipal | spath "ModifiedProperties{}.NewValue" | search "ModifiedProperties{}.NewValue"="*" | spath "Target{}.ID" | search "Target{}.ID"="*" | table ActorIpAddress Actor{}.ID signature ModifiedProperties{}.Name ModifiedProperties{}.NewValue Target{}.ID @@ -27,8 +27,5 @@ tags: mitre_attack_id: - T1136.003 security_domain: threat - automated_detection_testing: n/a - dataset: - - TBU type: ESCU version: 1 diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index c9f3f1bd6e..3b872406e7 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -10,7 +10,7 @@ known_false_positives: Logon errors may not be malicious in nature however it ma name: O365 Excessive SSO logon errors references: - https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/ -search: sourcetype="o365:management:activity" Workload=AzureActiveDirectory ActorIpAddress=* UserAgent=* LogonError=SsoArtifactInvalidOrExpired +search: '`o365_management_activity` Workload=AzureActiveDirectory ActorIpAddress=* UserAgent=* LogonError=SsoArtifactInvalidOrExpired | spath UserId | search UserId="*" | table ActorIpAddress UserAgent LogonError UserId |stats count by LogonError ActorIpAddress UserAgent UserId | `o365_excessive_sso_logon_errors_filter`' @@ -24,8 +24,5 @@ tags: mitre_attack_id: - T1556 security_domain: threat - automated_detection_testing: n/a - dataset: - - TBU type: ESCU version: 1 diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 9bcc518cac..3e3724b4d0 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -6,14 +6,14 @@ how_to_implement: You must install splunk Microsoft Office 365 add-on. This sear id: e155876a-6048-11eb-ae93-0242ac130002 known_false_positives: The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. -name: o365 add app role assignment grant user +name: O365 New Federated Domain Added references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.sygnia.co/golden-saml-advisory - https://o365blog.com/post/aadbackdoor/ -search: sourcetype="o365:management:activity" Workload=Exchange | spath Operation | search Operation="Add-FederatedDomain" +search: '`o365_management_activity` Workload=Exchange | spath Operation | search Operation="Add-FederatedDomain" | spath "Parameters{}.Value" | search "Parameters{}.Value"="*"| table ObjectId Operation OrganizationName OriginatingServer UserId UserKey Parameters{}.Value | `o365_new_federated_domain_added_filter`' tags: @@ -26,8 +26,5 @@ tags: mitre_attack_id: - T1136.003 security_domain: threat - automated_detection_testing: n/a - dataset: - - TBU type: ESCU version: 1 From 99c9958701c75ca164b29a89c2a767ae1de22426 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 1 Feb 2021 17:04:56 +0100 Subject: [PATCH 11/26] fixed Spl --- ...s_saml_access_by_provider_user_and_principal.yml | 13 ++++--------- .../cloud/aws_saml_update_identity_provider.yml | 6 +++--- .../o365_add_app_role_assignment_grant_user.yml | 5 +++-- detections/cloud/o365_added_service_principal.yml | 6 +++--- .../cloud/o365_excessive_sso_logon_errors.yml | 7 ++++--- .../cloud/o365_new_federated_domain_added.yml | 5 +++-- 6 files changed, 20 insertions(+), 22 deletions(-) diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index 2cab991c65..498561dd8e 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -16,15 +16,10 @@ references: - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps -search: '`cloudtrail` Assumerolewithsaml | spath "requestParameters.principalArn" | search "requestParameters.principalArn"=* - | spath "requestParameters.roleArn" | search "requestParameters.roleArn"=* | spath "requestParameters.roleSessionName" - | search "requestParameters.roleSessionName"=* | spath recipientAccountId | search recipientAccountId=* - | spath "responseElements.assumedRoleUser.arn" | search "responseElements.assumedRoleUser.arn"=* - | spath "responseElements.assumedRoleUser.assumedRoleId" | search "responseElements.assumedRoleUser.assumedRoleId"=* - | spath "responseElements.issuer" | search "responseElements.issuer"=* | spath sourceIPAddress | search sourceIPAddress=* - | spath userAgent | search userAgent=* - | table requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId recipientAccountId responseElements.issuer sourceIPAddress userAgent - |`aws_saml_access_by_provider_user_and_principal_filter`' +search: '`cloudtrail` eventName=Assumerolewithsaml + | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress userAgent + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + |`aws_saml_access_by_provider_user_and_principal_filter`' tags: analytics_story: - Cloud Federated Credential Abuse diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index 723ffcad85..54dbed56ff 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -12,9 +12,9 @@ references: - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps -search: '`cloudtrail` federation | spath eventSource | search eventSource="iam.amazonaws.com" - | spath eventName | search eventName=UpdateSAMLProvider | spath "requestParameters.sAMLProviderArn" | search "*" - | spath "userIdentity.sessionContext.sessionIssuer.arn" | search "userIdentity.sessionContext.sessionIssuer.arn"="*" | spath "userIdentity.accessKeyId" | search "userIdentity.accessKeyId"=* | spath "userIdentity.principalId" | search "userIdentity.principalId"="*" | table eventType eventName requestParameters.sAMLProviderArn userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId userIdentity.principalId +search: '`cloudtrail` eventName=UpdateSAMLProvider + | stats count min(_time) as firstTime max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId userIdentity.principalId + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_saml_update_identity_provider_filter`' tags: analytics_story: diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index a068606501..317c6d170a 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -10,8 +10,9 @@ name: O365 Add App Role Assignment Grant User references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a -search: '`o365_management_activity` Workload=AzureActiveDirectory | spath Operation | search Operation="Add app role assignment grant to user." - | table ActorIpAddress Actor{}.ID Actor{}.Type dest ResultStatus +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." + | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by ActorIpAddress dest ResultStatus + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`' tags: analytics_story: diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 560614244b..b6ed8a4626 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -13,9 +13,9 @@ references: - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.sygnia.co/golden-saml-advisory search: '`o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." - | spath "Actor{}.ID" | search "Actor{}.ID"="*" | spath "ModifiedProperties{}.Name" | search "ModifiedProperties{}.Name"="TargetId.ServicePrincipalNames" - | spath "ExtendedProperties{}.Value" | search "ExtendedProperties{}.Value"=ServicePrincipal | spath "ModifiedProperties{}.NewValue" | search "ModifiedProperties{}.NewValue"="*" - | spath "Target{}.ID" | search "Target{}.ID"="*" | table ActorIpAddress Actor{}.ID signature ModifiedProperties{}.Name ModifiedProperties{}.NewValue Target{}.ID + | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name + values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`' tags: analytics_story: diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 3b872406e7..95e835d54b 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -10,9 +10,10 @@ known_false_positives: Logon errors may not be malicious in nature however it ma name: O365 Excessive SSO logon errors references: - https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/ -search: '`o365_management_activity` Workload=AzureActiveDirectory ActorIpAddress=* UserAgent=* LogonError=SsoArtifactInvalidOrExpired - | spath UserId | search UserId="*" | table ActorIpAddress UserAgent LogonError UserId - |stats count by LogonError ActorIpAddress UserAgent UserId +search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired + | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId + | where count > 5 + | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`' tags: analytics_story: diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 3e3724b4d0..f1c3e31fdd 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -13,8 +13,9 @@ references: - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.sygnia.co/golden-saml-advisory - https://o365blog.com/post/aadbackdoor/ -search: '`o365_management_activity` Workload=Exchange | spath Operation | search Operation="Add-FederatedDomain" - | spath "Parameters{}.Value" | search "Parameters{}.Value"="*"| table ObjectId Operation OrganizationName OriginatingServer UserId UserKey Parameters{}.Value +search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" + | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId UserKey + | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`' tags: analytics_story: From 99501707257a218e76fab4f1573716c2252693db Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 1 Feb 2021 17:31:01 +0100 Subject: [PATCH 12/26] update --- .../process_creating_lnk_file_in_suspicious_location.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/endpoint/process_creating_lnk_file_in_suspicious_location.test.yml b/tests/endpoint/process_creating_lnk_file_in_suspicious_location.test.yml index 5f88dcf0de..97f58b4519 100644 --- a/tests/endpoint/process_creating_lnk_file_in_suspicious_location.test.yml +++ b/tests/endpoint/process_creating_lnk_file_in_suspicious_location.test.yml @@ -1,7 +1,7 @@ name: Process Creating LNK file in Suspicious location Unit Test tests: -- name: Process Creating LNK file in Suspicious Location - file: endpoint/process_creating_lnk_in_suspicious_location.yml +- name: Process Creating LNK file in Suspicious Location + file: endpoint/process_creating_lnk_file_in_suspicious_location.yml pass_condition: '| stats count | where count > 0' earliest_time: '-24h' latest_time: 'now' From 24355708a1c700ff729ea6bcc2a39b6e1155ebd1 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 2 Feb 2021 10:13:54 +0100 Subject: [PATCH 13/26] added detection tests --- ...l_access_by_provider_user_and_principal.test.yml | 13 +++++++++++++ .../aws_saml_update_identity_provider.test.yml | 13 +++++++++++++ ...o365_add_app_role_assignment_grant_user.test.yml | 12 ++++++++++++ tests/cloud/o365_added_service_principal.test.yml | 12 ++++++++++++ .../cloud/o365_excessive_sso_logon_errors.test.yml | 12 ++++++++++++ .../cloud/o365_new_federated_domain_added.test.yml | 12 ++++++++++++ 6 files changed, 74 insertions(+) create mode 100644 tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml create mode 100644 tests/cloud/aws_saml_update_identity_provider.test.yml create mode 100644 tests/cloud/o365_add_app_role_assignment_grant_user.test.yml create mode 100644 tests/cloud/o365_added_service_principal.test.yml create mode 100644 tests/cloud/o365_excessive_sso_logon_errors.test.yml create mode 100644 tests/cloud/o365_new_federated_domain_added.test.yml diff --git a/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml b/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml new file mode 100644 index 0000000000..ab99ac7fed --- /dev/null +++ b/tests/cloud/aws_saml_access_by_provider_user_and_principal.test.yml @@ -0,0 +1,13 @@ +name: AWS SAML Access by Provider User and Principal Unit Test +tests: +- name: AWS SAML Access by Provider User and Principal + file: cloud/aws_saml_access_by_provider_user_and_principal.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/aws_saml_update_identity_provider.test.yml b/tests/cloud/aws_saml_update_identity_provider.test.yml new file mode 100644 index 0000000000..2e5bc38378 --- /dev/null +++ b/tests/cloud/aws_saml_update_identity_provider.test.yml @@ -0,0 +1,13 @@ +name: AWS SAML Update identity provider Unit Test +tests: +- name: AWS SAML Update identity provider + file: cloud/aws_saml_update_identity_provider.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: aws_cloudtrail_events.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json + sourcetype: aws:cloudtrail + source: aws_cloudtrail + update_timestamp: True diff --git a/tests/cloud/o365_add_app_role_assignment_grant_user.test.yml b/tests/cloud/o365_add_app_role_assignment_grant_user.test.yml new file mode 100644 index 0000000000..9e1738fb4a --- /dev/null +++ b/tests/cloud/o365_add_app_role_assignment_grant_user.test.yml @@ -0,0 +1,12 @@ +name: O365 Add App Role Assignment Grant User Unit Test +tests: +- name: O365 Add App Role Assignment Grant User + file: cloud/o365_add_app_role_assignment_grant_user.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: o365_management_activity.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation.json + sourcetype: 'o365:management:activity' + source: 'o365' diff --git a/tests/cloud/o365_added_service_principal.test.yml b/tests/cloud/o365_added_service_principal.test.yml new file mode 100644 index 0000000000..b2ee0440f1 --- /dev/null +++ b/tests/cloud/o365_added_service_principal.test.yml @@ -0,0 +1,12 @@ +name: O365 Added Service Principal Unit Test +tests: +- name: O365 Added Service Principal + file: cloud/o365_added_service_principal.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: o365_management_activity.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.json + sourcetype: 'o365:management:activity' + source: 'o365' diff --git a/tests/cloud/o365_excessive_sso_logon_errors.test.yml b/tests/cloud/o365_excessive_sso_logon_errors.test.yml new file mode 100644 index 0000000000..3546060cfc --- /dev/null +++ b/tests/cloud/o365_excessive_sso_logon_errors.test.yml @@ -0,0 +1,12 @@ +name: O365 Excessive SSO logon errors Unit Test +tests: +- name: O365 Excessive SSO logon errors + file: cloud/o365_excessive_sso_logon_errors.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: o365_management_activity.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors.json + sourcetype: 'o365:management:activity' + source: 'o365' diff --git a/tests/cloud/o365_new_federated_domain_added.test.yml b/tests/cloud/o365_new_federated_domain_added.test.yml new file mode 100644 index 0000000000..80dae8a119 --- /dev/null +++ b/tests/cloud/o365_new_federated_domain_added.test.yml @@ -0,0 +1,12 @@ +name: O365 New Federated Domain Added Unit Test +tests: +- name: O365 New Federated Domain Added + file: cloud/o365_new_federated_domain_added.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: o365_management_activity.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/oo365_new_federated_domain.json + sourcetype: 'o365:management:activity' + source: 'o365' From 44d6c32803916db3380c03734e9af01bfa14503d Mon Sep 17 00:00:00 2001 From: root Date: Tue, 2 Feb 2021 09:37:17 +0000 Subject: [PATCH 14/26] Added detection testing service results inAWS SAML Update identity provider --- .../aws_saml_update_identity_provider.yml | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index 54dbed56ff..8a7321ae2c 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -1,20 +1,24 @@ author: Rod Soto, Splunk date: '2021-01-26' -description: This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely - as they may indicate possible perimeter compromise of federated credentials, or backdoor access from another cloud provider set by attacker. +description: This search provides detection of updates to SAML provider in AWS. Updates + to SAML provider need to be monitored closely as they may indicate possible perimeter + compromise of federated credentials, or backdoor access from another cloud provider + set by attacker. how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs. id: 2f0604c6-6030-11eb-ae93-0242ac130002 -known_false_positives: Updating a SAML provider or creating a new one may not necessarily be malicious however it needs to be closely monitored. +known_false_positives: Updating a SAML provider or creating a new one may not necessarily + be malicious however it needs to be closely monitored. name: AWS SAML Update identity provider references: - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps -search: '`cloudtrail` eventName=UpdateSAMLProvider - | stats count min(_time) as firstTime max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId userIdentity.principalId - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` +search: '`cloudtrail` eventName=UpdateSAMLProvider | stats count min(_time) as firstTime + max(_time) as lastTime by eventType eventName requestParameters.sAMLProviderArn + userIdentity.sessionContext.sessionIssuer.arn sourceIPAddress userIdentity.accessKeyId + userIdentity.principalId | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_saml_update_identity_provider_filter`' tags: analytics_story: @@ -23,5 +27,8 @@ tags: mitre_attack_id: - T1078 security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/update_saml_provider/update_saml_provider.json type: ESCU version: 1 From 82c6321c5fdbba500f3e713714a7f485b2399cb0 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 2 Feb 2021 09:38:07 +0000 Subject: [PATCH 15/26] Added detection testing service results inAWS SAML Access by Provider User and Principal --- ..._access_by_provider_user_and_principal.yml | 27 ++++++++++++------- 1 file changed, 17 insertions(+), 10 deletions(-) diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index 498561dd8e..9ac60556e2 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -1,24 +1,28 @@ author: Rod Soto, Splunk date: '2021-01-26' -description: This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. - This search provides specific information to detect abnormal access or potential credential hijack or forgery, specially - in federated environments using SAML protocol inside the perimeter or cloud provider. +description: This search provides specific SAML access from specific Service Provider, + user and targeted principal at AWS. This search provides specific information to + detect abnormal access or potential credential hijack or forgery, specially in federated + environments using SAML protocol inside the perimeter or cloud provider. how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with cloudtrail logs id: bbe23980-6019-11eb-ae93-0242ac130002 -known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries are very difficult to detect as - accessing cloud providers with these assertions looks exactly like normal access, however things such as source IP sourceIPAddress - user, and principal targeted at receiving cloud provider along with endpoint credential access and abuse detection searches - can provide the necessary context to detect these attacks. +known_false_positives: Attacks using a Golden SAML or SAML assertion hijacks or forgeries + are very difficult to detect as accessing cloud providers with these assertions + looks exactly like normal access, however things such as source IP sourceIPAddress + user, and principal targeted at receiving cloud provider along with endpoint credential + access and abuse detection searches can provide the necessary context to detect + these attacks. name: AWS SAML Access by Provider User and Principal references: - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://www.cyberark.com/resources/threat-research-blog/golden-saml-newly-discovered-attack-technique-forges-authentication-to-cloud-apps -search: '`cloudtrail` eventName=Assumerolewithsaml - | stats count min(_time) as firstTime max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress userAgent - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` +search: '`cloudtrail` eventName=Assumerolewithsaml | stats count min(_time) as firstTime + max(_time) as lastTime by requestParameters.principalArn requestParameters.roleArn + requestParameters.roleSessionName recipientAccountId responseElements.issuer sourceIPAddress + userAgent | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |`aws_saml_access_by_provider_user_and_principal_filter`' tags: analytics_story: @@ -27,5 +31,8 @@ tags: mitre_attack_id: - T1078 security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1078/assume_role_with_saml/assume_role_with_saml.json type: ESCU version: 1 From ba5b0875f427d4179bc82a6b9d35078e89fe3717 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 2 Feb 2021 09:47:55 +0000 Subject: [PATCH 16/26] Added detection testing service results inO365 Add App Role Assignment Grant User --- ...o365_add_app_role_assignment_grant_user.yml | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 317c6d170a..4f393bbcb6 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -1,18 +1,21 @@ author: Rod Soto, Splunk date: '2021-01-26' -description: This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +description: This search detects the creation of a new Federation setting by alerting + about an specific event related to its creation. how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity id: b2c81cc6-6040-11eb-ae93-0242ac130002 -known_false_positives: The creation of a new Federation is not necessarily malicious, however this events need to be followed closely, - as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. +known_false_positives: The creation of a new Federation is not necessarily malicious, + however this events need to be followed closely, as it may indicate federated credential + abuse or backdoor via federated identities at a different cloud provider. name: O365 Add App Role Assignment Grant User references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a -search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app role assignment grant to user." - | stats count min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by ActorIpAddress dest ResultStatus - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=AzureActiveDirectory Operation="Add app + role assignment grant to user." | stats count min(_time) as firstTime max(_time) + as lastTime values(Actor{}.ID) as Actor.ID values(Actor{}.Type) as Actor.Type by + ActorIpAddress dest ResultStatus | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_add_app_role_assignment_grant_user_filter`' tags: analytics_story: @@ -24,5 +27,8 @@ tags: mitre_attack_id: - T1136.003 security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federation/o365_new_federation.json type: ESCU version: 1 From ccf8872c46581325f7fe78cb4f86fea0ef284f6d Mon Sep 17 00:00:00 2001 From: root Date: Tue, 2 Feb 2021 10:13:09 +0000 Subject: [PATCH 17/26] Added detection testing service results inO365 Excessive SSO logon errors --- .../cloud/o365_excessive_sso_logon_errors.yml | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 95e835d54b..2195e7caf8 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -1,19 +1,19 @@ author: Rod Soto, Splunk date: '2021-01-26' -description: This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors - may indicate attempts to bruteforce of password or single sign on token hijack or reuse. +description: This search detects accounts with high number of Single Sign ON (SSO) + logon errors. Excessive logon errors may indicate attempts to bruteforce of password + or single sign on token hijack or reuse. how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity id: 8158ccc4-6038-11eb-ae93-0242ac130002 -known_false_positives: Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password - obtained via credential access attack. +known_false_positives: Logon errors may not be malicious in nature however it may + indicate attempts to reuse a token or password obtained via credential access attack. name: O365 Excessive SSO logon errors references: - https://stealthbits.com/blog/bypassing-mfa-with-pass-the-cookie/ search: '`o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired - | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId - | where count > 5 - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress + UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter`' tags: analytics_story: @@ -25,5 +25,8 @@ tags: mitre_attack_id: - T1556 security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1556/o365_sso_logon_errors/o365_sso_logon_errors.json type: ESCU version: 1 From 37bdc899157098bb4bac99cb291290edfe84e017 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 2 Feb 2021 10:13:33 +0000 Subject: [PATCH 18/26] Added detection testing service results inO365 Added Service Principal --- .../cloud/o365_added_service_principal.yml | 20 ++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index b6ed8a4626..88e3123ed8 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -1,21 +1,24 @@ author: Rod Soto, Splunk date: '2021-01-26' -description: This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. +description: This search detects the creation of a new Federation setting by alerting + about an specific event related to its creation. how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity id: 1668812a-6047-11eb-ae93-0242ac130002 -known_false_positives: The creation of a new Federation is not necessarily malicious, however these events need to be followed closely, - as it may indicate federated credential abuse or backdoor via federated identities at a different cloud provider. +known_false_positives: The creation of a new Federation is not necessarily malicious, + however these events need to be followed closely, as it may indicate federated credential + abuse or backdoor via federated identities at a different cloud provider. name: O365 Added Service Principal references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf - https://us-cert.cisa.gov/ncas/alerts/aa21-008a - https://www.splunk.com/en_us/blog/security/a-golden-saml-journey-solarwinds-continued.html - https://www.sygnia.co/golden-saml-advisory -search: '`o365_management_activity` Workload=AzureActiveDirectory signature="Add service principal credentials." - | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name - values(ModifiedProperties{}.NewValue) as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress signature - | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` +search: '`o365_management_activity` Workload=AzureActiveDirectory signature="Add service + principal credentials." | stats min(_time) as firstTime max(_time) as lastTime values(Actor{}.ID) + as Actor.ID values(ModifiedProperties{}.Name) as ModifiedProperties.Name values(ModifiedProperties{}.NewValue) + as ModifiedProperties.NewValue values(Target{}.ID) as Target.ID by ActorIpAddress + signature | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_added_service_principal_filter`' tags: analytics_story: @@ -27,5 +30,8 @@ tags: mitre_attack_id: - T1136.003 security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_add_service_principal/o365_add_service_principal.json type: ESCU version: 1 From fff2e32a35961345acdf63b0afabacf51145de64 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 2 Feb 2021 13:23:22 +0100 Subject: [PATCH 19/26] updated test file --- tests/cloud/o365_new_federated_domain_added.test.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/tests/cloud/o365_new_federated_domain_added.test.yml b/tests/cloud/o365_new_federated_domain_added.test.yml index 80dae8a119..fe66213299 100644 --- a/tests/cloud/o365_new_federated_domain_added.test.yml +++ b/tests/cloud/o365_new_federated_domain_added.test.yml @@ -3,10 +3,10 @@ tests: - name: O365 New Federated Domain Added file: cloud/o365_new_federated_domain_added.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-7d' latest_time: 'now' attack_data: - file_name: o365_management_activity.json data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/oo365_new_federated_domain.json sourcetype: 'o365:management:activity' - source: 'o365' + source: 'exchange' From 0dc3a302fde1982cb8e8b02ca85fc237126ce299 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 2 Feb 2021 14:19:33 +0100 Subject: [PATCH 20/26] small bug --- tests/cloud/o365_new_federated_domain_added.test.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/tests/cloud/o365_new_federated_domain_added.test.yml b/tests/cloud/o365_new_federated_domain_added.test.yml index fe66213299..3737d44222 100644 --- a/tests/cloud/o365_new_federated_domain_added.test.yml +++ b/tests/cloud/o365_new_federated_domain_added.test.yml @@ -10,3 +10,4 @@ tests: data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/oo365_new_federated_domain.json sourcetype: 'o365:management:activity' source: 'exchange' + update_timestamp: True From b18c30584ff1518e7d1673b88d5402ac5d3375e8 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 2 Feb 2021 15:06:58 +0100 Subject: [PATCH 21/26] fix for testing --- tests/cloud/o365_new_federated_domain_added.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/cloud/o365_new_federated_domain_added.test.yml b/tests/cloud/o365_new_federated_domain_added.test.yml index 3737d44222..7eb063af41 100644 --- a/tests/cloud/o365_new_federated_domain_added.test.yml +++ b/tests/cloud/o365_new_federated_domain_added.test.yml @@ -7,7 +7,7 @@ tests: latest_time: 'now' attack_data: - file_name: o365_management_activity.json - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/oo365_new_federated_domain.json + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json sourcetype: 'o365:management:activity' source: 'exchange' update_timestamp: True From c0edc68533d478b94182e977247b66cedb93530c Mon Sep 17 00:00:00 2001 From: root Date: Tue, 2 Feb 2021 14:26:31 +0000 Subject: [PATCH 22/26] Added detection testing service results inO365 New Federated Domain Added --- .../cloud/o365_new_federated_domain_added.yml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index f1c3e31fdd..949f8a081e 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -4,8 +4,9 @@ description: This search detects the addition of a new Federated domain. how_to_implement: You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity. id: e155876a-6048-11eb-ae93-0242ac130002 -known_false_positives: The creation of a new Federated domain is not necessarily malicious, however these events need to be followed closely, - as it may indicate federated credential abuse or backdoor via federated identities at a similar or different cloud provider. +known_false_positives: The creation of a new Federated domain is not necessarily malicious, + however these events need to be followed closely, as it may indicate federated credential + abuse or backdoor via federated identities at a similar or different cloud provider. name: O365 New Federated Domain Added references: - https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/wp-m-unc2452-2021-000343-01.pdf @@ -14,8 +15,9 @@ references: - https://www.sygnia.co/golden-saml-advisory - https://o365blog.com/post/aadbackdoor/ search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" - | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId UserKey - | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | stats count min(_time) as firstTime max(_time) as lastTime values(Parameters{}.Value) + as Parameters.Value by ObjectId Operation OrganizationName OriginatingServer UserId + UserKey | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_new_federated_domain_added_filter`' tags: analytics_story: @@ -27,5 +29,8 @@ tags: mitre_attack_id: - T1136.003 security_domain: threat + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1136.003/o365_new_federated_domain/o365_new_federated_domain.json type: ESCU version: 1 From 405ebb4dae129fa759eefc9acbed6af4c2bc4813 Mon Sep 17 00:00:00 2001 From: bpatel Date: Tue, 9 Feb 2021 16:33:53 -0800 Subject: [PATCH 23/26] spl update and test file --- .../certutil_exe_certificate_extraction.yml | 14 ++++++-------- .../certutil_exe_certificate_extraction.test.yml | 12 ++++++++++++ 2 files changed, 18 insertions(+), 8 deletions(-) create mode 100644 tests/endpoint/certutil_exe_certificate_extraction.test.yml diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index ee4c1ffb67..574d479ad1 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -8,8 +8,11 @@ description: This search looks for arguments to certutil.exe indicating the mani type: ESCU references: [] author: Rod Soto, Splunk -search: 'source="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" app="C:\\Windows\\System32\\certutil.exe" - CommandLine="certutil.exe -exportPFX powershellcert.pfx" | table User app CommandLine process_current_directory +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) + as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" + by Processes.parent_process Processes.process_name Processes.process + Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`' known_false_positives: Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns @@ -18,12 +21,7 @@ tags: analytics_story: - Windows Persistence Techniques - Cloud Federated Credential Abuse - mitre_attack_id: - - T1552.004 kill_chain_phases: - Installation security_domain: endpoint - asset_type: Endpoint - automated_detection_testing: n/a - dataset: - - TBU + asset_type: Endpoint \ No newline at end of file diff --git a/tests/endpoint/certutil_exe_certificate_extraction.test.yml b/tests/endpoint/certutil_exe_certificate_extraction.test.yml new file mode 100644 index 0000000000..d7337e7d5e --- /dev/null +++ b/tests/endpoint/certutil_exe_certificate_extraction.test.yml @@ -0,0 +1,12 @@ +name: Certutil exe certificate extraction Unit Test +tests: +- name: Certutil exe certificate extraction + file: endpoint/certutil_exe_certificate_extraction.yml + pass_condition: '| stats count | where count > 0' + earliest_time: '-24h' + latest_time: 'now' + attack_data: + - file_name: windows-sysmon.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log + source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational + sourcetype: xmlwineventlog From c27a46bd403e57247873056a1656cd7c2eb8244d Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 10 Feb 2021 14:40:13 -0800 Subject: [PATCH 24/26] update test time --- tests/endpoint/certutil_exe_certificate_extraction.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/certutil_exe_certificate_extraction.test.yml b/tests/endpoint/certutil_exe_certificate_extraction.test.yml index d7337e7d5e..b02052dfa2 100644 --- a/tests/endpoint/certutil_exe_certificate_extraction.test.yml +++ b/tests/endpoint/certutil_exe_certificate_extraction.test.yml @@ -3,7 +3,7 @@ tests: - name: Certutil exe certificate extraction file: endpoint/certutil_exe_certificate_extraction.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-24h' + earliest_time: '-2d' latest_time: 'now' attack_data: - file_name: windows-sysmon.log From 1c8dc0c0d0e4b08756d89398bd205d056f5b28db Mon Sep 17 00:00:00 2001 From: bpatel Date: Thu, 11 Feb 2021 09:02:22 -0800 Subject: [PATCH 25/26] change time --- tests/endpoint/certutil_exe_certificate_extraction.test.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tests/endpoint/certutil_exe_certificate_extraction.test.yml b/tests/endpoint/certutil_exe_certificate_extraction.test.yml index b02052dfa2..12d4601c5c 100644 --- a/tests/endpoint/certutil_exe_certificate_extraction.test.yml +++ b/tests/endpoint/certutil_exe_certificate_extraction.test.yml @@ -3,7 +3,7 @@ tests: - name: Certutil exe certificate extraction file: endpoint/certutil_exe_certificate_extraction.yml pass_condition: '| stats count | where count > 0' - earliest_time: '-2d' + earliest_time: '-7d' latest_time: 'now' attack_data: - file_name: windows-sysmon.log From eae6908d2302b0ee97b3553863c6695040062a98 Mon Sep 17 00:00:00 2001 From: root Date: Thu, 11 Feb 2021 17:21:45 +0000 Subject: [PATCH 26/26] Added detection testing service results inCertutil exe certificate extraction --- .../certutil_exe_certificate_extraction.yml | 20 ++++++++++--------- 1 file changed, 11 insertions(+), 9 deletions(-) diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 574d479ad1..18539c0bf7 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -9,14 +9,13 @@ type: ESCU references: [] author: Rod Soto, Splunk search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) - as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" - by Processes.parent_process Processes.process_name Processes.process - Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` - |`security_content_ctime(lastTime)` - | `certutil_exe_certificate_extraction_filter`' -known_false_positives: Unless there are specific use cases, manipulating or exporting certificates using certutil is - uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns - targeting Federated services. + as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe + Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name + Processes.process Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`' +known_false_positives: Unless there are specific use cases, manipulating or exporting + certificates using certutil is uncommon. Extraction of certificate has been observed + during attacks such as Golden SAML and other campaigns targeting Federated services. tags: analytics_story: - Windows Persistence Techniques @@ -24,4 +23,7 @@ tags: kill_chain_phases: - Installation security_domain: endpoint - asset_type: Endpoint \ No newline at end of file + asset_type: Endpoint + automated_detection_testing: passed + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/certutil_exe_certificate_extraction/windows-sysmon.log