From 16b771eae28c34250609aa91aa0a7906a253265f Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 14 Dec 2021 19:38:51 -0500 Subject: [PATCH 1/2] adding tags to detections --- detections/endpoint/any_powershell_downloadfile.yml | 2 ++ .../endpoint/cmd_carry_out_string_command_parameter.yml | 2 ++ detections/endpoint/curl_download_and_bash_execution.yml | 7 +++++-- detections/endpoint/hunting_for_log4shell.yml | 2 ++ .../java_class_file_download_by_java_user_agent.yml | 2 ++ ...ll_process___connect_to_internet_with_hidden_window.yml | 2 ++ detections/endpoint/wget_download_and_bash_execution.yml | 7 +++++-- .../experimental/endpoint/linux_java_spawning_shell.yml | 4 +++- .../experimental/endpoint/windows_java_spawning_shells.yml | 4 +++- detections/network/detect_outbound_ldap_traffic.yml | 2 ++ 10 files changed, 28 insertions(+), 6 deletions(-) diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index 924efa5169..354572f211 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -67,6 +67,8 @@ tags: type: Process role: - Child Process + cve: + - CVE-2021-44228 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index 043a3ddf01..cde3579f54 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -54,6 +54,8 @@ tags: type: User role: - Victim + cve: + - CVE-2021-44228 product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml index 6a4bd2b3cf..18feee42a2 100644 --- a/detections/endpoint/curl_download_and_bash_execution.yml +++ b/detections/endpoint/curl_download_and_bash_execution.yml @@ -29,7 +29,8 @@ tags: analytic_story: - Ingress Tool Transfer - Log4Shell CVE-2021-44228 - dataset: [] + dataset: + - "https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log" kill_chain_phases: - Exploitation mitre_attack_id: @@ -71,4 +72,6 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + cve: + - CVE-2021-44228 diff --git a/detections/endpoint/hunting_for_log4shell.yml b/detections/endpoint/hunting_for_log4shell.yml index 7ad19281a4..eb70cdded4 100644 --- a/detections/endpoint/hunting_for_log4shell.yml +++ b/detections/endpoint/hunting_for_log4shell.yml @@ -94,3 +94,5 @@ tags: type: Other role: - other + cve: + - CVE-2021-44228 diff --git a/detections/endpoint/java_class_file_download_by_java_user_agent.yml b/detections/endpoint/java_class_file_download_by_java_user_agent.yml index 3a8cf7def2..1e93fb7c6d 100644 --- a/detections/endpoint/java_class_file_download_by_java_user_agent.yml +++ b/detections/endpoint/java_class_file_download_by_java_user_agent.yml @@ -65,3 +65,5 @@ tags: role: - other automated_detection_testing: passed + cve: + - CVE-2021-44228 diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml index 7d6560e222..becf179931 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml @@ -93,3 +93,5 @@ tags: - Processes.dest risk_score: 81 security_domain: endpoint + cve: + - CVE-2021-44228 diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml index cf509f2f11..334aa430de 100644 --- a/detections/endpoint/wget_download_and_bash_execution.yml +++ b/detections/endpoint/wget_download_and_bash_execution.yml @@ -29,7 +29,8 @@ tags: analytic_story: - Ingress Tool Transfer - Log4Shell CVE-2021-44228 - dataset: [] + dataset: + - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/linux-sysmon_curlwget.log kill_chain_phases: - Exploitation mitre_attack_id: @@ -71,4 +72,6 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + cve: + - CVE-2021-44228 diff --git a/detections/experimental/endpoint/linux_java_spawning_shell.yml b/detections/experimental/endpoint/linux_java_spawning_shell.yml index 1e53542119..b4d5ff72b5 100644 --- a/detections/experimental/endpoint/linux_java_spawning_shell.yml +++ b/detections/experimental/endpoint/linux_java_spawning_shell.yml @@ -72,4 +72,6 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + cve: + - CVE-2021-44228 diff --git a/detections/experimental/endpoint/windows_java_spawning_shells.yml b/detections/experimental/endpoint/windows_java_spawning_shells.yml index 3750566d38..51bbb796cd 100644 --- a/detections/experimental/endpoint/windows_java_spawning_shells.yml +++ b/detections/experimental/endpoint/windows_java_spawning_shells.yml @@ -70,4 +70,6 @@ tags: - name: process_name type: Process role: - - Child Process \ No newline at end of file + - Child Process + cve: + - CVE-2021-44228 diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index 8ec6171cf9..b67befe123 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -61,3 +61,5 @@ tags: risk_score: 56 security_domain: network automated_detection_testing: passed + cve: + - CVE-2021-44228 From 1d04e6f78a030efbb64191f54417d5704cb9741b Mon Sep 17 00:00:00 2001 From: d1vious Date: Tue, 14 Dec 2021 19:46:04 -0500 Subject: [PATCH 2/2] minor playbook updates --- playbooks/log4j_investigate_and_respond.json | 0 playbooks/log4j_investigate_and_respond.py | 0 playbooks/log4j_investigate_and_respond.yml | 2 +- 3 files changed, 1 insertion(+), 1 deletion(-) create mode 100644 playbooks/log4j_investigate_and_respond.json create mode 100644 playbooks/log4j_investigate_and_respond.py diff --git a/playbooks/log4j_investigate_and_respond.json b/playbooks/log4j_investigate_and_respond.json new file mode 100644 index 0000000000..e69de29bb2 diff --git a/playbooks/log4j_investigate_and_respond.py b/playbooks/log4j_investigate_and_respond.py new file mode 100644 index 0000000000..e69de29bb2 diff --git a/playbooks/log4j_investigate_and_respond.yml b/playbooks/log4j_investigate_and_respond.yml index 1725d2a734..b8f5548ee0 100644 --- a/playbooks/log4j_investigate_and_respond.yml +++ b/playbooks/log4j_investigate_and_respond.yml @@ -2,7 +2,7 @@ name: Log4j Investigate And Respond id: fc0adc96-ff2b-48b0-9a6f-63da6783fd63 version: 1 date: '2021-12-14' -author: Philip Royer, Splunk +author: Phillip Royer, Splunk type: Response description: Published in response to CVE-2021-44228, this playbook and its sub-playbooks can be used to investigate and respond to attacks against hosts running vulnerable Java applications which use log4j. playbook: log4j_investigate_and_respond