Merge branch 'develop' into misko_credential_probing

detections/network/detect_snicat_sni_exfiltration.yml

@@ -0,0 +1,39 @@
+name: Detect SNICat SNI Exfiltration
+id: 82d06410-134c-11eb-adc1-0242ac120002
+version: 1
+date: '2020-10-21'
+description: This search looks for commands that the SNICat tool uses in the TLS SNI field.
+how_to_implement: You must be ingesting Zeek SSL data into Splunk.
+  Zeek data should also be getting ingested in JSON format.  We are detecting
+  when any of the predefined SNICat commands are found within the server_name (SNI) field.
+  These commands are LIST, LS, SIZE, LD, CB, EX, ALIVE, EXIT, WHERE, and finito.  You can go
+  further once this has been detected, and run other searches to decode the SNI data to prove
+  or disprove if any data exfiltration has taken place.
+type: ESCU
+references:
+- https://www.mnemonic.no/blog/introducing-snicat/
+- https://github.com/mnemonic-no/SNIcat
+- https://attack.mitre.org/techniques/T1041/
+author: Shannon Davis, Splunk
+search: '`zeek_ssl`
+| rex field=server_name "(?<snicat>(LIST|LS|SIZE|LD|CB|CD|EX|ALIVE|EXIT|WHERE|finito)-[A-Za-z0-9]{16}\.)"
+| stats count by src_ip dest_ip server_name snicat
+| where count>0
+| table src_ip dest_ip server_name snicat
+| `detect_snicat_sni_exfiltration_filter`'
+known_false_positives: Unknown
+tags:
+  analytics_story:
+  - Data Exfiltration
+  mitre_attack_id:
+  - T1041
+  kill_chain_phases:
+  - Actions on Objectives
+  cis20:
+  - CIS 13
+  nist:
+  - PR.DS
+  - DE.CM
+  - DE.AE
+  security_domain: network
+  asset_type: Network

macros/zeek_ssl.yml

@@ -0,0 +1,4 @@
+definition: index=zeek sourcetype="zeek:ssl:json"
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: zeek_ssl

stories/data_exfiltration.yml

@@ -0,0 +1,20 @@
+name: Data Exfiltration
+id: 66b0fe0c-1351-11eb-adc1-0242ac120002
+version: 1
+date: '2020-10-21'
+description: The stealing of data by an adversary.
+narrative: Exfiltration comes in many flavors.  Adversaries can collect data
+  over encrypted or non-encrypted channels.  They can utilise Command and Control
+  channels that are already in place to exfiltrate data.  They can use both standard
+  data transfer protocols such as FTP, SCP, etc to exfiltrate data.  Or they can use
+  non-standard protocols such as DNS, ICMP, etc with specially crafted fields to
+  try and circumvent security technologies in place.
+author: Shannon Davis, Splunk
+type: ESCU
+references:
+- https://attack.mitre.org/tactics/TA0010/
+tags:
+  analytics_story: Data Exfiltration
+  usecase: Advanced Threat Detection
+  category:
+  - Adversary Tactics

tests/network/detect_snicat_sni_exfiltration.test.yml

@@ -0,0 +1,10 @@
+name: Detect SNICat SNI Exfiltration Unit Test
+detections:
+- name: Detect SNICat SNI Exfiltration
+  file: network/detect_snicat_sni_exfiltration.yml
+  pass_condition: '| stats count | where count > 0'
+attack_data:
+- file_name: zeek-ssl.log
+  data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1041/zeek-ssl.log
+  source: zeek-ssl.log
+  sourcetype: bro:ssl:json