From 1ab400a5655b8928564307d9fe69266e38c02170 Mon Sep 17 00:00:00 2001 From: Shannon Davis Date: Fri, 6 Nov 2020 10:57:35 +1100 Subject: [PATCH 1/2] mods --- .../detect_snicat_sni_exfiltration.yml | 39 +++++++++++++++++++ stories/data_exfiltration.yml | 20 ++++++++++ .../detect_snicat_sni_exfiltration.test.yml | 10 +++++ 3 files changed, 69 insertions(+) create mode 100644 detections/network/detect_snicat_sni_exfiltration.yml create mode 100644 stories/data_exfiltration.yml create mode 100644 tests/network/detect_snicat_sni_exfiltration.test.yml diff --git a/detections/network/detect_snicat_sni_exfiltration.yml b/detections/network/detect_snicat_sni_exfiltration.yml new file mode 100644 index 0000000000..66196167ef --- /dev/null +++ b/detections/network/detect_snicat_sni_exfiltration.yml @@ -0,0 +1,39 @@ +name: Detect SNICat SNI Exfiltration +id: 82d06410-134c-11eb-adc1-0242ac120002 +version: 1 +date: '2020-10-21' +description: This search looks for commands that the SNICat tool uses in the TLS SNI field. +how_to_implement: You must be ingesting Zeek SSL data into Splunk. + Zeek data should also be getting ingested in JSON format. We are detecting + when any of the predefined SNICat commands are found within the server_name (SNI) field. + These commands are LIST, LS, SIZE, LD, CB, EX, ALIVE, EXIT, WHERE, and finito. You can go + further once this has been detected, and run other searches to decode the SNI data to prove + or disprove if any data exfiltration has taken place. +type: ESCU +references: +- https://www.mnemonic.no/blog/introducing-snicat/ +- https://github.com/mnemonic-no/SNIcat +- https://attack.mitre.org/techniques/T1041/ +author: Shannon Davis, Splunk +search: '`zeek_ssl` +| rex field=server_name "(?(LIST|LS|SIZE|LD|CB|CD|EX|ALIVE|EXIT|WHERE|finito)-[A-Za-z0-9]{16}\.)" +| stats count by src_ip dest_ip server_name snicat +| where count>0 +| table src_ip dest_ip server_name snicat +| `detect_snicat_sni_exfiltration_filter`' +known_false_positives: Unknown +tags: + analytics_story: + - Data Exfiltration + mitre_attack_id: + - T1041 + kill_chain_phases: + - Actions on Objectives + cis20: + - CIS 13 + nist: + - PR.DS + - DE.CM + - DE.AE + security_domain: network + asset_type: Network diff --git a/stories/data_exfiltration.yml b/stories/data_exfiltration.yml new file mode 100644 index 0000000000..4495d6a12d --- /dev/null +++ b/stories/data_exfiltration.yml @@ -0,0 +1,20 @@ +name: Data Exfiltration +id: 66b0fe0c-1351-11eb-adc1-0242ac120002 +version: 1 +date: '2020-10-21' +description: The stealing of data by an adversary. +narrative: Exfiltration comes in many flavors. Adversaries can collect data + over encrypted or non-encrypted channels. They can utilise Command and Control + channels that are already in place to exfiltrate data. They can use both standard + data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use + non-standard protocols such as DNS, ICMP, etc with specially crafted fields to + try and circumvent security technologies in place. +author: Shannon Davis, Splunk +type: ESCU +references: +- https://attack.mitre.org/tactics/TA0010/ +tags: + analytics_story: Data Exfiltration + usecase: Advanced Threat Detection + category: + - Adversary Tactics diff --git a/tests/network/detect_snicat_sni_exfiltration.test.yml b/tests/network/detect_snicat_sni_exfiltration.test.yml new file mode 100644 index 0000000000..6a25c4d02b --- /dev/null +++ b/tests/network/detect_snicat_sni_exfiltration.test.yml @@ -0,0 +1,10 @@ +name: Detect SNICat SNI Exfiltration Unit Test +detections: +- name: Detect SNICat SNI Exfiltration + file: network/detect_snicat_sni_exfiltration.yml + pass_condition: '| stats count | where count > 0' +attack_data: +- file_name: zeek-ssl.log + data: https://attack-range-attack-data.s3-us-west-2.amazonaws.com/T1041/zeek-ssl.log + source: zeek-ssl.log + sourcetype: bro:ssl:json From 098aa9019af631d30a475b3e8e16aa474134e765 Mon Sep 17 00:00:00 2001 From: Shannon Davis Date: Fri, 6 Nov 2020 11:08:38 +1100 Subject: [PATCH 2/2] mods --- macros/zeek_ssl.yml | 4 ++++ 1 file changed, 4 insertions(+) create mode 100644 macros/zeek_ssl.yml diff --git a/macros/zeek_ssl.yml b/macros/zeek_ssl.yml new file mode 100644 index 0000000000..76e061ab48 --- /dev/null +++ b/macros/zeek_ssl.yml @@ -0,0 +1,4 @@ +definition: index=zeek sourcetype="zeek:ssl:json" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: zeek_ssl