From 4ecb10aff70afb67cf762cbc77dcdf5da1a173e8 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 31 Aug 2021 11:43:10 +0000 Subject: [PATCH] Added detection testing service results inGet DomainPolicy with Powershell Script Block --- ...ainpolicy_with_powershell_script_block.yml | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml index 8ae7a3c61f..f0f5889b81 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell_script_block.yml @@ -6,16 +6,16 @@ author: Teoderick Contreras, Splunk type: TTP datamodel: - Endpoint -description: This search is to detect a possible execution of powerview pentesting tool for domain controller recon. - This search look for function Get-DomainPolicy to parse the domain policy of the targeted host. - This TTP may be a good pivot to look for credential dumping technique or lateral movement. -search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" - | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User - | `security_content_ctime(firstTime)` +description: This search is to detect a possible execution of powerview pentesting + tool for domain controller recon. This search look for function Get-DomainPolicy + to parse the domain policy of the targeted host. This TTP may be a good pivot to + look for credential dumping technique or lateral movement. +search: '`powershell` EventCode=4104 Message ="*Get-DomainPolicy*" | stats count min(_time) + as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `get_domainpolicy_with_powershell_script_block_filter`' -how_to_implement: The following Hunting analytic requires PowerShell operational logs to be imported. - Modify the powershell macro as needed to match the sourcetype or add index. This analytic is specific to 4104, - or PowerShell Script Block Logging. +how_to_implement: The following Hunting analytic requires PowerShell operational logs + to be imported. Modify the powershell macro as needed to match the sourcetype or + add index. This analytic is specific to 4104, or PowerShell Script Block Logging. known_false_positives: unknown references: - https://github.com/S1ckB0y1337/Active-Directory-Exploitation-Cheat-Sheet @@ -35,13 +35,12 @@ tags: required_fields: - _time - EventCode - - Message - - ComputerName + - Message + - ComputerName - User security_domain: endpoint impact: 50 confidence: 60 - # (impact * confidence)/100 risk_score: 30 context: - source:endpoint @@ -55,4 +54,5 @@ tags: - name: User type: User role: - - Victim \ No newline at end of file + - Victim + automated_detection_testing: passed