From 0bfb8ba32538f4a184ce130b1c44cc7602a25de5 Mon Sep 17 00:00:00 2001 From: sec-researcher Date: Thu, 19 Aug 2021 18:59:04 +0430 Subject: [PATCH 1/3] Filter blocked traffic because it made a lot of false positive specially when something like port scan happen, also add description to "how_to_implement" section to limit result just to organization private and public IP range for more accurate result --- .../protocols_passing_authentication_in_cleartext.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml index 24a747ac9e..c0ff387839 100644 --- a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml +++ b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml @@ -1,7 +1,7 @@ name: Protocols passing authentication in cleartext id: 6923cd64-17a0-453c-b945-81ac2d8c6db9 -version: 2 -date: '2020-11-04' +version: 3 +date: '2021-08-19' author: Rico Valdez, Splunk type: batch datamodel: @@ -11,13 +11,16 @@ description: This search looks for cleartext protocols at risk of leaking creden FTP sessions. While some of these protocols can be used over SSL, they typically run on different assigned ports in those cases. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Network_Traffic where All_Traffic.transport="tcp" AND + as lastTime from datamodel=Network_Traffic where All_Traffic.action!=blocked AND All_Traffic.transport="tcp" AND (All_Traffic.dest_port="23" OR All_Traffic.dest_port="143" OR All_Traffic.dest_port="110" OR (All_Traffic.dest_port="21" AND All_Traffic.user != "anonymous")) by All_Traffic.user All_Traffic.src All_Traffic.dest All_Traffic.dest_port | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `protocols_passing_authentication_in_cleartext_filter`' how_to_implement: This search requires you to be ingesting your network traffic, and populating the Network_Traffic data model. + For more accurate result it's better to limit destination to organization private and public IP range, like: + All_Traffic.dest IN(192.168.0.0/16,172.16.0.0/12,10.0.0.0/8, x.x.x.x/22) + known_false_positives: Some networks may use kerberized FTP or telnet servers, however, this is rare. references: [] From 0945cc72c9563f486c2535c48d647d0db0aacea5 Mon Sep 17 00:00:00 2001 From: Amir hossein Mahboubi <7353420+sec-researcher@users.noreply.github.com> Date: Sat, 21 Aug 2021 08:55:07 +0430 Subject: [PATCH 2/3] Update protocols_passing_authentication_in_cleartext.yml --- .../network/protocols_passing_authentication_in_cleartext.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml index 79015119a4..6bcce3b1de 100644 --- a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml +++ b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml @@ -18,7 +18,7 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime | `security_content_ctime(lastTime)` | `drop_dm_object_name("All_Traffic")` | `protocols_passing_authentication_in_cleartext_filter`' how_to_implement: This search requires you to be ingesting your network traffic, and populating the Network_Traffic data model. - For more accurate result it's better to limit destination to organization private and public IP range, like: + For more accurate result it's better to limit destination to organization private and public IP range, like All_Traffic.dest IN(192.168.0.0/16,172.16.0.0/12,10.0.0.0/8, x.x.x.x/22) known_false_positives: Some networks may use kerberized FTP or telnet servers, however, From b831023bd45295329191ba85637994b41075dc67 Mon Sep 17 00:00:00 2001 From: Michael Haag <5632822+MHaggis@users.noreply.github.com> Date: Tue, 24 Aug 2021 07:04:52 -0600 Subject: [PATCH 3/3] Update protocols_passing_authentication_in_cleartext.yml Added a few more changes to make it more clear. Thank you @sec-researcher for updating! --- ...rotocols_passing_authentication_in_cleartext.yml | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml index 6bcce3b1de..7a0331f8f2 100644 --- a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml +++ b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml @@ -6,10 +6,10 @@ author: Rico Valdez, Splunk type: TTP datamodel: - Network_Traffic -description: This search looks for cleartext protocols at risk of leaking credentials. - Currently, this consists of legacy protocols such as telnet, POP3, IMAP, and non-anonymous - FTP sessions. While some of these protocols can be used over SSL, they typically - run on different assigned ports in those cases. +description: The following analytic identifies cleartext protocols at risk of leaking sensitive information. + Currently, this consists of legacy protocols such as telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous + FTP (port 21) sessions. While some of these protocols may be used over SSL, they typically + are found on different assigned ports in those instances. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Traffic where All_Traffic.action!=blocked AND All_Traffic.transport="tcp" AND (All_Traffic.dest_port="23" OR All_Traffic.dest_port="143" OR All_Traffic.dest_port="110" @@ -23,7 +23,9 @@ how_to_implement: This search requires you to be ingesting your network traffic, known_false_positives: Some networks may use kerberized FTP or telnet servers, however, this is rare. -references: [] +references: + - https://www.rackaid.com/blog/secure-your-email-and-file-transfers/ + - https://www.infosecmatter.com/capture-passwords-using-wireshark/ tags: analytic_story: - Use of Cleartext Protocols @@ -50,4 +52,5 @@ tags: - All_Traffic.user - All_Traffic.src - All_Traffic.dest + - All_Traffic.action security_domain: network