diff --git a/automated_detection_testing/ci/attack_range_for_testing/requirements.txt b/automated_detection_testing/ci/attack_range_for_testing/requirements.txt index a368e7956a..0e8920b87c 100644 --- a/automated_detection_testing/ci/attack_range_for_testing/requirements.txt +++ b/automated_detection_testing/ci/attack_range_for_testing/requirements.txt @@ -1,4 +1,4 @@ -ansible==3.1.0 +ansible==4.2.0 ansible-runner==1.4.7 apipkg==1.5 aspy.yaml==1.3.0 diff --git a/automated_detection_testing/ci/detection_testing_batch/requirements.txt b/automated_detection_testing/ci/detection_testing_batch/requirements.txt index 698a3b0abf..4ec326670d 100644 --- a/automated_detection_testing/ci/detection_testing_batch/requirements.txt +++ b/automated_detection_testing/ci/detection_testing_batch/requirements.txt @@ -1,4 +1,4 @@ -ansible==2.9.20 +ansible==4.2.0 ansible-runner==1.4.4 attackcti==0.3.4.3 boto3==1.11.0 diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt index d1125dd1fe..62002870d8 100644 --- a/automated_detection_testing/requirements.txt +++ b/automated_detection_testing/requirements.txt @@ -1,5 +1,5 @@ ansible==3.4.0 -ansible-runner==1.4.7 +ansible-runner==2.0.2 apipkg==1.5 aspy.yaml==1.3.0 atomicwrites==1.4.0 @@ -7,13 +7,13 @@ attackcti==0.3.4.3 attrs==21.2.0 azure-common==1.1.27 azure-core==1.18.0 -azure-identity==1.6.0 +azure-identity==1.6.1 azure-mgmt-compute==20.0.0 azure-mgmt-core==1.2.1 azure-mgmt-network==19.0.0 azure-mgmt-resource==17.0.0 bcrypt==3.2.0 -boto3==1.17.104 +boto3==1.18.38 botocore==1.20.105 certifi==2021.5.30 cffi==1.14.5 @@ -45,7 +45,7 @@ path==15.1.2 path.py==12.5.0 pexpect==4.8.0 pluggy==0.13.1 -pre-commit==2.13.0 +pre-commit==2.15.0 protobuf==3.17.0 psutil==5.8.0 ptyprocess==0.7.0 diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index bfbd39056f..74000753e6 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -1,8 +1,8 @@ name: Detect Exchange Web Shell id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a -version: 2 -date: '2021-03-09' -author: Michael Haag, Shannon Davis, Splunk +version: 3 +date: '2021-10-05' +author: Michael Haag, Shannon Davis, David Dorsey, Splunk type: TTP datamodel: - Endpoint @@ -12,7 +12,19 @@ description: 'The following query identifies suspicious .aspx created in 3 paths `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and - other potential exploitation.' + other potential exploitation. It is often the case that a particular threat is only + applicable to a specific subset of systems in your environment. Typically analytics + to detect those threats are written without the benefit of being able to only target + those systems as well. Writing analytics against all systems when those behaviors + are limited to identifiable subsets of those systems is suboptimal. Consider the + case ProxyShell vulnerability on Microsoft Exchange Servers. With asset information, + a hunter can limit their analytics to systems that have been identified as Exchange + servers. A hunter may start with the theory that the exchange server is communicating + with new systems that it has not previously. If this theory is run against all publicly + facing systems, the amount of noise it will generate will likely render this theory + untenable. However, using the asset information to limit this analytic to just the + Exchange servers will reduce the noise allowing the hunter to focus only on the + systems where this behavioral change is relevant.' search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml index 72c9271cdf..7b5444fb72 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml @@ -1,32 +1,34 @@ name: Malicious PowerShell Process - Connect To Internet With Hidden Window id: ee18ed37-0802-4268-9435-b3b91aaa18db -version: 6 -date: '2020-11-20' -author: David Dorsey, Splunk -type: TTP +version: 7 +date: '2021-10-05' +author: David Dorsey, Michael Haag Splunk +type: Hunting datamodel: -- Endpoint -description: This search looks for PowerShell processes started with parameters to - modify the execution policy of the run, run in a hidden window, and connect to the - Internet. This combination of command-line options is suspicious because it's overriding - the default PowerShell execution policy, attempts to hide its activity from the - user, and connects to the Internet. Deprecated becaue hidden is not needed when - download file with System.Net.WebClient. -search: '| tstats `security_content_summariesonly` count values(Processes.process) - as process values(Processes.parent_process) as parent_process min(_time) as firstTime - max(_time) as lastTime from datamodel=Endpoint.Processes where `process_powershell` - Processes.process=*-WindowStyle* Processes.process=*hidden* Processes.process="*New-Object*" - by Processes.user Processes.process_name Processes.original_file_name Processes.parent_process_name - Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| - `security_content_ctime(lastTime)` | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. + - Endpoint +description: 'The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell execution policy, attempts to hide its activity from the user, and connects to the Internet. + Removed in this version of the query is New-Object. + The analytic identifies all variations of WindowStyle, as PowerShell allows the ability to shorten the parameter. For example w, win, windowsty and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash.' +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) + as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user + Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | where match(process,"(?i)[\-|\/|–|—|―]w(in*d*o*w*s*t*y*l*e*)*\s+[^-]") + | `malicious_powershell_process___connect_to_internet_with_hidden_window_filter`' +how_to_implement: You must be ingesting data that records process activity from your + hosts to populate the Endpoint data model in the Processes node. You must also be + ingesting logs with both the process name and command line from your endpoints. + The command-line arguments are mapped to the "process" field in the Endpoint data + model. known_false_positives: Legitimate process can have this combination of command-line options, but it's not common. -references: [] +references: + - https://regexr.com/663rr + - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 + - https://ss64.com/ps/powershell.html + - https://twitter.com/M_haggis/status/1440758396534214658?s=20 tags: analytic_story: - Malicious PowerShell @@ -77,16 +79,10 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest + - Processes.process + - Processes.process_name - Processes.user - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Processes.dest risk_score: 81 - security_domain: endpoint + security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 9924e356ce..0c9e87b655 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -1,27 +1,33 @@ name: Malicious PowerShell Process - Encoded Command id: c4db14d9-7909-48b4-a054-aa14d89dbb19 -version: 5 -date: '2020-07-21' -author: David Dorsey, Splunk +version: 6 +date: '2021-10-05' +author: David Dorsey, Michael Haag, Splunk type: Hunting datamodel: -- Endpoint -description: This search looks for PowerShell processes that have encoded the script - within the command-line. Malware has been seen using this parameter, as it obfuscates - the code and makes it relatively easy to pass a script on the command-line. + - Endpoint +description: 'The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ + + The analytic identifies all variations of EncodedCommand, as PowerShell allows the ability to shorten the parameter. For example enc, enco, encod and so forth. In addition, through our research it was identified that PowerShell will interpret different command switch types beyond the hyphen. We have added endash, emdash, horizontal bar, and forward slash. \ + + During triage, review parallel events to determine legitimacy. Tune as needed based on admin scripts in use. \ + + Alternatively, may use regex per matching here https://regexr.com/662ov.' search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes where `process_powershell` (Processes.process=*-EncodedCommand* - OR Processes.process=*-enc*) by Processes.user Processes.process_name Processes.process - Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id - | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` + as lastTime from datamodel=Endpoint.Processes where `process_powershell` by Processes.user + Processes.process_name Processes.process Processes.parent_process_name Processes.original_file_name Processes.dest Processes.process_id + | `drop_dm_object_name(Processes)` + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | where match(process,"(?i)[\-|\/|–|—|―]e(nc*o*d*e*d*c*o*m*m*a*n*d*)*\s+[^-]") | `malicious_powershell_process___encoded_command_filter`' -how_to_implement: To successfully implement this search you need to be ingesting information - on process that include the name of the process responsible for the changes from - your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, - confirm the latest CIM App 4.20 or higher is installed and the latest TA for the - endpoint product. +how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product. known_false_positives: System administrators may use this option, but it's not common. -references: [] +references: + - https://regexr.com/662ov + - https://github.com/redcanaryco/AtomicTestHarnesses/blob/master/TestHarnesses/T1059.001_PowerShell/OutPowerShellCommandLineParameter.ps1 + - https://ss64.com/ps/powershell.html + - https://twitter.com/M_haggis/status/1440758396534214658?s=20 tags: analytic_story: - Malicious PowerShell @@ -62,16 +68,11 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - Processes.process_name - Processes.process + - Processes.user + - Processes.parent_process_name + - Processes.dest - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 35 - security_domain: endpoint + security_domain: endpoint \ No newline at end of file diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index bcd3e1fbcf..7104cb9a50 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -1,7 +1,7 @@ name: DNS Query Length With High Standard Deviation id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 -version: 3 -date: '2021-07-21' +version: 4 +date: '2021-10-06' author: Bhavin Patel, Splunk type: Anomaly datamodel: @@ -11,10 +11,11 @@ description: This search allows you to identify DNS requests and compute the sta standard deviation to show you those queries that are unusually large for your environment. search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution where NOT DNS.message_type IN("Pointer","PTR") by DNS.query | `drop_dm_object_name("DNS")` + | eval tlds=split(query,".") | eval tld=mvindex(tlds,-1) | eval tld_len=len(tld) | search tld_len<=24 | eval query_length = len(query) | table query query_length record_type count | eventstats stdev(query_length) AS stdev avg(query_length) AS avg p50(query_length) AS p50| where query_length>(avg+stdev*2) | eval z_score=(query_length-avg)/stdev - | `dns_query_length_with_high_standard_deviation_filter` ' + | `dns_query_length_with_high_standard_deviation_filter`' how_to_implement: To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. known_false_positives: It's possible there can be long domain names that are legitimate. diff --git a/docs/_config.yml b/docs/_config.yml index 31183e8a67..f834b25a9b 100644 --- a/docs/_config.yml +++ b/docs/_config.yml @@ -6,7 +6,7 @@ description: >- # this means to ignore newlines until "baseurl:" mapped to the MITRE ATT&CK Framework, the Lockheed Martin Cyber Kill Chain, and CIS Controls. They include Splunk searches, machine learning algorithms and Splunk Phantom playbooks (where available)—all designed to work together to detect, investigate, and respond to threats. -name: Jose Hernandez +name: Splunk Threat Research Team (STRT) url: "https://splunkresearch.com" baseurl: "/" # the subpath of your site, e.g. /blog url: "https://splunkresearch.com" # the base hostname & protocol for your site, e.g. http://example.com diff --git a/requirements.txt b/requirements.txt index f5c3904b15..5f29b2db80 100644 --- a/requirements.txt +++ b/requirements.txt @@ -26,7 +26,7 @@ importlib-metadata==4.8.1 importlib-resources==5.2.2 ipaddr==2.2.0 Jinja2==3.0.1 -jsonschema==3.2.0 +jsonschema==4.0.1 lockfile==0.12.2 MarkupSafe==2.0.1 more-itertools==8.9.0 @@ -38,7 +38,7 @@ pendulum==2.1.2 pep517==0.11.0 Pillow==8.3.2 platformdirs==2.3.0 -pre-commit==2.14.1 +pre-commit==2.15.0 progress==1.6 prompt-toolkit==1.0.14 pyfiglet==0.8.post1