admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
pyth0n1c
2022-04-01 08:12:08 -07:00
committed by GitHub
parent fc396bc54c a7d3d1dc57
commit 50ea0ea2db
864 changed files with 50143 additions and 10199 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detection_page.j2
+2 -2
View File
@@ -12,8 +12,8 @@ sidebar:
| -------------- | --------------- | --------------- |
{%- for detection in objects -%}
{% if detection.tags.mitre_attack_enrichments %}
| [{{ detection.name }}](/{{ detection.source }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.tags.mitre_attack_enrichments -%} [{{ attack.mitre_attack_technique }}](/tags/#{{ attack.mitre_attack_technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | {{ detection.type }} |
| [{{ detection.name }}](/{{ detection.source }}/{{ detection.name | lower | replace(' ', '_') }}/) | {% for attack in detection.tags.mitre_attack_enrichments -%} [{{ attack.mitre_attack_technique }}](/tags/#{{ attack.mitre_attack_technique | lower | replace(" ", "-") }}){% if not loop.last -%}, {% endif -%}{%- endfor %} | [{{ detection.type }}](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
{%- else %}
| [{{ detection.name }}]() | None | {{ detection.type }} |
| [{{ detection.name }}]() | None | [{{ detection.type }}](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
{%- endif -%}
{%- endfor -%}
bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_detections.j2
+73 -21
View File
@@ -44,17 +44,23 @@ We have not been able to test, simulate, or build datasets for this object. Use
{{ object.description }}
- **Type**: [{{ object.type }}](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [{{ object.type }}](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: {{ object.tags.product|join(', ') }}
{% if object.datamodel -%}- **Datamodel**: {% for datamodel in object.datamodel %}[{{ datamodel }}](https://docs.splunk.com/Documentation/CIM/latest/User/{{ datamodel|replace("_", "")}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %}
{% if object.splunk_app_enrichment -%}- **Datasource**: {% for splunk_app in object.splunk_app_enrichment %}[{{ splunk_app.name }}]({{splunk_app.url}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %}
{%- if object.splunk_app_enrichment %}- **Datasource**: {% for splunk_app in object.splunk_app_enrichment %}[{{ splunk_app.name }}]({{splunk_app.url}}){% if not loop.last %}, {% endif %}{%-endfor %}{% endif %}
- **Last Updated**: {{ object.date }}
- **Author**: {{object.author}}
- **ID**: {{ object.id }}
{% if object.tags.mitre_attack_id %}
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
{% if object.tags.mitre_attack_id %}
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
{%- for attack in object.tags.mitre_attack_enrichments %}
@@ -68,6 +74,66 @@ We have not been able to test, simulate, or build datasets for this object. Use
{% endfor %}
{% endif -%}
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
{% for phase in object.annotations.kill_chain_phases -%}
* {{ phase }}
{% endfor %}
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
{% if object.annotations.nist -%}
{% for nist in object.annotations.nist -%}
* {{ nist }}
{% endfor %}
{% endif %}
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
{% if object.annotations.cis20 -%}
{% for cis in object.annotations.cis20 -%}
* {{ cis }}
{% endfor %}
{% endif %}
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
{% if object.cve_enrichment -%}
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
{% for cve in object.cve_enrichment -%}
| [{{ cve.id }}](https://nvd.nist.gov/vuln/detail/{{cve.id}}) | {{ cve.summary }} | {{ cve.cvss }} |
{% endfor %}
{% endif %}
</div>
</details>
#### Search
```
@@ -84,7 +150,7 @@ The SPL above uses the following Macros:
{% endfor %}
{% endif -%}
Note that `{{object.name | lower | replace(" ", "_") }}_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **{{object.name | lower | replace(" ", "_") }}_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
{% if object.lookups -%}
#### Lookups
@@ -111,10 +177,6 @@ The SPL above uses the following Lookups:
* [{{ story }}](/stories/{{story|lower|replace(" ", "_")}})
{% endfor %}
#### Kill Chain Phase
{% for phase in object.tags.kill_chain_phases -%}
* {{ phase }}
{% endfor %}
{% if object.tags.observable %}
#### RBA
@@ -124,16 +186,6 @@ The SPL above uses the following Lookups:
| {{(object.tags.impact * object.tags.confidence)/100}} | {{ object.tags.impact }} | {{ object.tags.confidence }} | {{object.tags.message}} |
{% endif %}
{% if object.cve_enrichment -%}
#### CVE
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
{% for cve in object.cve_enrichment -%}
| [{{ cve.id }}](https://nvd.nist.gov/vuln/detail/{{cve.id}}) | {{ cve.summary }} | {{ cve.cvss }} |
{% endfor %}
{% endif %}
#### Reference
{% if object.references %}
{% for reference in object.references -%}
@@ -142,7 +194,7 @@ The SPL above uses the following Lookups:
{% endif %}
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
{% if object.tags.dataset %}
@@ -151,4 +203,4 @@ Alternatively you can replay a dataset into a [Splunk Attack Range](https://gith
{% endfor %}
{% endif %}
[*source*](https://github.com/splunk/security_content/tree/develop/detections/{% if object.experimental is sameas true -%}experimental/{%- endif -%}{{object.source}}/{{ object.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{object.version}}**
[*source*](https://github.com/splunk/security_content/tree/develop/detections/{% if object.experimental is sameas true -%}experimental/{%- endif -%}{{object.source}}/{{ object.name | lower | replace (" ", "_") }}.yml) \| *version*: **{{object.version}}**
bin/contentctl_project/contentctl_infrastructure/adapter/templates/doc_navigation.j2
+3 -3
View File
@@ -5,8 +5,8 @@ main:
url: /stories/
- title: "Playbooks"
url: /playbooks/
- title: "Tags"
url: /tags/
- title: "Blog"
url: https://www.splunk.com/en_us/blog/author/secmrkt-research.html
- title: "About"
url: https://www.splunk.com/en_us/cyber-security/threat-research.html
detections:
@@ -45,4 +45,4 @@ playbooks:
- title: "Response"
url: /tags/#response/
- title: "Investigation"
url: /tags/#investigation/
url: /tags/#investigation/
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_data/navigation.yml
+2 -2
View File
@@ -5,8 +5,8 @@ main:
url: /stories/
- title: "Playbooks"
url: /playbooks/
- title: "Tags"
url: /tags/
- title: "Blog"
url: https://www.splunk.com/en_us/blog/author/secmrkt-research.html
- title: "About"
url: https://www.splunk.com/en_us/cyber-security/threat-research.html
detections:
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_pages/detections.md
+2 -2
View File
@@ -10,5 +10,5 @@ sidebar:
| Name | Technique | Type |
| -------------- | --------------- | --------------- |
| [Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
| [Detect new user AWS Console Login](/deprecated/detect_new_user_aws_console_login/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP |
| [Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect new user AWS Console Login](/deprecated/detect_new_user_aws_console_login/) | [Cloud Accounts](/tags/#cloud-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2020-07-21-detect_new_user_aws_console_login.md
+60 -10
View File
@@ -26,21 +26,76 @@ tags:
This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f3-d82362dffd75
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.AE
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -59,7 +114,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
#### Macros
The SPL above uses the following Macros:
Note that `detect_new_user_aws_console_login_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +132,6 @@ When a legitimate new user logins for the first time, this activity will be dete
* [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -89,13 +141,11 @@ When a legitimate new user logins for the first time, this activity will be dete
| 90.0 | 90 | 100 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+62 -11
View File
@@ -27,16 +27,21 @@ tags:
Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Patrick Bareiss, Splunk
- **ID**: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -58,7 +114,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
#### Macros
The SPL above uses the following Macros:
Note that `attempted_credential_dump_from_registry_via_reg_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ None identified.
* [DarkSide Ransomware](/stories/darkside_ransomware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -98,8 +151,6 @@ None identified.
| 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. |
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets)
@@ -107,7 +158,7 @@ None identified.
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_data/navigation.yml
+2 -2
View File
@@ -5,8 +5,8 @@ main:
url: /stories/
- title: "Playbooks"
url: /playbooks/
- title: "Tags"
url: /tags/
- title: "Blog"
url: https://www.splunk.com/en_us/blog/author/secmrkt-research.html
- title: "About"
url: https://www.splunk.com/en_us/cyber-security/threat-research.html
detections:
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_pages/detections.md
+2 -2
View File
@@ -10,5 +10,5 @@ sidebar:
| Name | Technique | Type |
| -------------- | --------------- | --------------- |
| [Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | TTP |
| [Detect new user AWS Console Login](/deprecated/detect_new_user_aws_console_login/) | [Cloud Accounts](/tags/#cloud-accounts) | TTP |
| [Attempted Credential Dump From Registry via Reg exe](/detection/attempted_credential_dump_from_registry_via_reg_exe/) | [Security Account Manager](/tags/#security-account-manager), [OS Credential Dumping](/tags/#os-credential-dumping) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
| [Detect new user AWS Console Login](/deprecated/detect_new_user_aws_console_login/) | [Cloud Accounts](/tags/#cloud-accounts) | [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types) |
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2020-07-21-detect_new_user_aws_console_login.md
+60 -10
View File
@@ -26,21 +26,76 @@ tags:
This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. The alert is fired if the user has logged into the console for the first time within the last hour. Deprecated now this search is updated to use the Authentication datamodel.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-07-21
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f3-d82362dffd75
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.AE
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -59,7 +114,7 @@ This search looks for AWS CloudTrail events wherein a console login event by a u
#### Macros
The SPL above uses the following Macros:
Note that `detect_new_user_aws_console_login_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_new_user_aws_console_login_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +132,6 @@ When a legitimate new user logins for the first time, this activity will be dete
* [Suspicious AWS Login Activities](/stories/suspicious_aws_login_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -89,13 +141,11 @@ When a legitimate new user logins for the first time, this activity will be dete
| 90.0 | 90 | 100 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_md_data_ref/_posts/2021-09-16-attempted_credential_dump_from_registry_via_reg_exe.md
+62 -11
View File
@@ -27,16 +27,21 @@ tags:
Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2021-09-16
- **Author**: Patrick Bareiss, Splunk
- **ID**: e9fb4a59-c5fb-440a-9f24-191fbc6b2911
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -58,7 +114,7 @@ Monitor for execution of reg.exe with parameters specifying an export of keys th
#### Macros
The SPL above uses the following Macros:
Note that `attempted_credential_dump_from_registry_via_reg_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **attempted_credential_dump_from_registry_via_reg_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -86,9 +142,6 @@ None identified.
* [DarkSide Ransomware](/stories/darkside_ransomware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -98,8 +151,6 @@ None identified.
| 90.0 | 90 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. |
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets)
@@ -107,7 +158,7 @@ None identified.
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
detections/endpoint/log4shell_cve_2021_44228_exploitation.yml
+4 -2
View File
@@ -11,8 +11,10 @@ description: This correlation find exploitation of Log4Shell CVE-2021-44228 agai
by calculating the distinct count of MITRE ATT&CK tactics from Log4Shell detections
fired. If the count is larger than 2 or more distinct MITRE ATT&CK tactics we assume
high problability of exploitation. The Analytic story breaks down into 3 major phases
of a Log4Shell exploitation, specifically 1. Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}`
2. Call back to malicious LDAP server eg. Exploit.class 3. Post Exploitation Activity/Lateral
of a Log4Shell exploitation, specifically>
Initial Payload delivery eg. `${jndi:ldap://PAYLOAD_INJECTED}`
Call back to malicious LDAP server eg. Exploit.class
Post Exploitation Activity/Lateral
Movement using Powershell or similar T1562.001 Each of these phases fall into different
MITRE ATT&CK Tactics (Initial Access, Execution, Command and Control), by looking
into 2 or more phases showing up in detections triggerd is how this correlation
dist/escu/app.manifest
Vendored
+1 -1
View File
@@ -5,7 +5,7 @@
"id": {
"group": null,
"name": "DA-ESS-ContentUpdate",
"version": "3.37.0"
"version": "3.37.1"
},
"author": [
{
dist/escu/default/analyticstories.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-03-31T20:50:18 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/app.conf
Vendored
+2 -2
View File
@@ -4,7 +4,7 @@
is_configured = false
state = enabled
state_change_requires_restart = false
build = 6915
build = 6973
[triggers]
reload.analytic_stories = simple
@@ -20,7 +20,7 @@ reload.es_investigations = simple
[launcher]
author = Splunk
version = 3.37.0
version = 3.37.1
description = Explore the Analytic Stories included with ES Content Updates.
[ui]
dist/escu/default/collections.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-03-31T20:50:18 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/content-version.conf
Vendored
+1 -1
View File
@@ -1,2 +1,2 @@
[content-version]
version = 3.37.0
version = 3.37.1
dist/escu/default/es_investigations.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-03-31T20:50:18 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/macros.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-03-31T20:50:18 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/savedsearches.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-03-31T20:50:18 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/transforms.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-03-31T20:50:18 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/escu/default/workflow_actions.conf
Vendored
+1 -1
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security_content
# On Date: 2022-03-29T17:44:17 UTC
# On Date: 2022-03-31T20:50:18 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
dist/ssa/srs/ssa___fsutil_zeroing_file.yml
Vendored
+3 -3
View File
@@ -53,6 +53,6 @@ test:
file: endpoint/ssa___fsutil_zeroing_file.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
- file_name: windows-security.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-security.log
source: WinEventLog:Security
docs/Gemfile.lock
+6 -1
View File
@@ -244,12 +244,16 @@ GEM
rb-fsevent (~> 0.10, >= 0.10.3)
rb-inotify (~> 0.9, >= 0.9.10)
mercenary (0.3.6)
mini_portile2 (2.7.1)
minima (2.5.1)
jekyll (>= 3.5, < 5.0)
jekyll-feed (~> 0.9)
jekyll-seo-tag (~> 2.1)
minitest (5.15.0)
multipart-post (2.1.1)
nokogiri (1.13.1)
mini_portile2 (~> 2.7.0)
racc (~> 1.4)
nokogiri (1.13.1-x86_64-darwin)
racc (~> 1.4)
nokogiri (1.13.1-x86_64-linux)
@@ -300,6 +304,7 @@ GEM
zeitwerk (2.5.4)
PLATFORMS
ruby
x86_64-darwin-20
x86_64-linux
@@ -317,4 +322,4 @@ DEPENDENCIES
webrick (~> 1.7)
BUNDLED WITH
2.3.6
2.3.6
docs/_config.yml
+19 -1
View File
@@ -32,8 +32,26 @@ minimal_mistakes_skin: "contrast" #default, neon, dark are also options
# Build settings
markdown: kramdown
highlighter: rouge
lsi: false
excerpt_separator: "\n\n"
incremental: false
# Markdown Processing
kramdown:
input: GFM
hard_wrap: false
auto_ids: true
footnote_nr: 1
entity_output: as_char
toc_levels: 1..6
smart_quotes: lsquo,rsquo,ldquo,rdquo
enable_coderay: false
syntax_highlighter_opts:
block:
line_numbers: true
remote_theme: mmistakes/minimal-mistakes
# Outputting
permalink: /:categories/:title/
paginate: 5 # amount of posts to show
@@ -149,4 +167,4 @@ analytics:
provider: "google-gtag"
google:
tracking_id: "G-294P2LYRR5"
anonymize_ip: false # default
anonymize_ip: false # default
docs/_data/navigation.yml
+2 -2
View File
@@ -5,8 +5,8 @@ main:
url: /stories/
- title: "Playbooks"
url: /playbooks/
- title: "Tags"
url: /tags/
- title: "Blog"
url: https://www.splunk.com/en_us/blog/author/secmrkt-research.html
- title: "About"
url: https://www.splunk.com/en_us/cyber-security/threat-research.html
detections:
docs/_pages/detections.md
+836 -836
View File
File diff suppressed because it is too large Load Diff
docs/_posts/2017-01-07-spectre_and_meltdown_vulnerable_systems.md
+67 -15
View File
@@ -22,14 +22,77 @@ tags:
The search is used to detect systems that are still vulnerable to the Spectre and Meltdown vulnerabilities.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Vulnerabilities](https://docs.splunk.com/Documentation/CIM/latest/User/Vulnerabilities)
- **Last Updated**: 2017-01-07
- **Author**: David Dorsey, Splunk
- **ID**: 354be8e0-32cd-4da0-8c47-796de13b60ea
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.RA
* RS.MI
* PR.IP
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 4
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2017-5753](https://nvd.nist.gov/vuln/detail/CVE-2017-5753) | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | 4.7 |
</div>
</details>
#### Search
```
@@ -46,7 +109,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `spectre_and_meltdown_vulnerable_systems_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **spectre_and_meltdown_vulnerable_systems_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,9 +125,6 @@ It is possible that your vulnerability scanner is not detecting that the patches
* [Spectre And Meltdown Vulnerabilities](/stories/spectre_and_meltdown_vulnerabilities)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -74,19 +134,11 @@ It is possible that your vulnerability scanner is not detecting that the patches
| 25.0 | 50 | 50 | tbd |
#### CVE
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2017-5753](https://nvd.nist.gov/vuln/detail/CVE-2017-5753) | Systems with microprocessors utilizing speculative execution and branch prediction may allow unauthorized disclosure of information to an attacker with local user access via a side-channel analysis. | 4.7 |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-12-detect_new_login_attempts_to_routers.md
+62 -9
View File
@@ -23,14 +23,72 @@ We have not been able to test, simulate, or build datasets for this object. Use
The search queries the authentication logs for assets that are categorized as routers in the ES Assets and Identity Framework, to identify connections that have not been seen before in the last 30 days.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Authentication](https://docs.splunk.com/Documentation/CIM/latest/User/Authentication)
- **Last Updated**: 2017-09-12
- **Author**: Bhavin Patel, Splunk
- **ID**: bce3ed7c-9b1f-42a0-abdf-d8b123a34836
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.AC
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 11
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -49,7 +107,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `detect_new_login_attempts_to_routers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_new_login_attempts_to_routers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -68,9 +126,6 @@ Legitimate router connections may appear as new connections
* [Router and Infrastructure Security](/stories/router_and_infrastructure_security)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -80,13 +135,11 @@ Legitimate router connections may appear as new connections
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-12-extended_period_without_successful_netbackup_backups.md
+60 -9
View File
@@ -20,14 +20,70 @@ tags:
This search returns a list of hosts that have not successfully completed a backup in over a week. Deprecated because it's a infrastructure monitoring.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2017-09-12
- **Author**: David Dorsey, Splunk
- **ID**: a34aae96-ccf8-4aef-952c-3ea214444440
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 10
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -46,7 +102,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
Note that `extended_period_without_successful_netbackup_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **extended_period_without_successful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -64,9 +120,6 @@ None identified
* [Monitor Backup Solution](/stories/monitor_backup_solution)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -76,13 +129,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-12-identify_new_user_accounts.md
+59 -10
View File
@@ -26,21 +26,75 @@ tags:
This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the past week.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2017-09-12
- **Author**: Bhavin Patel, Splunk
- **ID**: 475b9e27-17e4-46e2-b7e2-648221be3b89
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.002](https://attack.mitre.org/techniques/T1078/002/) | Domain Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -58,7 +112,7 @@ This detection search will help profile user accounts in your environment by ide
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `identify_new_user_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **identify_new_user_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +128,6 @@ If the Identity_Management data model is not updated regularly, this search coul
* [Account Monitoring and Controls](/stories/account_monitoring_and_controls)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -86,13 +137,11 @@ If the Identity_Management data model is not updated regularly, this search coul
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-12-unsuccessful_netbackup_backups.md
+60 -9
View File
@@ -20,14 +20,70 @@ tags:
This search gives you the hosts where a backup was attempted and then failed.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2017-09-12
- **Author**: David Dorsey, Splunk
- **ID**: a34aae96-ccf8-4aaa-952c-3ea21444444f
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 10
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -45,7 +101,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [netbackup](https://github.com/splunk/security_content/blob/develop/macros/netbackup.yml)
Note that `unsuccessful_netbackup_backups_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **unsuccessful_netbackup_backups_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -61,9 +117,6 @@ None identified
* [Monitor Backup Solution](/stories/monitor_backup_solution)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -73,13 +126,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-13-detect_unauthorized_assets_by_mac_address.md
+63 -11
View File
@@ -23,14 +23,73 @@ We have not been able to test, simulate, or build datasets for this object. Use
By populating the organization's assets within the assets_by_str.csv, we will be able to detect unauthorized devices that are trying to connect with the organization's network by inspecting DHCP request packets, which are issued by devices when they attempt to obtain an IP address from the DHCP server. The MAC address associated with the source of the DHCP request is checked against the list of known devices, and reports on those that are not found.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Sessions](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkSessions)
- **Last Updated**: 2017-09-13
- **Author**: Bhavin Patel, Splunk
- **ID**: dcfd6b40-42f9-469d-a433-2e53f7489ff4
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Reconnaissance
* Delivery
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
* PR.DS
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -50,7 +109,7 @@ By populating the organization's assets within the assets_by_str.csv, we will be
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `detect_unauthorized_assets_by_mac_address_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_unauthorized_assets_by_mac_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,11 +128,6 @@ This search might be prone to high false positives. Please consider this when co
* [Asset Tracking](/stories/asset_tracking)
#### Kill Chain Phase
* Reconnaissance
* Delivery
* Actions on Objectives
#### RBA
@@ -83,13 +137,11 @@ This search might be prone to high false positives. Please consider this when co
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-15-no_windows_updates_in_a_time_frame.md
+61 -9
View File
@@ -23,14 +23,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. Windows updates are typically released monthly and applied shortly thereafter. An endpoint that has not successfully applied an update in this time frame indicates the endpoint is not regularly being patched for some reason.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Updates](https://docs.splunk.com/Documentation/CIM/latest/User/Updates)
- **Last Updated**: 2017-09-15
- **Author**: Bhavin Patel, Splunk
- **ID**: 1a77c08c-2f56-409c-a2d3-7d64617edd4f
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.MA
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 18
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -52,7 +109,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `no_windows_updates_in_a_time_frame_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **no_windows_updates_in_a_time_frame_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +128,6 @@ None identified
* [Monitor for Updates](/stories/monitor_for_updates)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -83,13 +137,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-19-email_attachments_with_lots_of_spaces.md
+60 -9
View File
@@ -23,14 +23,70 @@ We have not been able to test, simulate, or build datasets for this object. Use
Attackers often use spaces as a means to obfuscate an attachment's file extension. This search looks for messages with email attachments that have many spaces within the file names.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email)
- **Last Updated**: 2017-09-19
- **Author**: David Dorsey, Splunk
- **ID**: 56e877a6-1455-4479-ada6-0550dc1e22f8
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 7
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -50,7 +106,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `email_attachments_with_lots_of_spaces_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **email_attachments_with_lots_of_spaces_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +130,6 @@ None at this time
* [Suspicious Emails](/stories/suspicious_emails)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -86,13 +139,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-19-open_redirect_in_splunk_web.md
+71 -15
View File
@@ -21,14 +21,81 @@ tags:
This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2017-09-19
- **Author**: Bhavin Patel, Splunk
- **ID**: d199fb99-2312-451a-9daa-e5efa6ed76a7
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.RA
* RS.MI
* PR.PT
* PR.AC
* PR.IP
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 4
* CIS 18
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2016-4859](https://nvd.nist.gov/vuln/detail/CVE-2016-4859) | Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | 5.8 |
</div>
</details>
#### Search
```
@@ -39,7 +106,7 @@ index=_internal sourcetype=splunk_web_access return_to="/%09/*"
#### Macros
The SPL above uses the following Macros:
Note that `open_redirect_in_splunk_web_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **open_redirect_in_splunk_web_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -55,9 +122,6 @@ None identified
* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -67,19 +131,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
#### CVE
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2016-4859](https://nvd.nist.gov/vuln/detail/CVE-2016-4859) | Open redirect vulnerability in Splunk Enterprise 6.4.x prior to 6.4.3, Splunk Enterprise 6.3.x prior to 6.3.6, Splunk Enterprise 6.2.x prior to 6.2.10, Splunk Enterprise 6.1.x prior to 6.1.11, Splunk Enterprise 6.0.x prior to 6.0.12, Splunk Enterprise 5.0.x prior to 5.0.16 and Splunk Light prior to 6.4.3 allows to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors. | 5.8 |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-20-large_volume_of_dns_any_queries.md
+62 -10
View File
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
The search is used to identify attempts to use your DNS Infrastructure for DDoS purposes via a DNS amplification attack leveraging ANY queries.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
- **Last Updated**: 2017-09-20
- **Author**: Bhavin Patel, Splunk
- **ID**: 8fa891f7-a533-4b3c-af85-5aa2e7c1f1eb
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,58 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS
| [T1498.002](https://attack.mitre.org/techniques/T1498/002/) | Reflection Amplification | Impact |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.AE
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 11
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -60,7 +117,7 @@ The search is used to identify attempts to use your DNS Infrastructure for DDoS
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `large_volume_of_dns_any_queries_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **large_volume_of_dns_any_queries_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +136,6 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a
* [DNS Amplification Attacks](/stories/dns_amplification_attacks)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -91,13 +145,11 @@ Legitimate ANY requests may trigger this search, however it is unusual to see a
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-23-detect_attackers_scanning_for_vulnerable_jboss_servers.md
+55 -10
View File
@@ -26,21 +26,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for specific GET or HEAD requests to web servers that are indicative of reconnaissance attempts to identify vulnerable JBoss servers. JexBoss is described as the exploit tool of choice for this malicious activity.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
- **Last Updated**: 2017-09-23
- **Author**: Bhavin Patel, Splunk
- **ID**: 104658f4-afdc-499e-9719-17243f982681
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Reconnaissance
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -57,7 +107,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `detect_attackers_scanning_for_vulnerable_jboss_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_attackers_scanning_for_vulnerable_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +128,6 @@ It's possible for legitimate HTTP requests to be made to URLs containing the sus
* [SamSam Ransomware](/stories/samsam_ransomware)
#### Kill Chain Phase
* Reconnaissance
#### RBA
@@ -90,13 +137,11 @@ It's possible for legitimate HTTP requests to be made to URLs containing the sus
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-23-detect_malicious_requests_to_exploit_jboss_servers.md
+67 -9
View File
@@ -23,14 +23,77 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search is used to detect malicious HTTP requests crafted to exploit jmx-console in JBoss servers. The malicious requests have a long URL length, as the payload is embedded in the URL.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
- **Last Updated**: 2017-09-23
- **Author**: Bhavin Patel, Splunk
- **ID**: c8bff7a4-11ea-4416-a27d-c5bca472913d
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.RA
* PR.PT
* PR.IP
* DE.AE
* PR.MA
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 12
* CIS 4
* CIS 18
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -49,7 +112,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `detect_malicious_requests_to_exploit_jboss_servers_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_malicious_requests_to_exploit_jboss_servers_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +134,6 @@ No known false positives for this detection.
* [SamSam Ransomware](/stories/samsam_ransomware)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -83,13 +143,11 @@ No known false positives for this detection.
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-23-monitor_dns_for_brand_abuse.md
+58 -11
View File
@@ -21,14 +21,67 @@ tags:
This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
- **Last Updated**: 2017-09-23
- **Author**: David Dorsey, Splunk
- **ID**: 24dd17b1-e2fb-4c31-878c-d4f746595bfa
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -43,10 +96,10 @@ This search looks for DNS requests for faux domains similar to the domains that
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [brand_abuse_dns](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_dns.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `monitor_dns_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **monitor_dns_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,10 +115,6 @@ None at this time
* [Brand Monitoring](/stories/brand_monitoring)
#### Kill Chain Phase
* Delivery
* Actions on Objectives
#### RBA
@@ -75,13 +124,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-09-23-monitor_web_traffic_for_brand_abuse.md
+61 -10
View File
@@ -23,14 +23,70 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for Web requests to faux domains similar to the one that you want to have monitored for abuse.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Web](https://docs.splunk.com/Documentation/CIM/latest/User/Web)
- **Last Updated**: 2017-09-23
- **Author**: David Dorsey, Splunk
- **ID**: 134da869-e264-4a8f-8d7e-fcd0ec88f301
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 7
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -44,11 +100,11 @@ This search looks for Web requests to faux domains similar to the one that you w
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [brand_abuse_web](https://github.com/splunk/security_content/blob/develop/macros/brand_abuse_web.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `monitor_web_traffic_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **monitor_web_traffic_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -66,9 +122,6 @@ None at this time
* [Brand Monitoring](/stories/brand_monitoring)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -78,13 +131,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-10-13-unusually_long_content-type_length.md
+69 -9
View File
@@ -22,14 +22,79 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for unusually long strings in the Content-Type http header that the client sends the server.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2017-10-13
- **Author**: Bhavin Patel, Splunk
- **ID**: 57a0a2bf-353f-40c1-84dc-29293f3c35b7
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.RA
* RS.MI
* PR.PT
* PR.IP
* DE.AE
* PR.MA
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 4
* CIS 18
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -44,7 +109,7 @@ This search looks for unusually long strings in the Content-Type http header tha
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
Note that `unusually_long_content-type_length_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **unusually_long_content-type_length_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -65,9 +130,6 @@ Very few legitimate Content-Type fields will have a length greater than 100 char
* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -77,13 +139,11 @@ Very few legitimate Content-Type fields will have a length greater than 100 char
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2017-11-27-detect_usb_device_insertion.md
+62 -10
View File
@@ -21,14 +21,72 @@ tags:
The search is used to detect hosts that generate Windows Event ID 4663 for successful attempts to write to or read from a removable storage and Event ID 4656 for failures, which occurs when a USB drive is plugged in. In this scenario we are querying the Change_Analysis data model to look for Windows Event ID 4656 or 4663 where the priority of the affected host is marked as high in the ES Assets and Identity Framework.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Change_Analysis](https://docs.splunk.com/Documentation/CIM/latest/User/ChangeAnalysis)
- **Last Updated**: 2017-11-27
- **Author**: Bhavin Patel, Splunk
- **ID**: 104658f4-afdc-499f-9719-17a43f9826f5
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Installation
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.DS
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 13
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -45,7 +103,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `detect_usb_device_insertion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_usb_device_insertion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -65,10 +123,6 @@ Legitimate USB activity will also be detected. Please verify and investigate as
* [Data Protection](/stories/data_protection)
#### Kill Chain Phase
* Installation
* Actions on Objectives
#### RBA
@@ -78,13 +132,11 @@ Legitimate USB activity will also be detected. Please verify and investigate as
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-01-05-monitor_email_for_brand_abuse.md
+60 -9
View File
@@ -23,14 +23,70 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for emails claiming to be sent from a domain similar to one that you want to have monitored for abuse.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Email](https://docs.splunk.com/Documentation/CIM/latest/User/Email)
- **Last Updated**: 2018-01-05
- **Author**: David Dorsey, Splunk
- **ID**: b2ea1f38-3a3e-4b8a-9cf1-82760d86a6b8
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 7
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -52,7 +108,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `monitor_email_for_brand_abuse_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **monitor_email_for_brand_abuse_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -77,9 +133,6 @@ None at this time
* [Suspicious Emails](/stories/suspicious_emails)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -89,13 +142,11 @@ None at this time
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-02-23-ec2_instance_started_in_previously_unseen_region.md
+60 -10
View File
@@ -23,21 +23,76 @@ tags:
This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-02-23
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f3-d82362d6fd75
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.AE
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -58,7 +113,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `ec2_instance_started_in_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **ec2_instance_started_in_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -76,9 +131,6 @@ It's possible that a user has unknowingly started an instance in a new region. P
* [Suspicious AWS EC2 Activities](/stories/suspicious_aws_ec2_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -88,13 +140,11 @@ It's possible that a user has unknowingly started an instance in a new region. P
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-03-12-ec2_instance_started_with_previously_unseen_ami.md
+60 -9
View File
@@ -20,14 +20,70 @@ tags:
This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-03-12
- **Author**: David Dorsey, Splunk
- **ID**: 347ec301-601b-48b9-81aa-9ddf9c829dd3
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -53,7 +109,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `ec2_instance_started_with_previously_unseen_ami_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **ec2_instance_started_with_previously_unseen_ami_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +128,6 @@ After a new AMI is created, the first systems created with that AMI will cause t
* [AWS Cryptomining](/stories/aws_cryptomining)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -84,13 +137,11 @@ After a new AMI is created, the first systems created with that AMI will cause t
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_city.md
+59 -10
View File
@@ -23,21 +23,75 @@ tags:
This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: 344a1778-0b25-490c-adb1-de8beddf59cd
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -64,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen cities.
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `aws_cloud_provisioning_from_previously_unseen_city_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **aws_cloud_provisioning_from_previously_unseen_city_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -95,13 +146,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_country.md
+59 -10
View File
@@ -23,21 +23,75 @@ tags:
This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: ceb8d3d8-06cb-49eb-beaf-829526e33ff0
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -64,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen countri
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `aws_cloud_provisioning_from_previously_unseen_country_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **aws_cloud_provisioning_from_previously_unseen_country_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -95,13 +146,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_ip_address.md
+60 -9
View File
@@ -20,14 +20,70 @@ tags:
This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: 42e15012-ac14-4801-94f4-f1acbe64880b
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -52,7 +108,7 @@ This search looks for AWS provisioning activities from previously unseen IP addr
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `aws_cloud_provisioning_from_previously_unseen_ip_address_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **aws_cloud_provisioning_from_previously_unseen_ip_address_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -71,9 +127,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -83,13 +136,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-03-16-aws_cloud_provisioning_from_previously_unseen_region.md
+59 -10
View File
@@ -23,21 +23,75 @@ tags:
This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-03-16
- **Author**: David Dorsey, Splunk
- **ID**: 7971d3df-da82-4648-a6e5-b5637bea5253
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1535](https://attack.mitre.org/techniques/T1535/) | Unused/Unsupported Cloud Regions | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -64,7 +118,7 @@ This search looks for AWS provisioning activities from previously unseen regions
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `aws_cloud_provisioning_from_previously_unseen_region_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **aws_cloud_provisioning_from_previously_unseen_region_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +137,6 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
* [AWS Suspicious Provisioning Activities](/stories/aws_suspicious_provisioning_activities)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -95,13 +146,11 @@ This is a strictly behavioral search, so we define "false positive" slightly dif
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-04-16-detect_new_api_calls_from_user_roles.md
+59 -10
View File
@@ -26,21 +26,75 @@ tags:
This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-04-16
- **Author**: Bhavin Patel, Splunk
- **ID**: 22773e84-bac0-4595-b086-20d3f335b4f1
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -66,7 +120,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_new_api_calls_from_user_roles_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_new_api_calls_from_user_roles_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -92,9 +146,6 @@ It is possible that there are legitimate user roles making new or infrequently u
* [AWS User Monitoring](/stories/aws_user_monitoring)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -104,13 +155,11 @@ It is possible that there are legitimate user roles making new or infrequently u
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-04-18-detect_spike_in_security_group_activity.md
+61 -10
View File
@@ -26,21 +26,77 @@ tags:
This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file that factors in the latest data. This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-04-18
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a3f1-e32372d4bd53
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078.004](https://attack.mitre.org/techniques/T1078/004/) | Cloud Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.CM
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -71,7 +127,7 @@ The SPL above uses the following Macros:
* [security_group_api_calls](https://github.com/splunk/security_content/blob/develop/macros/security_group_api_calls.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_spike_in_security_group_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_spike_in_security_group_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -94,9 +150,6 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
* [AWS User Monitoring](/stories/aws_user_monitoring)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -106,13 +159,11 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-05-07-detect_spike_in_blocked_outbound_traffic_from_your_aws.md
+63 -10
View File
@@ -22,14 +22,73 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search will detect spike in blocked outbound network connections originating from within your AWS environment. It will also update the cache file that factors in the latest data.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-05-07
- **Author**: Bhavin Patel, Splunk
- **ID**: d3fffa37-492f-487b-a35d-c60fcb2acf01
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.AE
* DE.CM
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 11
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,7 +115,7 @@ This search will detect spike in blocked outbound network connections originatin
The SPL above uses the following Macros:
* [cloudwatchlogs_vpcflow](https://github.com/splunk/security_content/blob/develop/macros/cloudwatchlogs_vpcflow.yml)
Note that `detect_spike_in_blocked_outbound_traffic_from_your_aws_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_spike_in_blocked_outbound_traffic_from_your_aws_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -83,10 +142,6 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
* [Command and Control](/stories/command_and_control)
#### Kill Chain Phase
* Actions on Objectives
* Command & Control
#### RBA
@@ -96,13 +151,11 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-05-17-detect_api_activity_from_users_without_mfa.md
+61 -9
View File
@@ -20,14 +20,71 @@ tags:
This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. Multi factor authentication adds a layer of security by forcing the users to type a unique authentication code from an approved authentication device when they access AWS websites or services. AWS Best Practices recommend that you enable MFA for privileged IAM users.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-05-17
- **Author**: Bhavin Patel, Splunk
- **ID**: 4d46e8bd-4072-48e4-92db-0325889ef894
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -47,7 +104,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_api_activity_from_users_without_mfa_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_api_activity_from_users_without_mfa_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -79,9 +136,6 @@ Many service accounts configured within an AWS infrastructure do not have multi
* [AWS User Monitoring](/stories/aws_user_monitoring)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -91,13 +145,11 @@ Many service accounts configured within an AWS infrastructure do not have multi
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-05-21-detect_spike_in_network_acl_activity.md
+63 -11
View File
@@ -23,21 +23,78 @@ tags:
This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-05-21
- **Author**: Bhavin Patel, Splunk
- **ID**: ada0f478-84a8-4641-a1f1-e32372d4bd53
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1562.007](https://attack.mitre.org/techniques/T1562/007/) | Disable or Modify Cloud Firewall | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.CM
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 12
* CIS 11
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -65,10 +122,10 @@ This search will detect users creating spikes in API activity related to network
#### Macros
The SPL above uses the following Macros:
* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
* [network_acl_events](https://github.com/splunk/security_content/blob/develop/macros/network_acl_events.yml)
Note that `detect_spike_in_network_acl_activity_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_spike_in_network_acl_activity_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -91,9 +148,6 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
* [AWS Network ACL Activity](/stories/aws_network_acl_activity)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -103,13 +157,11 @@ The false-positive rate may vary based on the values of`dataPointThreshold` and
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-06-01-detect_large_outbound_icmp_packets.md
+60 -10
View File
@@ -26,21 +26,76 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for outbound ICMP packets with a packet size larger than 1,000 bytes. Various threat actors have been known to use ICMP as a command and control channel for their attack infrastructure. Large ICMP packets from an endpoint to a remote host may be indicative of this activity.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Traffic](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkTraffic)
- **Last Updated**: 2018-06-01
- **Author**: Rico Valdez, Splunk
- **ID**: e9c102de-4d43-42a7-b1c8-8062ea297419
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1095](https://attack.mitre.org/techniques/T1095/) | Non-Application Layer Protocol | Command And Control |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.AE
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 9
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -58,7 +113,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `detect_large_outbound_icmp_packets_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_large_outbound_icmp_packets_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +136,6 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue
* [Command and Control](/stories/command_and_control)
#### Kill Chain Phase
* Command & Control
#### RBA
@@ -93,13 +145,11 @@ ICMP packets are used in a variety of ways to help troubleshoot networking issue
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-06-14-splunk_enterprise_information_disclosure.md
+71 -15
View File
@@ -21,14 +21,81 @@ tags:
This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-06-14
- **Author**: David Dorsey, Splunk
- **ID**: f6a26b7b-7e80-4963-a9a8-d836e7534ebd
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.RA
* RS.MI
* PR.PT
* PR.AC
* PR.IP
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 4
* CIS 18
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2018-11409](https://nvd.nist.gov/vuln/detail/CVE-2018-11409) | Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. | 5.0 |
</div>
</details>
#### Search
```
@@ -45,7 +112,7 @@ index=_internal sourcetype=splunkd_ui_access server-info
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `splunk_enterprise_information_disclosure_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **splunk_enterprise_information_disclosure_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -61,9 +128,6 @@ Retrieving server information may be a legitimate API request. Verify that the a
* [Splunk Vulnerabilities](/stories/splunk_vulnerabilities)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -73,19 +137,11 @@ Retrieving server information may be a legitimate API request. Verify that the a
| 25.0 | 50 | 50 | tbd |
#### CVE
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2018-11409](https://nvd.nist.gov/vuln/detail/CVE-2018-11409) | Splunk through 7.0.1 allows information disclosure by appending __raw/services/server/info/server-info?output_mode=json to a query, as demonstrated by discovering a license key. | 5.0 |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-06-28-detect_s3_access_from_a_new_ip.md
+62 -10
View File
@@ -25,21 +25,78 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks at S3 bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed an S3 bucket.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-06-28
- **Author**: Bhavin Patel, Splunk
- **ID**: e6f1bb1b-f441-492b-9126-902acda217da
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.DS
* PR.AC
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 13
* CIS 14
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -64,7 +121,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [aws_s3_accesslogs](https://github.com/splunk/security_content/blob/develop/macros/aws_s3_accesslogs.yml)
Note that `detect_s3_access_from_a_new_ip_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_s3_access_from_a_new_ip_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -83,9 +140,6 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn
* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -95,13 +149,11 @@ S3 buckets can be accessed from any IP, as long as it can make a successful conn
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-08-web_fraud_-_account_harvesting.md
+60 -10
View File
@@ -23,21 +23,76 @@ tags:
This search is used to identify the creation of multiple user accounts using the same email domain name.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-10-08
- **Author**: Jim Apger, Splunk
- **ID**: bf1d7b5c-df2f-4249-a401-c09fdc221ddf
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1136](https://attack.mitre.org/techniques/T1136/) | Create Account | Persistence |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
* DE.DP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,7 +111,7 @@ This search is used to identify the creation of multiple user accounts using the
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
Note that `web_fraud_-_account_harvesting_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **web_fraud_-_account_harvesting_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +130,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
* [Web Fraud Detection](/stories/web_fraud_detection)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -87,8 +139,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
| 25.0 | 50 | 50 | tbd |
#### Reference
* [https://splunkbase.splunk.com/app/2734/](https://splunkbase.splunk.com/app/2734/)
@@ -97,7 +147,7 @@ As is common with many fraud-related searches, we are usually looking to attribu
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-08-web_fraud_-_anomalous_user_clickspeed.md
+60 -10
View File
@@ -26,21 +26,76 @@ tags:
This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect cadence (high periodicity or low standard deviation), resembling a script driven session.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-10-08
- **Author**: Jim Apger, Splunk
- **ID**: 31337bbb-bc22-4752-b599-ef192df2dc7a
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1078](https://attack.mitre.org/techniques/T1078/) | Valid Accounts | Defense Evasion, Initial Access, Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.AE
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 6
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -57,7 +112,7 @@ This search is used to examine web sessions to identify those where the clicks a
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
Note that `web_fraud_-_anomalous_user_clickspeed_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **web_fraud_-_anomalous_user_clickspeed_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +130,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
* [Web Fraud Detection](/stories/web_fraud_detection)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -87,8 +139,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
| 25.0 | 50 | 50 | tbd |
#### Reference
* [https://en.wikipedia.org/wiki/Session_ID](https://en.wikipedia.org/wiki/Session_ID)
@@ -99,7 +149,7 @@ As is common with many fraud-related searches, we are usually looking to attribu
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-08-web_fraud_-_password_sharing_across_accounts.md
+60 -9
View File
@@ -20,14 +20,70 @@ tags:
This search is used to identify user accounts that share a common password.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-10-08
- **Author**: Jim Apger, Splunk
- **ID**: 31337a1a-53b9-4e05-96e9-55c934cb71d3
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -45,7 +101,7 @@ This search is used to identify user accounts that share a common password.
The SPL above uses the following Macros:
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
Note that `web_fraud_-_password_sharing_across_accounts_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **web_fraud_-_password_sharing_across_accounts_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -63,9 +119,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
* [Web Fraud Detection](/stories/web_fraud_detection)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -75,8 +128,6 @@ As is common with many fraud-related searches, we are usually looking to attribu
| 25.0 | 50 | 50 | tbd |
#### Reference
* [https://en.wikipedia.org/wiki/Session_ID](https://en.wikipedia.org/wiki/Session_ID)
@@ -87,7 +138,7 @@ As is common with many fraud-related searches, we are usually looking to attribu
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-12-cloud_compute_instance_created_with_previously_unseen_image.md
+61 -10
View File
@@ -21,14 +21,70 @@ tags:
This search looks for cloud compute instances being created with previously unseen image IDs.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)
- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Datamodel**: [Change](https://docs.splunk.com/Documentation/CIM/latest/User/Change)- **Datasource**: [Splunk Add-on for Amazon Kinesis Firehose](https://splunkbase.splunk.com/app/3719)
- **Last Updated**: 2018-10-12
- **Author**: David Dorsey, Splunk
- **ID**: bc24922d-987c-4645-b288-f8c73ec194c4
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -51,7 +107,7 @@ This search looks for cloud compute instances being created with previously unse
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `cloud_compute_instance_created_with_previously_unseen_image_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **cloud_compute_instance_created_with_previously_unseen_image_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -76,9 +132,6 @@ After a new image is created, the first systems created with that image will cau
* [Cloud Cryptomining](/stories/cloud_cryptomining)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -88,13 +141,11 @@ After a new image is created, the first systems created with that image will cau
| 36.0 | 60 | 60 | User $user$ is creating an instance $dest$ with an image that has not been previously seen. |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-23-wmi_permanent_event_subscription.md
+64 -11
View File
@@ -25,21 +25,79 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for the creation of WMI permanent event subscriptions.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-10-23
- **Author**: Rico Valdez, Splunk
- **ID**: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.AT
* PR.AC
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,10 +114,10 @@ This search looks for the creation of WMI permanent event subscriptions.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `wmi_permanent_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **wmi_permanent_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +137,6 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -91,13 +146,11 @@ Although unlikely, administrators may use event subscriptions for legitimate pur
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-10-23-wmi_temporary_event_subscription.md
+64 -11
View File
@@ -25,21 +25,79 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for the creation of WMI temporary event subscriptions.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-10-23
- **Author**: Rico Valdez, Splunk
- **ID**: 38cbd42c-1098-41bb-99cf-9d6d2b296d83
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.AT
* PR.AC
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -55,10 +113,10 @@ This search looks for the creation of WMI temporary event subscriptions.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wmi](https://github.com/splunk/security_content/blob/develop/macros/wmi.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `wmi_temporary_event_subscription_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **wmi_temporary_event_subscription_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -77,9 +135,6 @@ Some software may create WMI temporary event subscriptions for various purposes.
* [Suspicious WMI Use](/stories/suspicious_wmi_use)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -89,13 +144,11 @@ Some software may create WMI temporary event subscriptions for various purposes.
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-11-02-windows_hosts_file_modification.md
+66 -9
View File
@@ -20,14 +20,76 @@ tags:
The search looks for modifications to the hosts file on all Windows endpoints across your environment.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-11-02
- **Author**: Rico Valdez, Splunk
- **ID**: 06a6fc63-a72d-41dc-8736-7e3dd9612116
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
* PR.PT
* PR.AC
* DE.AE
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 8
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -45,7 +107,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `windows_hosts_file_modification_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **windows_hosts_file_modification_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -61,9 +123,6 @@ There may be legitimate reasons for system administrators to add entries to this
* [Host Redirection](/stories/host_redirection)
#### Kill Chain Phase
* Command & Control
#### RBA
@@ -73,13 +132,11 @@ There may be legitimate reasons for system administrators to add entries to this
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-11-27-detect_spike_in_s3_bucket_deletion.md
+61 -10
View File
@@ -25,21 +25,77 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file that factors in the latest data.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-11-27
- **Author**: Bhavin Patel, Splunk
- **ID**: e733a326-59d2-446d-b8db-14a17151aa68
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1530](https://attack.mitre.org/techniques/T1530/) | Data from Cloud Storage Object | Collection |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.CM
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 13
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -70,7 +126,7 @@ This search detects users creating spikes in API activity related to deletion of
The SPL above uses the following Macros:
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `detect_spike_in_s3_bucket_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_spike_in_s3_bucket_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Lookups
The SPL above uses the following Lookups:
@@ -94,9 +150,6 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
* [Suspicious AWS S3 Activities](/stories/suspicious_aws_s3_activities)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -106,13 +159,11 @@ Based on the values of`dataPointThreshold` and `deviationThreshold`, the false p
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-12-03-remote_wmi_command_attempt.md
+66 -13
View File
@@ -24,21 +24,79 @@ tags:
The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. During triage, review parallel processes for additional commands executed. Look for any file modifications before and after `wmic.exe` execution. In addition, identify the remote endpoint and confirm execution or file modifications. Contain and isolate the endpoint as needed.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-03
- **Author**: Rico Valdez, Michael Haag, Splunk
- **ID**: 272df6de-61f1-4784-877c-1fbc3e2d0838
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1047](https://attack.mitre.org/techniques/T1047/) | Windows Management Instrumentation | Execution |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* PR.AT
* PR.AC
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -52,11 +110,11 @@ The following analytic identifies usage of `wmic.exe` spawning a local or remote
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [process_wmic](https://github.com/splunk/security_content/blob/develop/macros/process_wmic.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `remote_wmi_command_attempt_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **remote_wmi_command_attempt_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +138,6 @@ Administrators may use this legitimately to gather info from remote systems. Fil
* [Living Off The Land](/stories/living_off_the_land)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -92,8 +147,6 @@ Administrators may use this legitimately to gather info from remote systems. Fil
| 36.0 | 60 | 60 | A wmic.exe process $process$ contain node commandline $process$ in host $dest$ |
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1047/T1047.yaml)
@@ -101,7 +154,7 @@ Administrators may use this legitimately to gather info from remote systems. Fil
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-12-03-usn_journal_deletion.md
+66 -11
View File
@@ -24,21 +24,81 @@ tags:
The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files on the disk. This search looks for fsutil.exe deleting the USN journal.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-03
- **Author**: David Dorsey, Splunk
- **ID**: b6e0ff70-b122-4227-9368-4cf322ab43c3
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1070](https://attack.mitre.org/techniques/T1070/) | Indicator Removal on Host | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
* PR.PT
* DE.AE
* DE.DP
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 6
* CIS 8
* CIS 10
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,7 +116,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `usn_journal_deletion_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **usn_journal_deletion_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -79,9 +139,6 @@ None identified
* [Ransomware](/stories/ransomware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -91,13 +148,11 @@ None identified
| 45.0 | 50 | 90 | Possible USN journal deletion on $dest$ |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-12-06-suspicious_java_classes.md
+62 -10
View File
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for suspicious Java classes that are often used to exploit remote command execution in common Java frameworks, such as Apache Struts.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2018-12-06
- **Author**: Jose Hernandez, Splunk
- **ID**: 6ed33786-5e87-4f55-b62c-cb5f1168b831
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.AE
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 7
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -45,10 +102,10 @@ This search looks for suspicious Java classes that are often used to exploit rem
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [stream_http](https://github.com/splunk/security_content/blob/develop/macros/stream_http.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `suspicious_java_classes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **suspicious_java_classes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -72,9 +129,6 @@ There are no known false positives.
* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -84,13 +138,11 @@ There are no known false positives.
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-12-14-file_with_samsam_extension.md
+62 -10
View File
@@ -21,14 +21,71 @@ tags:
The search looks for file writes with extensions consistent with a SamSam ransomware attack.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-14
- **Author**: Rico Valdez, Splunk
- **ID**: 02c6cfc2-ae66-4735-bfc7-6291da834cbf
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Installation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -47,7 +104,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `file_with_samsam_extension_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **file_with_samsam_extension_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -67,9 +124,6 @@ Because these extensions are not typically used in normal operations, you should
* [SamSam Ransomware](/stories/samsam_ransomware)
#### Kill Chain Phase
* Installation
#### RBA
@@ -79,13 +133,11 @@ Because these extensions are not typically used in normal operations, you should
| 90.0 | 100 | 90 | File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2018-12-14-samsam_test_file_write.md
+61 -11
View File
@@ -24,21 +24,76 @@ tags:
The search looks for a file named "test.txt" written to the windows system directory tree, which is consistent with Samsam propagation.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2018-12-14
- **Author**: Rico Valdez, Splunk
- **ID**: 493a879d-519d-428f-8f57-a06a0fdc107e
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1486](https://attack.mitre.org/techniques/T1486/) | Data Encrypted for Impact | Impact |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Delivery
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -55,7 +110,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `samsam_test_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **samsam_test_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +130,6 @@ No false positives have been identified.
* [SamSam Ransomware](/stories/samsam_ransomware)
#### Kill Chain Phase
* Delivery
#### RBA
@@ -87,13 +139,11 @@ No false positives have been identified.
| 12.0 | 60 | 20 | A samsam ransomware test file creation in $file_path$ in host $dest$ |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-01-25-processes_tapping_keyboard_events.md
+61 -9
View File
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for processes in an MacOS system that is tapping keyboard events in MacOS, and essentially monitoring all keystrokes made by a user. This is a common technique used by RATs to log keystrokes from a victim, although it can also be used by legitimate processes like Siri to react on human input
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-01-25
- **Author**: Jose Hernandez, Splunk
- **ID**: 2a371608-331d-4034-ae2c-21dda8f1d0ec
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 4
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -45,7 +102,7 @@ This search looks for processes in an MacOS system that is tapping keyboard even
#### Macros
The SPL above uses the following Macros:
Note that `processes_tapping_keyboard_events_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **processes_tapping_keyboard_events_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -67,9 +124,6 @@ There might be some false positives as keyboard event taps are used by processes
* [ColdRoot MacOS RAT](/stories/coldroot_macos_rat)
#### Kill Chain Phase
* Command & Control
#### RBA
@@ -79,13 +133,11 @@ There might be some false positives as keyboard event taps are used by processes
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-01-29-osquery_pack_-_coldroot_detection.md
+64 -10
View File
@@ -20,14 +20,74 @@ tags:
This search looks for ColdRoot events from the osx-attacks osquery pack.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-01-29
- **Author**: Rico Valdez, Splunk
- **ID**: a6fffe5e-05c3-4c04-badc-887607fbb8dc
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Installation
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.CM
* PR.PT
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 4
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -43,7 +103,7 @@ This search looks for ColdRoot events from the osx-attacks osquery pack.
#### Macros
The SPL above uses the following Macros:
Note that `osquery_pack_-_coldroot_detection_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **osquery_pack_-_coldroot_detection_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -59,10 +119,6 @@ There are no known false positives.
* [ColdRoot MacOS RAT](/stories/coldroot_macos_rat)
#### Kill Chain Phase
* Installation
* Command & Control
#### RBA
@@ -72,13 +128,11 @@ There are no known false positives.
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-02-27-detect_mimikatz_via_powershell_and_eventcode_4703.md
+63 -10
View File
@@ -23,21 +23,79 @@ tags:
This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-02-27
- **Author**: Rico Valdez, Splunk
- **ID**: 98917be2-bfc8-475a-8618-a9bb06575188
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
* PR.AC
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -57,7 +115,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [wineventlog_security](https://github.com/splunk/security_content/blob/develop/macros/wineventlog_security.yml)
Note that `detect_mimikatz_via_powershell_and_eventcode_4703_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_mimikatz_via_powershell_and_eventcode_4703_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +136,6 @@ The activity may be legitimate. PowerShell is often used by administrators to pe
* [Cloud Federated Credential Abuse](/stories/cloud_federated_credential_abuse)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -90,13 +145,11 @@ The activity may be legitimate. PowerShell is often used by administrators to pe
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-02-27-reg_exe_used_to_hide_files_directories_via_registry_keys.md
+59 -10
View File
@@ -24,21 +24,75 @@ tags:
The search looks for command-line arguments used to hide a file or directory using the reg add command.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2019-02-27
- **Author**: Bhavin Patel, Splunk
- **ID**: 61a7d1e6-f5d4-41d9-a9be-39a1ffe69459
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1564.001](https://attack.mitre.org/techniques/T1564/001/) | Hidden Files and Directories | Defense Evasion |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,7 +110,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `reg_exe_used_to_hide_files_directories_via_registry_keys_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **reg_exe_used_to_hide_files_directories_via_registry_keys_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +128,6 @@ None at the moment
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -86,13 +137,11 @@ None at the moment
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-04-01-web_servers_executing_suspicious_processes.md
+59 -10
View File
@@ -26,21 +26,75 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for suspicious processes on all systems labeled as web servers.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2019-04-01
- **Author**: David Dorsey, Splunk
- **ID**: ec3b7601-689a-4463-94e0-c9f45638efb9
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1082](https://attack.mitre.org/techniques/T1082/) | System Information Discovery | Discovery |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -57,7 +111,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `web_servers_executing_suspicious_processes_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **web_servers_executing_suspicious_processes_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -78,9 +132,6 @@ Some of these processes may be used legitimately on web servers during maintenan
* [Apache Struts Vulnerability](/stories/apache_struts_vulnerability)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -90,13 +141,11 @@ Some of these processes may be used legitimately on web servers during maintenan
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-04-25-suspicious_file_write.md
+62 -10
View File
@@ -20,14 +20,71 @@ tags:
The search looks for files created with names that have been linked to malicious activity.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-04-25
- **Author**: Rico Valdez, Splunk
- **ID**: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -43,10 +100,10 @@ The search looks for files created with names that have been linked to malicious
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
* [suspicious_writes](https://github.com/splunk/security_content/blob/develop/macros/suspicious_writes.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `suspicious_file_write_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **suspicious_file_write_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,9 +119,6 @@ It's possible for a legitimate file to be created with the same name as one note
* [Hidden Cobra Malware](/stories/hidden_cobra_malware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -74,13 +128,11 @@ It's possible for a legitimate file to be created with the same name as one note
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-05-08-unusually_long_command_line_-_mltk.md
+61 -9
View File
@@ -22,14 +22,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Machine Learning Toolkit (MLTK) to help identify command lines with lengths that are unusual for a given user.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-05-08
- **Author**: Rico Valdez, Splunk
- **ID**: 57edaefa-a73b-45e5-bbae-f39c1473f941
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -52,7 +109,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `unusually_long_command_line_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **unusually_long_command_line_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -75,9 +132,6 @@ Some legitimate applications use long command lines for installs or updates. You
* [Ransomware](/stories/ransomware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -87,13 +141,11 @@ Some legitimate applications use long command lines for installs or updates. You
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-10-11-prohibited_software_on_endpoint.md
+63 -11
View File
@@ -21,14 +21,73 @@ tags:
This search looks for applications on the endpoint that you have marked as prohibited.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2019-10-11
- **Author**: David Dorsey, Splunk
- **ID**: a51bfe1a-94f0-48cc-b4e4-b6ae50145893
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Installation
* Command & Control
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
* PR.DS
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 2
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -47,7 +106,7 @@ The SPL above uses the following Macros:
* [prohibited_softwares](https://github.com/splunk/security_content/blob/develop/macros/prohibited_softwares.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `prohibited_software_on_endpoint_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **prohibited_software_on_endpoint_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _times
@@ -65,11 +124,6 @@ None identified
* [SamSam Ransomware](/stories/samsam_ransomware)
#### Kill Chain Phase
* Installation
* Command & Control
* Actions on Objectives
#### RBA
@@ -79,13 +133,11 @@ None identified
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-12-03-detect_credential_dumping_through_lsass_access.md
+64 -11
View File
@@ -26,16 +26,21 @@ tags:
This search looks for reading lsass memory consistent with credential dumping.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-12-03
- **Author**: Patrick Bareiss, Splunk
- **ID**: 2c365e57-4414-4540-8dc0-73ab10729996
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,59 @@ This search looks for reading lsass memory consistent with credential dumping.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.IP
* PR.AC
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,10 +114,10 @@ This search looks for reading lsass memory consistent with credential dumping.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_credential_dumping_through_lsass_access_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_credential_dumping_through_lsass_access_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +142,6 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas
* [Detect Zerologon Attack](/stories/detect_zerologon_attack)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -96,13 +151,11 @@ The activity may be legitimate. Other tools can access lsass for legitimate reas
| 80.0 | 80 | 100 | The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-12-03-detect_mimikatz_using_loaded_images.md
+62 -11
View File
@@ -26,16 +26,21 @@ tags:
This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon Event Code.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-12-03
- **Author**: Patrick Bareiss, Splunk
- **ID**: 29e307ba-40af-4ab2-91b2-3c6b392bbba0
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,57 @@ This search looks for reading loaded Images unique to credential dumping with Mi
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.AE
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 6
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -57,10 +113,10 @@ This search looks for reading loaded Images unique to credential dumping with Mi
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `detect_mimikatz_using_loaded_images_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **detect_mimikatz_using_loaded_images_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -84,9 +140,6 @@ Other tools can import the same DLLs. These tools should be part of a whitelist.
* [DarkSide Ransomware](/stories/darkside_ransomware)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -96,8 +149,6 @@ Other tools can import the same DLLs. These tools should be part of a whitelist.
| 64.0 | 80 | 80 | A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. |
#### Reference
* [https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html](https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html)
@@ -105,7 +156,7 @@ Other tools can import the same DLLs. These tools should be part of a whitelist.
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-12-06-access_lsass_memory_for_dump_creation.md
+61 -11
View File
@@ -26,16 +26,21 @@ tags:
Detect memory dumping of the LSASS process.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-12-06
- **Author**: Patrick Bareiss, Splunk
- **ID**: fb4c31b0-13e8-4155-8aa5-24de4b8d6717
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ Detect memory dumping of the LSASS process.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 6
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,10 +111,10 @@ Detect memory dumping of the LSASS process.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `access_lsass_memory_for_dump_creation_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **access_lsass_memory_for_dump_creation_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +137,6 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
* [Credential Dumping](/stories/credential_dumping)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -94,8 +146,6 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
| 63.0 | 70 | 90 | process $SourceImage$ injected into $TargetImage$ and was attempted dump LSASS on $dest$. Adversaries tend to do this when trying to accesss credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS). |
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -103,7 +153,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-12-06-create_remote_thread_into_lsass.md
+61 -11
View File
@@ -26,16 +26,21 @@ tags:
Detect remote thread creation into LSASS consistent with credential dumping.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-12-06
- **Author**: Patrick Bareiss, Splunk
- **ID**: 67d4dbef-9564-4699-8da8-03a151529edc
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ Detect remote thread creation into LSASS consistent with credential dumping.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,10 +111,10 @@ Detect remote thread creation into LSASS consistent with credential dumping.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `create_remote_thread_into_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **create_remote_thread_into_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -82,9 +137,6 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th
* [Credential Dumping](/stories/credential_dumping)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -94,8 +146,6 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th
| 81.0 | 90 | 90 | A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. |
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -103,7 +153,7 @@ Other tools can access LSASS for legitimate reasons and generate an event. In th
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-12-06-unsigned_image_loaded_by_lsass.md
+61 -11
View File
@@ -23,21 +23,76 @@ tags:
This search detects loading of unsigned images by LSASS. Deprecated because too noisy.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2019-12-06
- **Author**: Patrick Bareiss, Splunk
- **ID**: 56ef054c-76ef-45f9-af4a-a634695dcd65
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1003.001](https://attack.mitre.org/techniques/T1003/001/) | LSASS Memory | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -51,10 +106,10 @@ This search detects loading of unsigned images by LSASS. Deprecated because too
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `unsigned_image_loaded_by_lsass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **unsigned_image_loaded_by_lsass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -70,9 +125,6 @@ Other tools could load images into LSASS for legitimate reason. But enterprise t
* [Credential Dumping](/stories/credential_dumping)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -82,8 +134,6 @@ Other tools could load images into LSASS for legitimate reason. But enterprise t
| 25.0 | 50 | 50 | tbd |
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -91,7 +141,7 @@ Other tools could load images into LSASS for legitimate reason. But enterprise t
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2019-12-10-creation_of_shadow_copy.md
+61 -11
View File
@@ -27,16 +27,21 @@ tags:
Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2019-12-10
- **Author**: Patrick Bareiss, Splunk
- **ID**: eb120f5f-b879-4a63-97c1-93352b5df844
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,56 @@ Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -60,7 +115,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `creation_of_shadow_copy_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **creation_of_shadow_copy_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +142,6 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives.
* [Credential Dumping](/stories/credential_dumping)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -99,8 +151,6 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives.
| 81.0 | 90 | 90 | An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. |
#### Reference
* [https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf](https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf)
@@ -108,7 +158,7 @@ Legitimate administrator usage of Vssadmin or Wmic will create false positives.
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-01-22-dns_query_length_outliers_-_mltk.md
+62 -10
View File
@@ -29,16 +29,21 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search allows you to identify DNS requests that are unusually large for the record type being requested in your environment.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Network_Resolution](https://docs.splunk.com/Documentation/CIM/latest/User/NetworkResolution)
- **Last Updated**: 2020-01-22
- **Author**: Rico Valdez, Splunk
- **ID**: 85fbcfe8-9718-4911-adf6-7000d077a3a9
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,58 @@ This search allows you to identify DNS requests that are unusually large for the
| [T1071](https://attack.mitre.org/techniques/T1071/) | Application Layer Protocol | Command And Control |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.AE
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
* CIS 12
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -69,7 +126,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `dns_query_length_outliers_-_mltk_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **dns_query_length_outliers_-_mltk_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -97,9 +154,6 @@ If you are seeing more results than desired, you may consider reducing the value
* [Command and Control](/stories/command_and_control)
#### Kill Chain Phase
* Command & Control
#### RBA
@@ -109,13 +163,11 @@ If you are seeing more results than desired, you may consider reducing the value
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-01-28-auto_admin_logon_registry_entry.md
+56 -11
View File
@@ -27,16 +27,21 @@ tags:
this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to continue encrypting the whole network. This behavior is not a common practice and really a suspicious TTP or alert need to be consider if found within then network premise.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 1379d2b8-0f18-11ec-8ca3-acde48001122
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,51 @@ this search is to detect a suspicious registry modification to implement auto ad
| [T1552](https://attack.mitre.org/techniques/T1552/) | Unsecured Credentials | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -64,7 +114,7 @@ this search is to detect a suspicious registry modification to implement auto ad
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `auto_admin_logon_registry_entry_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **auto_admin_logon_registry_entry_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -85,9 +135,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -97,8 +144,6 @@ unknown
| 63.0 | 70 | 90 | modified registry key $registry_key_name$ with registry value $registry_value_name$ to prepare autoadminlogon |
#### Reference
* [https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/](https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/)
@@ -106,7 +151,7 @@ unknown
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-01-28-monitor_registry_keys_for_print_monitors.md
+62 -10
View File
@@ -28,16 +28,21 @@ tags:
This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry by giving the full path name to the after.dll. The system will execute the .dll with elevated (SYSTEM) permissions and will persist after reboot.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-01-28
- **Author**: Bhavin Patel, Teoderick Contreras, Splunk
- **ID**: f5f6af30-7ba7-4295-bfe9-07de87c01bbc
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,58 @@ This search looks for registry activity associated with modifications to the reg
| [T1547](https://attack.mitre.org/techniques/T1547/) | Boot or Logon Autostart Execution | Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
* PR.AC
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
* CIS 5
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -65,7 +122,7 @@ This search looks for registry activity associated with modifications to the reg
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `monitor_registry_keys_for_print_monitors_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **monitor_registry_keys_for_print_monitors_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -89,9 +146,6 @@ You will encounter noise from legitimate print-monitor registry entries.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -101,13 +155,11 @@ You will encounter noise from legitimate print-monitor registry entries.
| 64.0 | 80 | 80 | New print monitor added on $dest$ |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-01-28-registry_keys_for_creating_shim_databases.md
+60 -10
View File
@@ -28,16 +28,21 @@ tags:
This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-01-28
- **Author**: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk
- **ID**: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -45,6 +50,56 @@ This search looks for registry activity associated with application compatibilit
| [T1546](https://attack.mitre.org/techniques/T1546/) | Event Triggered Execution | Persistence, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -65,7 +120,7 @@ This search looks for registry activity associated with application compatibilit
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `registry_keys_for_creating_shim_databases_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **registry_keys_for_creating_shim_databases_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +142,6 @@ There are many legitimate applications that leverage shim databases for compatib
* [Windows Registry Abuse](/stories/windows_registry_abuse)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -99,13 +151,11 @@ There are many legitimate applications that leverage shim databases for compatib
| 56.0 | 70 | 80 | A registry activity in $registry_path$ related to shim modication in host $dest$ |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-01-28-sdclt_uac_bypass.md
+56 -11
View File
@@ -29,16 +29,21 @@ tags:
This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: d71efbf6-da63-11eb-8c6e-acde48001122
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -66,7 +116,7 @@ This search is to detect a suspicious sdclt.exe registry modification. This tech
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `sdclt_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **sdclt_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ Limited to no false positives are expected.
* [Windows Registry Abuse](/stories/windows_registry_abuse)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -99,8 +146,6 @@ Limited to no false positives are expected.
| 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
#### Reference
* [https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/](https://enigma0x3.net/2017/03/17/fileless-uac-bypass-using-sdclt-exe/)
@@ -110,7 +155,7 @@ Limited to no false positives are expected.
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-01-28-silentcleanup_uac_bypass.md
+56 -11
View File
@@ -29,16 +29,21 @@ tags:
This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 56d7cfcc-da63-11eb-92d4-acde48001122
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect a suspicious modification of registry that may related
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -66,7 +116,7 @@ This search is to detect a suspicious modification of registry that may related
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `silentcleanup_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **silentcleanup_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -87,9 +137,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -99,8 +146,6 @@ unknown
| 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
#### Reference
* [https://github.com/hfiref0x/UACME](https://github.com/hfiref0x/UACME)
@@ -109,7 +154,7 @@ unknown
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-01-28-wsreset_uac_bypass.md
+56 -11
View File
@@ -29,16 +29,21 @@ tags:
This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-01-28
- **Author**: Teoderick Contreras, Splunk
- **ID**: 8b5901bc-da63-11eb-be43-acde48001122
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -46,6 +51,51 @@ This search is to detect a suspicious modification of registry related to UAC by
| [T1548](https://attack.mitre.org/techniques/T1548/) | Abuse Elevation Control Mechanism | Defense Evasion, Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -66,7 +116,7 @@ This search is to detect a suspicious modification of registry related to UAC by
The SPL above uses the following Macros:
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `wsreset_uac_bypass_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **wsreset_uac_bypass_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -88,9 +138,6 @@ unknown
* [Windows Registry Abuse](/stories/windows_registry_abuse)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -100,8 +147,6 @@ unknown
| 63.0 | 70 | 90 | Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ |
#### Reference
* [https://github.com/hfiref0x/UACME](https://github.com/hfiref0x/UACME)
@@ -110,7 +155,7 @@ unknown
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-02-03-creation_of_lsass_dump_with_taskmgr.md
+61 -11
View File
@@ -26,16 +26,21 @@ tags:
Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-02-03
- **Author**: Michael Haag, Splunk
- **ID**: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -43,6 +48,56 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 6
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -56,10 +111,10 @@ Detect the hands on keyboard behavior of Windows Task Manager creating a process
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [sysmon](https://github.com/splunk/security_content/blob/develop/macros/sysmon.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
Note that `creation_of_lsass_dump_with_taskmgr_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **creation_of_lsass_dump_with_taskmgr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -80,9 +135,6 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
* [Credential Dumping](/stories/credential_dumping)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -92,8 +144,6 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
| 80.0 | 80 | 100 | $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. |
#### Reference
* [https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager](https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-5---dump-lsassexe-memory-using-windows-task-manager)
@@ -103,7 +153,7 @@ Administrators can create memory dumps for debugging purposes, but memory dumps
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-02-07-ec2_instance_started_with_previously_unseen_instance_type.md
+60 -9
View File
@@ -20,14 +20,70 @@ tags:
This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest Change Datamodel.
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Anomaly](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-02-07
- **Author**: David Dorsey, Splunk
- **ID**: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* ID.AM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 1
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -55,7 +111,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [cloudtrail](https://github.com/splunk/security_content/blob/develop/macros/cloudtrail.yml)
Note that `ec2_instance_started_with_previously_unseen_instance_type_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **ec2_instance_started_with_previously_unseen_instance_type_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -74,9 +130,6 @@ It is possible that an admin will create a new system using a new instance type
* [AWS Cryptomining](/stories/aws_cryptomining)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -86,13 +139,11 @@ It is possible that an admin will create a new system using a new instance type
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-02-07-macos_-_re-opened_applications.md
+62 -10
View File
@@ -23,14 +23,72 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for processes referencing the plist files that determine which applications are re-opened when a user reboots their machine.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2020-02-07
- **Author**: Jamie Windley, Splunk
- **ID**: 40bb64f9-f619-4e3d-8732-328d40377c4b
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Installation
* Command & Control
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.DP
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -47,7 +105,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `macos_-_re-opened_applications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **macos_-_re-opened_applications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -69,10 +127,6 @@ At this stage, there are no known false positives. During testing, no process ev
* [ColdRoot MacOS RAT](/stories/coldroot_macos_rat)
#### Kill Chain Phase
* Installation
* Command & Control
#### RBA
@@ -82,13 +136,11 @@ At this stage, there are no known false positives. During testing, no process ev
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-02-20-gcp_gcr_container_uploaded.md
+55 -10
View File
@@ -23,21 +23,71 @@ tags:
This search show information on uploaded containers including source user, account, action, bucket name event name, http user agent, message and destination path.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-02-20
- **Author**: Rod Soto, Rico Valdez, Splunk
- **ID**: 4f00ca88-e766-4605-ac65-ae51c9fd185b
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -50,7 +100,7 @@ This search show information on uploaded containers including source user, accou
#### Macros
The SPL above uses the following Macros:
Note that `gcp_gcr_container_uploaded_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **gcp_gcr_container_uploaded_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -66,9 +116,6 @@ Uploading container is a normal behavior from developers or users with access to
* [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -78,13 +125,11 @@ Uploading container is a normal behavior from developers or users with access to
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-02-20-new_container_uploaded_to_aws_ecr.md
+55 -10
View File
@@ -25,21 +25,71 @@ We have not been able to test, simulate, or build datasets for this object. Use
This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time of operation (PutImage). These searches are based on Cloud Infrastructure Data Model.
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [Hunting](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-02-20
- **Author**: Rod Soto, Rico Valdez, Splunk
- **ID**: f0f70b40-f7ad-489d-9905-23d149da8099
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1525](https://attack.mitre.org/techniques/T1525/) | Implant Internal Image | Persistence |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -52,7 +102,7 @@ This searches show information on uploaded containers including source user, ima
#### Macros
The SPL above uses the following Macros:
Note that `new_container_uploaded_to_aws_ecr_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **new_container_uploaded_to_aws_ecr_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -68,9 +118,6 @@ Uploading container is a normal behavior from developers or users with access to
* [Container Implantation Monitoring and Investigation](/stories/container_implantation_monitoring_and_investigation)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -80,13 +127,11 @@ Uploading container is a normal behavior from developers or users with access to
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-02-21-dump_lsass_via_comsvcs_dll.md
+63 -12
View File
@@ -27,16 +27,21 @@ tags:
Detect the usage of comsvcs.dll for dumping the lsass process.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)- **Datasource**: [Splunk Add-on for Sysmon](https://splunkbase.splunk.com/app/5709)
- **Last Updated**: 2020-02-21
- **Author**: Patrick Bareiss, Splunk
- **ID**: 8943b567-f14d-4ee8-a0bb-2121d4ce3184
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
@@ -44,6 +49,57 @@ Detect the usage of comsvcs.dll for dumping the lsass process.
| [T1003](https://attack.mitre.org/techniques/T1003/) | OS Credential Dumping | Credential Access |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 3
* CIS 5
* CIS 16
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -57,11 +113,11 @@ Detect the usage of comsvcs.dll for dumping the lsass process.
#### Macros
The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [process_rundll32](https://github.com/splunk/security_content/blob/develop/macros/process_rundll32.yml)
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `dump_lsass_via_comsvcs_dll_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **dump_lsass_via_comsvcs_dll_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -91,9 +147,6 @@ None identified.
* [Living Off The Land](/stories/living_off_the_land)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -103,8 +156,6 @@ None identified.
| 80.0 | 80 | 100 | An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. |
#### Reference
* [https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/](https://modexp.wordpress.com/2019/08/30/minidumpwritedump-via-com-services-dll/)
@@ -113,7 +164,7 @@ None identified.
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-03-02-remote_registry_key_modifications.md
+61 -9
View File
@@ -20,14 +20,71 @@ tags:
This search monitors for remote modifications to registry keys.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Last Updated**: 2020-03-02
- **Author**: Bhavin Patel, Splunk
- **ID**: c9f4b923-f8af-4155-b697-1354f5dcbc5e
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Actions on Objectives
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
</div>
</details>
#### Search
```
@@ -44,7 +101,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `remote_registry_key_modifications_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **remote_registry_key_modifications_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -62,9 +119,6 @@ This technique may be legitimately used by administrators to modify remote regis
* [Windows Persistence Techniques](/stories/windows_persistence_techniques)
#### Kill Chain Phase
* Actions on Objectives
#### RBA
@@ -74,13 +128,11 @@ This technique may be legitimately used by administrators to modify remote regis
| 25.0 | 50 | 50 | tbd |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)
docs/_posts/2020-03-16-child_processes_of_spoolsv_exe.md
+66 -16
View File
@@ -27,21 +27,82 @@ We have not been able to test, simulate, or build datasets for this object. Use
This search looks for child processes of spoolsv.exe. This activity is associated with a POC privilege-escalation exploit associated with CVE-2018-8440. Spoolsv.exe is the process associated with the Print Spooler service in Windows and typically runs as SYSTEM.
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/object-Analytic-Types)
- **Type**: [TTP](https://github.com/splunk/security_content/wiki/Detection-Analytic-Types)
- **Product**: Splunk Enterprise, Splunk Enterprise Security, Splunk Cloud
- **Datamodel**: [Endpoint](https://docs.splunk.com/Documentation/CIM/latest/User/Endpoint)
- **Last Updated**: 2020-03-16
- **Author**: Rico Valdez, Splunk
- **ID**: aa0c4aeb-5b18-41c4-8c07-f1442d7599df
#### [ATT&CK](https://attack.mitre.org/)
#### Annotations
<details>
<summary>ATT&CK</summary>
<div markdown="1">
| ID | Technique | Tactic |
| -------------- | ---------------- |-------------------- |
| [T1068](https://attack.mitre.org/techniques/T1068/) | Exploitation for Privilege Escalation | Privilege Escalation |
</div>
</details>
<details>
<summary>Kill Chain Phase</summary>
<div markdown="1">
* Exploitation
</div>
</details>
<details>
<summary>NIST</summary>
<div markdown="1">
* PR.AC
* PR.PT
* DE.CM
</div>
</details>
<details>
<summary>CIS20</summary>
<div markdown="1">
* CIS 5
* CIS 8
</div>
</details>
<details>
<summary>CVE</summary>
<div markdown="1">
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2018-8440](https://nvd.nist.gov/vuln/detail/CVE-2018-8440) | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. | 7.2 |
</div>
</details>
#### Search
```
@@ -58,7 +119,7 @@ The SPL above uses the following Macros:
* [security_content_ctime](https://github.com/splunk/security_content/blob/develop/macros/security_content_ctime.yml)
* [security_content_summariesonly](https://github.com/splunk/security_content/blob/develop/macros/security_content_summariesonly.yml)
Note that `child_processes_of_spoolsv_exe_filter` is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
Note that **child_processes_of_spoolsv_exe_filter** is a empty macro by default. It allows the user to filter out any results (false positives) without editing the SPL.
#### Required field
* _time
@@ -81,9 +142,6 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe
* [Windows Privilege Escalation](/stories/windows_privilege_escalation)
#### Kill Chain Phase
* Exploitation
#### RBA
@@ -93,19 +151,11 @@ Some legitimate printer-related processes may show up as children of spoolsv.exe
| 25.0 | 50 | 50 | tbd |
#### CVE
| ID | Summary | [CVSS](https://nvd.nist.gov/vuln-metrics/cvss) |
| ----------- | ----------- | -------------- |
| [CVE-2018-8440](https://nvd.nist.gov/vuln/detail/CVE-2018-8440) | An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers. | 7.2 |
#### Reference
#### Test Dataset
Replay any dataset to Splunk Enterprise by using our [`replay.py`](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Replay any dataset to Splunk Enterprise by using our [replay.py](https://github.com/splunk/attack_data#using-replaypy) tool or the [UI](https://github.com/splunk/attack_data#using-ui).
Alternatively you can replay a dataset into a [Splunk Attack Range](https://github.com/splunk/attack_range#replay-dumps-into-attack-range-splunk-server)

Some files were not shown because too many files have changed in this diff Show More