admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' of github.com:splunk/security-content into develop

Browse Source 
local merge of develop prior to push
This commit is contained in:
Rico Valdez
2020-02-05 16:28:45 -07:00
parent ac7bd7cfee 7d33b5c36c
commit 537f51434e
15 changed files with 50 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/generate.py
+1
View File
@@ -64,6 +64,7 @@ def generate_savedsearches_conf(detections, investigations, baselines):
output_path = OUTPUT_PATH + "/default/savedsearches.conf"
output = template.render(detections=detections, investigations=investigations, baselines=baselines, time=utc_time)
with open(output_path, 'w') as f:
output = output.encode('ascii', 'ignore').decode('ascii')
f.write(output)
return output_path
detections/system_processes_run_from_unexpected_locations.yml
+6 -6
View File
@@ -29,9 +29,9 @@ detect:
- system
risk_score: 50
macros:
- system32_executables
- is_windows_system_file
lookups:
- system32_executables
- is_windows_system_file
schedule:
cron_schedule: 0 * * * *
earliest_time: -70m@m
@@ -39,14 +39,14 @@ detect:
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as
lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*"
Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest
Processes.process_name Processes.process_path Processes.process_id | `drop_dm_object_name("Processes")`
Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name Processes.process_hash| `drop_dm_object_name("Processes")`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`'
suppress:
suppress_fields: dest,process_name
suppress_period: 86400s
eli5: This search returns all the processes that are not executing out of the C:\Windows\System32
or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up
in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64
in a table `is_windows_system_file` of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64
directory. Any matches are then returned.
entities:
- dest
@@ -98,7 +98,7 @@ mappings:
nist:
- PR.PT
- DE.CM
modification_date: '2020-01-21'
modification_date: '2020-02-04'
name: System Processes Run From Unexpected Locations
original_authors:
- company: Splunk
@@ -108,4 +108,4 @@ references: []
security_domain: endpoint
spec_version: 2
type: splunk
version: '4.0'
version: '5.0'
lookups/system32_executables.csv → lookups/is_windows_system_file.csv
View File
lookups/system32_executables.yml → lookups/is_windows_system_file.yml
+2 -2
View File
@@ -1,5 +1,5 @@
default_match: 'false'
description: A list of executable files in Windows\System32
filename: system32_executables.csv
filename: is_windows_system_file.csv
min_matches: 1
name: system32_executables
name: is_windows_system_file
macros/is_windows_system_file.yml
+2 -2
View File
@@ -1,5 +1,5 @@
definition: lookup update=true system32_executables filename as process_name
definition: lookup update=true is_windows_system_file filename as process_name
OUTPUT systemFile | search systemFile=true
description: This macro limits the output to process names that are in the Windows
System directory
name: system32_executables
name: is_windows_system_file
package/appserver/static/analytic_story_details.css
+1
View File
@@ -169,6 +169,7 @@ h3 {
.kill_chain_tag {
background-color: #ed8440;
color: #303841;
}
.attack_tag {
package/default/analytic_stories.conf
+7 -7
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2020-01-23T21:55:09 UTC
# On Date: 2020-02-04T17:15:12 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -691,9 +691,9 @@ narrative = A traditional security best practice is to control the ports, protoc
[Ransomware]
category = Malware
creation_date = 2017-07-24
modification_date = 2017-09-10
modification_date = 2020-02-04
id = cf309d0d-d4aa-4fbb-963d-1e79febd3756
version = 1.0
version = 1.1
reference = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
detection_searches = ["ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Windows Event Log Cleared - Rule"]
mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery"], "mitre_attack": ["AppInit DLLs", "Authentication Package", "Command and Control", "Commonly Used Port", "Defense Evasion", "Execution", "Exfiltration", "Exfiltration Over Alternative Protocol", "Indicator Removal on Host", "Lateral Movement", "Masquerading", "Persistence", "Registry Run Keys / Start Folder", "Scheduled Task", "Windows Management Instrumentation"], "mitre_technique_id": [], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]}
@@ -891,9 +891,9 @@ The searches in this Analytic Story will monitor your AWS network traffic for ev
[Suspicious Command-Line Executions]
category = Adversary Tactics
creation_date = 2017-10-09
modification_date = 2017-10-23
modification_date = 2020-02-04
id = f4368ddf-d59f-4192-84f6-778ac5a3ffc7
version = 2.0
version = 2.1
reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd.exe - Rule", "ESCU - Detect Use of cmd.exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["Command-Line Interface", "Defense Evasion", "Execution", "Masquerading", "Persistence", "Scripting"], "mitre_technique_id": [], "nist": ["DE.CM", "PR.IP", "PR.PT"]}
@@ -1014,9 +1014,9 @@ narrative = A common attack technique is to infiltrate a cloud instance and make
[Unusual Processes]
category = Malware
creation_date = 2016-08-09
modification_date = 2018-11-20
modification_date = 2020-02-04
id = f4368e3f-d59f-4192-84f6-748ac5a3ddb6
version = 2.0
version = 2.1
reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"]
mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["Accessibility Features", "Defense Evasion", "Execution", "Masquerading", "Rundll32"], "mitre_technique_id": [], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]}
package/default/macros.conf
+5 -5
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2020-01-23T21:55:09 UTC
# On Date: 2020-02-04T17:15:12 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -126,6 +126,10 @@ description = This limits the query fields to domains that are associated with e
definition = lookup update=true lookup_rare_process_whitelist_default process as process OUTPUTNEW whitelist | where whitelist="false" | lookup update=true lookup_rare_process_whitelist_local process as process OUTPUT whitelist | where whitelist="false"
description = This macro is intended to whitelist processes that have been definied as rare
[is_windows_system_file]
definition = lookup update=true is_windows_system_file filename as process_name OUTPUT systemFile | search systemFile=true
description = This macro limits the output to process names that are in the Windows System directory
[malicious_powershell_process_obfuscation_techniques_output_filter]
definition = search *
description = Use this macro to add output filters for Malicious PowerShell Process With Obfuscation Techniques.
@@ -223,10 +227,6 @@ description = This macro limites the output to file names that have been marked
definition = sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational"
description = customer specific splunk configurations(eg- index, source, sourcetype) for Windows Sysmon Logs. Replace the macro definition with configurations for your Splunk Environmnent.
[system32_executables]
definition = lookup update=true system32_executables filename as process_name OUTPUT systemFile | search systemFile=true
description = This macro limits the output to process names that are in the Windows System directory
[system_network_configuration_discovery_tools]
definition = (process_name= "arp.exe" OR process_name= "at.exe" OR process_name= "attrib.exe" OR process_name= "cscript.exe" OR process_name= "dsquery.exe" OR process_name= "hostname.exe" OR process_name= "ipconfig.exe" OR process_name= "mimikatz.exe" OR process_name= "nbstat.exe" OR process_name= "net.exe" OR process_name= "netsh.exe" OR process_name= "nslookup.exe" OR process_name= "ping.exe" OR process_name= "quser.exe" OR process_name= "qwinsta.exe" OR process_name= "reg.exe" OR process_name= "runas.exe" OR process_name= "sc.exe" OR process_name= "schtasks.exe" OR process_name= "ssh.exe" OR process_name= "systeminfo.exe" OR process_name= "taskkill.exe" OR process_name= "telnet.exe" OR process_name= "tracert.exe" OR process_name="wscript.exe" OR process_name= "xcopy.exe")
description = This macro is a list of process that can be used to discover the network configuration
package/default/savedsearches.conf
+5 -5
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2020-01-23T21:55:09 UTC
# On Date: 2020-02-04T17:15:12 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -721,7 +721,7 @@ quantity = 0
realtime_schedule = 0
schedule_window = auto
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter` 
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path=*Software\\Microsoft\\Powershell\\1\\ShellIds\\Microsoft.PowerShell* Registry.registry_key_name=ExecutionPolicy (Registry.registry_value_name=Unrestricted OR Registry.registry_value_name=Bypass) by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `attempt_to_set_default_powershell_execution_policy_to_unrestricted_or_bypass_filter`
[ESCU - Attempt To Stop Security Service - Rule]
action.escu = 0
@@ -8223,11 +8223,11 @@ action.escu.enabled = 1
description = This search looks for system processes that normally run out of C:\Windows\System32\ or C:\Windows\SysWOW64 that are not run from that location. This can indicate a malicious process that is trying to hide as a legitimate process.
action.escu.mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["Defense Evasion", "Masquerading"], "nist": ["PR.PT", "DE.CM"]}
action.escu.data_models = ["Endpoint"]
action.escu.eli5 = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
action.escu.eli5 = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table `is_windows_system_file` of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
action.escu.how_to_implement = To successfully implement this search you need to ingest details about process execution from your hosts. Specifically, this search requires the process name and the full path to the process executable.
action.escu.known_false_positives = None identified
action.escu.creation_date = 2016-08-24
action.escu.modification_date = 2020-01-21
action.escu.modification_date = 2020-02-04
action.escu.confidence = medium
action.escu.full_search_name = ESCU - System Processes Run From Unexpected Locations - Rule
action.escu.search_type = detection
@@ -8266,7 +8266,7 @@ quantity = 0
realtime_schedule = 0
schedule_window = auto
is_visible = false
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest Processes.process_name Processes.process_path Processes.process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`
search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.user Processes.dest Processes.process_name Processes.process_id Processes.process_path Processes.parent_process_name Processes.process_hash| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file`
[ESCU - TOR Traffic - Rule]
action.escu = 0
package/default/transforms.conf
+7 -7
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2020-01-23T21:55:09 UTC
# On Date: 2020-02-04T17:15:12 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -60,6 +60,12 @@ filename = suspicious_email_attachments.csv
# description = A list of suspicious extensions for email attachments
match_type = WILDCARD(file_name)
[is_windows_system_file]
filename = is_windows_system_file.csv
default_match = false
# description = A list of executable files in Windows\System32
min_matches = 1
[legit_domains]
filename = legit_domains.csv
# description = A list of legit domains to be used to whitelist possible phishing sites
@@ -194,9 +200,3 @@ default_match = false
match_type = WILDCARD(file)
min_matches = 1
[system32_executables]
filename = system32_executables.csv
default_match = false
# description = A list of executable files in Windows\System32
min_matches = 1
package/default/use_case_library.conf
+8 -8
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2020-01-23T21:55:09 UTC
# On Date: 2020-02-04T17:15:12 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -515,8 +515,8 @@ narrative = A traditional security best practice is to control the ports, protoc
[analytic_story://Ransomware]
category = Malware
last_updated = 2017-09-10
version = 1.0
last_updated = 2020-02-04
version = 1.1
references = ["https://www.symantec.com/connect/blogs/what-you-need-know-about-wannacry-ransomware", "https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"]
maintainers = [{"company": "Splunk", "email": "davidd@splunk.com", "name": "David Dorsey"}]
spec_version = 2
@@ -660,8 +660,8 @@ The searches in this Analytic Story will monitor your AWS network traffic for ev
[analytic_story://Suspicious Command-Line Executions]
category = Adversary Tactics
last_updated = 2017-10-23
version = 2.0
last_updated = 2020-02-04
version = 2.1
references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"]
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
spec_version = 2
@@ -748,8 +748,8 @@ narrative = A common attack technique is to infiltrate a cloud instance and make
[analytic_story://Unusual Processes]
category = Malware
last_updated = 2018-11-20
version = 2.0
last_updated = 2020-02-04
version = 2.1
references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"]
maintainers = [{"company": "Splunk", "email": "bpatel@splunk.com", "name": "Bhavin Patel"}]
spec_version = 2
@@ -2585,7 +2585,7 @@ providing_technologies = ["Sysmon"]
type = detection
asset_type = Endpoint
confidence = medium
explanation = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
explanation = This search returns all the processes that are not executing out of the C:\Windows\System32 or C:\Windows\SysWOW64 directories. Next, it takes the filename and looks it up in a table `is_windows_system_file` of files that should normally run out of the C:\Windows\System32 or C:\Windows\SysWOW64 directory. Any matches are then returned.
how_to_implement = To successfully implement this search you need to ingest details about process execution from your hosts. Specifically, this search requires the process name and the full path to the process executable.
annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["Defense Evasion", "Masquerading"], "nist": ["PR.PT", "DE.CM"]}
known_false_positives = None identified
package/lookups/system32_executables.csv → package/lookups/is_windows_system_file.csv
View File
stories/ransomware.yml
+2 -2
View File
@@ -66,7 +66,7 @@ maintainers:
- company: Splunk
email: davidd@splunk.com
name: David Dorsey
modification_date: '2017-09-10'
modification_date: '2020-02-04'
name: Ransomware
narrative: Ransomware is an ever-present risk to the enterprise, wherein an infected
host encrypts business-critical data, holding it hostage until the victim pays the
@@ -87,4 +87,4 @@ references:
- https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html
spec_version: 2
usecase: Advanced Threat Detection
version: '1.0'
version: '1.1'
stories/suspicious_cmd_line_executions.yml
+2 -2
View File
@@ -30,7 +30,7 @@ maintainers:
- company: Splunk
email: bpatel@splunk.com
name: Bhavin Patel
modification_date: '2017-10-23'
modification_date: '2020-02-04'
name: Suspicious Command-Line Executions
narrative: The ability to execute arbitrary commands via the Windows CLI is a primary
goal for the adversary. With access to the shell, an attacker can easily run scripts
@@ -51,4 +51,4 @@ references:
- https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf
spec_version: 2
usecase: Advanced Threat Detection
version: '2.0'
version: '2.1'
stories/unusual_processes.yml
+2 -2
View File
@@ -33,7 +33,7 @@ maintainers:
- company: Splunk
email: bpatel@splunk.com
name: Bhavin Patel
modification_date: '2018-11-20'
modification_date: '2020-02-04'
name: Unusual Processes
narrative: 'Being able to profile a host''s processes within your environment can
help you more quickly identify processes that seem out of place when compared to
@@ -58,4 +58,4 @@ references:
- https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262
spec_version: 2
usecase: Advanced Threat Detection
version: '2.0'
version: '2.1'