mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Merge branch 'develop' into all_drilldowns
This commit is contained in:
Bhavin Patel
+7
-1
@@ -3,7 +3,7 @@ app:
|
||||
uid: 3449
|
||||
title: ES Content Updates
|
||||
appid: DA-ESS-ContentUpdate
|
||||
version: 4.39.1
|
||||
version: 4.42.0
|
||||
description: Explore the Analytic Stories included with ES Content Updates.
|
||||
prefix: ESCU
|
||||
label: ESCU
|
||||
@@ -176,6 +176,12 @@ apps:
|
||||
version: 5.4.1
|
||||
description: description of app
|
||||
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/splunk-machine-learning-toolkit_541.tgz
|
||||
- uid: 5518
|
||||
title: Splunk add on for Microsoft Defender Advanced Hunting
|
||||
appid: SPLUNK_ADD_ON_FOR_MICROSOFT_DEFENDER_ADVANCED_HUNTING
|
||||
version: 1.4.1
|
||||
description: description of app
|
||||
hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/microsoft-defender-advanced-hunting-add-on-for-splunk_141.tgz
|
||||
- uid: 2734
|
||||
title: URL Toolbox
|
||||
appid: URL_TOOLBOX
|
||||
|
||||
@@ -0,0 +1,67 @@
|
||||
name: Windows Defender Alerts
|
||||
id: 91738e9e-d112-41c9-b91b-e5868d8993d7
|
||||
version: 1
|
||||
date: '2024-09-24'
|
||||
author: Gowthamaraj Rajendran
|
||||
description: Data source object for Windows Defender alerts
|
||||
source: eventhub://windowsdefenderlogs
|
||||
sourcetype: mscs:azure:eventhub:defender:advancedhunting
|
||||
separator: AlertId
|
||||
supported_TA:
|
||||
- name: Splunk add on for Microsoft Defender Advanced Hunting
|
||||
url: https://splunkbase.splunk.com/app/5518
|
||||
version: 1.4.1
|
||||
fields:
|
||||
- _time
|
||||
- AlertId
|
||||
- TenantId
|
||||
- OperationName
|
||||
- Category
|
||||
- Timestamp
|
||||
- EntityType
|
||||
- EvidenceRole
|
||||
- SHA1
|
||||
- SHA256
|
||||
- RemoteIP
|
||||
- LocalIP
|
||||
- RemoteUrl
|
||||
- AccountName
|
||||
- AccountDomain
|
||||
- AccountSid
|
||||
- AccountObjectId
|
||||
- DeviceId
|
||||
- ThreatFamily
|
||||
- EvidenceDirection
|
||||
- AdditionalFields
|
||||
- MachineGroup
|
||||
- NetworkMessageId
|
||||
- ServiceSource
|
||||
- FileName
|
||||
- FolderPath
|
||||
- ProcessCommandLine
|
||||
- EmailSubject
|
||||
- ApplicationId
|
||||
- Application
|
||||
- DeviceName
|
||||
- FileSize
|
||||
- RegistryKey
|
||||
- RegistryValueName
|
||||
- RegistryValueData
|
||||
- AccountUpn
|
||||
- OAuthApplicationId
|
||||
- Categories
|
||||
- Title
|
||||
- AttackTechniques
|
||||
- DetectionSource
|
||||
- Severity
|
||||
example_log: '{"time": "2024-06-14T20:12:23.3360383Z", "tenantId": "abced-c7ee-abce-1123-123", "operationName": "Publish",
|
||||
"category": "AdvancedHunting-AlertEvidence", "properties": {"Timestamp": "2024-04-14T19:59:59.1549925Z", "AlertId": "dc25",
|
||||
"EntityType": "CloudResource", "EvidenceRole": "Impacted", "SHA1": null, "SHA256": null, "RemoteIP": null, "LocalIP": null,
|
||||
"RemoteUrl": null, "AccountName": null, "AccountDomain": null, "AccountSid": null, "AccountObjectId": null, "DeviceId": null,
|
||||
"ThreatFamily": null, "EvidenceDirection": null, "AdditionalFields": "{\"ResourceId\":\"/subscriptions/1-2-3-4/resourceGroups/pluginframework/
|
||||
providers/Microsoft.Compute/virtualMachines/phantom-identity\",\"ResourceType\":\"Virtual Machine\",\"ResourceName\":\"phantom-identity\",\"Asset\":true,\"
|
||||
Type\":\"azure-resource\",\"Role\":0,\"MergeByKey\":\"abcd=\",\"MergeByKeyHex\":\"1234\"}", "MachineGroup": null, "NetworkMessageId": null, "ServiceSource":
|
||||
"Microsoft Defender for Cloud", "FileName": null, "FolderPath": null, "ProcessCommandLine": null, "EmailSubject": null, "ApplicationId": null, "Application":
|
||||
null, "DeviceName": null, "FileSize": null, "RegistryKey": null, "RegistryValueName": null, "RegistryValueData": null, "AccountUpn": null, "OAuthApplicationId":
|
||||
null, "Categories": "[\"InitialAccess\"]", "Title": "Suspicious authentication activity", "AttackTechniques": "", "DetectionSource": "DefenderForServers",
|
||||
"Severity": "High"}, "Tenant": "DefaultTenant"}'
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Detect Spike in AWS Security Hub Alerts for EC2 Instance
|
||||
id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222
|
||||
version: 5
|
||||
date: '2024-09-30'
|
||||
date: '2024-10-09'
|
||||
author: Bhavin Patel, Splunk
|
||||
status: production
|
||||
type: Anomaly
|
||||
@@ -24,6 +24,7 @@ drilldown_searches:
|
||||
tags:
|
||||
analytic_story:
|
||||
- AWS Security Hub Alerts
|
||||
- Critical Alerts
|
||||
asset_type: AWS Instance
|
||||
confidence: 50
|
||||
impact: 30
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Detect Spike in AWS Security Hub Alerts for User
|
||||
id: 2a9b80d3-6220-4345-b5ad-290bf5d0d222
|
||||
version: 4
|
||||
date: '2024-05-18'
|
||||
version: 5
|
||||
date: '2024-10-09'
|
||||
author: Bhavin Patel, Splunk
|
||||
status: experimental
|
||||
type: Anomaly
|
||||
@@ -28,6 +28,7 @@ references: []
|
||||
tags:
|
||||
analytic_story:
|
||||
- AWS Security Hub Alerts
|
||||
- Critical Alerts
|
||||
asset_type: AWS Instance
|
||||
confidence: 50
|
||||
impact: 50
|
||||
|
||||
@@ -0,0 +1,50 @@
|
||||
name: Detect Critical Alerts from Security Tools
|
||||
id: 483e8a68-f2f7-45be-8fc9-bf725f0e22fd
|
||||
version: 1
|
||||
date: '2024-10-09'
|
||||
author: Gowthamaraj Rajendran, Patrick Bareiss, Bhavin Patel, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
data_source:
|
||||
- Windows Defender Alerts
|
||||
description: The following analytics is to detect high and critical alerts from endpoint security tools such as Microsoft Defender, Carbon Black, and Crowdstrike. This query aggregates and summarizes critical severity alerts from the Alerts data model, providing details such as the alert signature, application, description, source, destination, and timestamps, while applying custom filters and formatting for enhanced analysis in a SIEM environment.This capability allows security teams to efficiently allocate resources and maintain a strong security posture, while also supporting compliance with regulatory requirements by providing a clear record of critical security events. We tested these detections with logs from Microsoft Defender, however this detection should work for any security alerts that are ingested into the alerts data model.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Alerts where Alerts.severity IN ("high","critical") by Alerts.signature Alerts.app, Alerts.severity, Alerts.description, source, Alerts.id, Alerts.dest
|
||||
| `drop_dm_object_name("Alerts")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
|
||||
| `detect_critical_alerts_from_security_tools_filter`'
|
||||
how_to_implement: In order to properly run this search, you to ingest alerts data from other security products such as Crowdstrike, Microsoft Defender, or Carbon Black using appropriate TAs for that technology. Once ingested, the fields should be mapped to the Alerts data model. Make sure to apply transformation on the data if necessary.
|
||||
known_false_positives: False positives may vary by endpoint protection tool; monitor and filter out the alerts that are not relevant to your environment.
|
||||
references:
|
||||
- https://techcommunity.microsoft.com/t5/microsoft-defender-for-cloud/accessing-microsoft-defender-for-cloud-alerts-in-splunk-using/ba-p/938228
|
||||
- https://docs.splunk.com/Documentation/CIM/5.3.2/User/Alerts
|
||||
- https://learn.microsoft.com/en-us/defender-endpoint/api/raw-data-export-event-hub
|
||||
tags:
|
||||
analytic_story:
|
||||
- Critical Alerts
|
||||
asset_type: Endpoint
|
||||
atomic_guid: []
|
||||
confidence: 90
|
||||
impact: 90
|
||||
message: $severity$ alert for $dest$ from $source$ - $signature$
|
||||
mitre_attack_id:
|
||||
- T1484
|
||||
observable:
|
||||
- name: dest
|
||||
type: Endpoint
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- app
|
||||
- name
|
||||
risk_score: 81
|
||||
security_domain: endpoint
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/alerts/AdvancedHunting.log
|
||||
source: eventhub://windowsdefenderlogs
|
||||
sourcetype: mscs:azure:eventhub:defender:advancedhunting
|
||||
@@ -1,16 +1,29 @@
|
||||
name: Linux Auditd Change File Owner To Root
|
||||
id: 7b87c556-0ca4-47e0-b84c-6cd62a0a3e90
|
||||
version: 2
|
||||
date: '2024-09-30'
|
||||
date: '2024-10-09'
|
||||
author: Teoderick Contreras, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic detects the use of the 'chown' command to change a file owner to 'root' on a Linux system. It leverages Linux Auditd telemetry, specifically monitoring command-line executions and process details. This activity is significant as it may indicate an attempt to escalate privileges by adversaries, malware, or red teamers. If confirmed malicious, this action could allow an attacker to gain root-level access, leading to full control over the compromised host and potential persistence within the environment.
|
||||
data_source:
|
||||
- Linux Auditd Proctitle
|
||||
search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as dest | where LIKE (process_exec, "%chown %") AND LIKE (process_exec, "% root %") | stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `linux_auditd_change_file_owner_to_root_filter`'
|
||||
how_to_implement: To implement this detection, the process begins by ingesting auditd data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line executions and process details on Unix/Linux systems. These logs should be ingested and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833), which is essential for correctly parsing and categorizing the data. The next step involves normalizing the field names to match the field names set by the Splunk Common Information Model (CIM) to ensure consistency across different data sources and enhance the efficiency of data modeling. This approach enables effective monitoring and detection of linux endpoints where auditd is deployed
|
||||
known_false_positives: Administrator or network operator can execute this command. Please update the filter macros to remove false positives.
|
||||
search: '`linux_auditd` `linux_auditd_normalized_proctitle_process`| rename host as
|
||||
dest | where LIKE (process_exec, "%chown %root%")
|
||||
| stats count min(_time) as firstTime max(_time) as lastTime by process_exec proctitle
|
||||
normalized_proctitle_delimiter dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`|
|
||||
`linux_auditd_change_file_owner_to_root_filter`'
|
||||
how_to_implement: To implement this detection, the process begins by ingesting auditd
|
||||
data, that consist SYSCALL, TYPE, EXECVE and PROCTITLE events, which captures command-line
|
||||
executions and process details on Unix/Linux systems. These logs should be ingested
|
||||
and processed using Splunk Add-on for Unix and Linux (https://splunkbase.splunk.com/app/833),
|
||||
which is essential for correctly parsing and categorizing the data. The next step
|
||||
involves normalizing the field names to match the field names set by the Splunk
|
||||
Common Information Model (CIM) to ensure consistency across different data sources
|
||||
and enhance the efficiency of data modeling. This approach enables effective monitoring
|
||||
and detection of linux endpoints where auditd is deployed
|
||||
known_false_positives: Administrator or network operator can execute this command.
|
||||
Please update the filter macros to remove false positives.
|
||||
references:
|
||||
- https://unix.stackexchange.com/questions/101073/how-to-change-permissions-from-root-user-to-all-users
|
||||
- https://askubuntu.com/questions/617850/changing-from-user-to-superuser
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Possible Lateral Movement PowerShell Spawn
|
||||
id: cb909b3e-512b-11ec-aa31-3e22fbd008af
|
||||
version: 6
|
||||
date: '2024-09-30'
|
||||
date: '2024-10-07'
|
||||
author: Mauricio Velazco, Michael Haag, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
@@ -35,6 +35,7 @@ tags:
|
||||
- Hermetic Wiper
|
||||
- Data Destruction
|
||||
- Scheduled Tasks
|
||||
- CISA AA24-241A
|
||||
asset_type: Endpoint
|
||||
confidence: 50
|
||||
impact: 90
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Windows AdFind Exe
|
||||
id: bd3b0187-189b-46c0-be45-f52da2bae67f
|
||||
version: 5
|
||||
date: '2024-09-30'
|
||||
date: '2024-10-09'
|
||||
author: Jose Hernandez, Bhavin Patel, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
@@ -10,9 +10,19 @@ data_source:
|
||||
- Sysmon EventID 1
|
||||
- Windows Event Log Security 4688
|
||||
- CrowdStrike ProcessRollup2
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="* -gcb *" OR Processes.process="* -sc *") by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter`'
|
||||
how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint` data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.
|
||||
known_false_positives: ADfind is a command-line tool for AD administration and management that is seen to be leveraged by various adversaries. Filter out legitimate administrator usage using the filter macro.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where ((Processes.process="* -f *" OR Processes.process="* -b *") AND (Processes.process=*objectcategory* OR Processes.process="*-gcb *" OR Processes.process="* -sc *" )) OR ((Processes.process="*trustdmp*" OR Processes.process="*dclist*")) by Processes.dest Processes.user Processes.process_name Processes.process Processes.parent_process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `windows_adfind_exe_filter`| `windows_adfind_exe_filter`'
|
||||
how_to_implement: The detection is based on data that originates from Endpoint Detection
|
||||
and Response (EDR) agents. These agents are designed to provide security-related
|
||||
telemetry from the endpoints where the agent is installed. To implement this search,
|
||||
you must ingest logs that contain the process GUID, process name, and parent process.
|
||||
Additionally, you must ingest complete command-line executions. These logs must
|
||||
be processed using the appropriate Splunk Technology Add-ons that are specific to
|
||||
the EDR product. The logs must also be mapped to the `Processes` node of the `Endpoint`
|
||||
data model. Use the Splunk Common Information Model (CIM) to normalize the field
|
||||
names and speed up the data modeling process.
|
||||
known_false_positives: ADfind is a command-line tool for AD administration and management
|
||||
that is seen to be leveraged by various adversaries. Filter out legitimate administrator
|
||||
usage using the filter macro.
|
||||
references:
|
||||
- https://www.volexity.com/blog/2020/12/14/dark-halo-leverages-solarwinds-compromise-to-breach-organizations/
|
||||
- https://www.mandiant.com/resources/a-nasty-trick-from-credential-theft-malware-to-business-disruption
|
||||
@@ -37,7 +47,14 @@ tags:
|
||||
asset_type: Endpoint
|
||||
confidence: 50
|
||||
impact: 50
|
||||
message: Windows AdFind Exe
|
||||
message: Windows AdFind Exe detected with command-line arguments associated with Active Directory queries on machine - [dest]
|
||||
atomic_guid:
|
||||
- 736b4f53-f400-4c22-855d-1a6b5a551600
|
||||
- b95fd967-4e62-4109-b48d-265edfd28c3a
|
||||
- e1ec8d20-509a-4b9a-b820-06c9b2da8eb7
|
||||
- 5e2938fb-f919-47b6-8b29-2f6a1f718e99
|
||||
- abf00f6c-9983-4d9a-afbc-6b1c6c6448e1
|
||||
- 51a98f96-0269-4e09-a10f-e307779a8b05
|
||||
mitre_attack_id:
|
||||
- T1018
|
||||
observable:
|
||||
@@ -65,4 +82,4 @@ tests:
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1018/atomic_red_team/windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
sourcetype: xmlwineventlog
|
||||
sourcetype: xmlwineventlog
|
||||
@@ -0,0 +1,71 @@
|
||||
name: Windows Identify PowerShell Web Access IIS Pool
|
||||
id: d8419343-f0f8-4d8e-91cc-18bb531df87d
|
||||
version: 1
|
||||
date: '2024-09-09'
|
||||
author: Michael Haag, Splunk
|
||||
data_sources:
|
||||
- Windows Event Log Security 4648
|
||||
type: Hunting
|
||||
status: production
|
||||
description: This analytic detects and analyzes PowerShell Web Access (PSWA) usage in Windows environments. It tracks both connection attempts (EventID 4648) and successful logons (EventID 4624) associated with PSWA, providing a comprehensive view of access patterns. The analytic identifies PSWA's operational status, host servers, processes, and connection metrics. It highlights unique target accounts, domains accessed, and verifies logon types. This information is crucial for detecting potential misuse, such as lateral movement, brute force attempts, or unusual access patterns. By offering insights into PSWA activity, it enables security teams to quickly assess and investigate potential security incidents involving this powerful administrative tool.
|
||||
search: '`wineventlog_security` (EventCode=4648 OR EventCode=4624 OR EventCode=4625) SubjectUserName="pswa_pool"
|
||||
| fields EventCode, SubjectUserName, TargetUserName, Computer, TargetDomainName, ProcessName, LogonType
|
||||
| rename Computer as dest
|
||||
| stats
|
||||
count(eval(EventCode=4648)) as "Connection Attempts",
|
||||
count(eval(EventCode=4624)) as "Successful Logons",
|
||||
count(eval(EventCode=4625)) as "Unsuccessful Logons",
|
||||
dc(TargetUserName) as "Unique Target Accounts",
|
||||
values(dest) as "PSWA Host",
|
||||
dc(TargetDomainName) as "Unique Target Domains",
|
||||
values(ProcessName) as "PSWA Process",
|
||||
values(TargetUserName) as "Target Users List",
|
||||
values(TargetServerName) as "Target Servers List",
|
||||
values(LogonType) as "Logon Types"
|
||||
| eval
|
||||
PSWA_Running = "Yes",
|
||||
"PSWA Process" = mvindex(split(mvindex("PSWA Process", 0), "\\"), -1)
|
||||
| fields PSWA_Running, "PSWA Host", "PSWA Process", "Connection Attempts", "Successful Logons","Unsuccessful Logons", "Unique Target Accounts", "Unique Target Domains", "Target Users List","Target Servers List", "Logon Types"
|
||||
| `security_content_ctime(firstTime)`
|
||||
|`security_content_ctime(lastTime)`
|
||||
| `windows_identify_powershell_web_access_iis_pool_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting Windows Security Event logs, specifically Event ID 4648 (A logon was attempted using explicit credentials). Ensure that your Windows systems are configured to audit logon events and that these logs are being forwarded to your SIEM or log management solution. You may need to enable advanced audit policy settings in Windows to capture these events. Additionally, make sure that your environment is set up to capture the necessary fields such as SubjectUserName, TargetUserName, Computer, TargetServerName, and ProcessName from these events. If you're using Splunk, ensure that you have the appropriate Windows TA installed and configured to collect these security logs.
|
||||
known_false_positives: False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity.
|
||||
references:
|
||||
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
|
||||
- https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
|
||||
tags:
|
||||
analytic_story:
|
||||
- CISA AA24-241A
|
||||
asset_type: Endpoint
|
||||
confidence: 80
|
||||
impact: 80
|
||||
message: PowerShell Web Access (PSWA) IIS Application Pool activity detected on $PSWA Host$.
|
||||
mitre_attack_id:
|
||||
- T1190
|
||||
observable:
|
||||
- name: PSWA Host
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- EventCode
|
||||
- SubjectUserName
|
||||
- TargetUserName
|
||||
- dest
|
||||
- TargetServerName
|
||||
- ProcessName
|
||||
risk_score: 64
|
||||
security_domain: endpoint
|
||||
cve: []
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/4648_4624_pswa_pool.log
|
||||
sourcetype: XmlWinEventLog
|
||||
source: XmlWinEventLog:Security
|
||||
@@ -0,0 +1,61 @@
|
||||
name: Windows IIS Server PSWA Console Access
|
||||
id: 914ab191-fa8a-48cb-83a6-0565e061f934
|
||||
version: 1
|
||||
date: '2024-09-30'
|
||||
author: Michael Haag, Splunk
|
||||
data_sources:
|
||||
- Windows IIS
|
||||
type: Hunting
|
||||
status: production
|
||||
description: This analytic detects access attempts to the PowerShell Web Access (PSWA) console on Windows IIS servers. It monitors web traffic for requests to PSWA-related URIs, which could indicate legitimate administrative activity or potential unauthorized access attempts. By tracking source IP, HTTP status, URI path, and HTTP method, it helps identify suspicious patterns or brute-force attacks targeting PSWA. This detection is crucial for maintaining the security of remote PowerShell management interfaces and preventing potential exploitation of this powerful administrative tool.
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
|
||||
as lastTime from datamodel=Web where Web.dest IN ("/pswa/*")
|
||||
by Web.src Web.status Web.uri_path Web.dest Web.http_method
|
||||
Web.uri_query | `drop_dm_object_name("Web")`| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `windows_iis_server_pswa_console_access_filter`'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on Web traffic, Exchange OR IIS logs, mapped to `Web` datamodel in the `Web` node.
|
||||
In addition, confirm the latest CIM App 4.20 or higher is installed.
|
||||
known_false_positives: False positives may occur if legitimate PSWA processes are used for administrative tasks. Careful review of the logs is recommended to distinguish between legitimate and malicious activity.
|
||||
references:
|
||||
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
|
||||
tags:
|
||||
analytic_story:
|
||||
- CISA AA24-241A
|
||||
asset_type: Web Server
|
||||
confidence: 80
|
||||
impact: 40
|
||||
message: Access to the PowerShell Web Access (PSWA) console detected from $src$.
|
||||
mitre_attack_id:
|
||||
- T1190
|
||||
observable:
|
||||
- name: src
|
||||
type: IP Address
|
||||
role:
|
||||
- Attacker
|
||||
- name: dest
|
||||
type: Hostname
|
||||
role:
|
||||
- Victim
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
required_fields:
|
||||
- _time
|
||||
- Web.src
|
||||
- Web.status
|
||||
- Web.uri_path
|
||||
- Web.dest
|
||||
- Web.http_method
|
||||
- Web.uri_query
|
||||
risk_score: 32
|
||||
security_domain: network
|
||||
cve: []
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/pswa/iis_pswaaccess.log
|
||||
sourcetype: ms:iis:splunk
|
||||
source: ms:iis:splunk
|
||||
@@ -1,13 +1,16 @@
|
||||
name: CISA AA24-241A
|
||||
id: f075adb6-76a6-4476-b24a-ce9d471a1bdc
|
||||
version: 1
|
||||
date: '2024-09-03'
|
||||
version: 2
|
||||
date: '2024-10-07'
|
||||
author: Michael Haag, Splunk
|
||||
description: This story covers the tactics of Iran-based cyber actors exploiting U.S. and foreign organizations across multiple sectors, as detailed in CISA Alert AA24-241A. It focuses on their methods of gaining initial access, establishing persistence, and enabling ransomware attacks through vulnerabilities in public-facing networking devices.
|
||||
narrative: As of August 2024, Iran-based cyber actors continue to exploit organizations across several U.S. sectors and other countries. The FBI assesses that a significant percentage of these operations aim to obtain network access for collaboration with ransomware affiliates. The actors typically use Shodan to identify vulnerable devices, then exploit public-facing networking equipment such as Citrix Netscaler, F5 BIG-IP, and various VPNs. They deploy webshells, create local accounts, and manipulate existing ones to maintain access. Post-exploitation, they repurpose credentials, disable security software, and use remote access tools. The group collaborates with ransomware affiliates like NoEscape, Ransomhouse, and ALPHV, actively participating in network lockdowns and extortion strategies. Defenders should prioritize patching public-facing devices, monitoring for unauthorized accounts and suspicious PowerShell activity, implementing strong access controls, and regularly reviewing logs for signs of compromise.
|
||||
references:
|
||||
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-241a
|
||||
- https://gist.github.com/MHaggis/7e67b659af9148fa593cf2402edebb41
|
||||
- https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/want-remote-powershell-management-from-your-browser-see-how-pswa/ba-p/255764
|
||||
- https://learn.microsoft.com/en-us/powershell/module/powershellwebaccess/?view=winserver2012r2-ps
|
||||
- https://arz101.medium.com/hackthebox-acute-ee0308b9b443
|
||||
tags:
|
||||
category:
|
||||
- Adversary Tactics
|
||||
@@ -22,4 +25,4 @@ tags:
|
||||
- CVE-2019-19781
|
||||
- CVE-2023-3519
|
||||
- CVE-2022-1388
|
||||
- CVE-2024-21887
|
||||
- CVE-2024-21887
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
name: Critical Alerts
|
||||
id: bc7056a5-c2b0-4b83-93ce-5f31739305c8
|
||||
version: 1
|
||||
date: '2024-06-21'
|
||||
author: Gowthamaraj Rajendran, Patrick Bareiss, Splunk
|
||||
description: This analytic story contains detections that monitor critical alerts data from security tools ingested into Splunk. By correlating these alerts and enriching them with MITRE ATT&CK annotations and other risk events, it offers a nuanced perspective on potential threats and security posture of your organization.
|
||||
narrative: Monitoring alerts from security tools is crucial because they act as an early warning system for potential threats. High and critical alerts signal serious issues that could compromise your systems if not addressed promptly. By keeping an eye on these alerts, you can quickly identify and respond to threats, minimizing damage and protecting sensitive data. This proactive approach not only strengthens your security posture but also ensures you're ready to tackle any compliance requirements by maintaining a detailed record of significant security events. This story has rules that integrates and assesses critical alerts from Endpoint, DLP, and firewall sources in Splunk. By correlating alerts and adding MITRE annotations, it provides a comprehensive view of customer risk. It triggers an alert when critical alerts are detected, preserving the source and assigning risk scores. This helps security analysts understand threats and respond effectively.
|
||||
references:
|
||||
- https://docs.splunk.com/Documentation/CIM/5.3.2/User/Alerts
|
||||
- https://docs.splunk.com/Documentation/CIM/5.3.2/User/UsetheCAM
|
||||
tags:
|
||||
category:
|
||||
- Adversary Tactics
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
usecase: Advanced Threat Detection
|
||||
Reference in New Issue
Block a user