+
+
+====Narrative====
+A non-privledged user is able to execute the sudoedit command to trigger a buffer overflow. After the successful buffer overflow, they are then able to gain root privileges on the affected host. The conditions needed to be run are a trailing "\" along with shell and edit flags. Monitoring the /var/log directory on Linux hosts using the Splunk Universal Forwarder will allow you to pick up this behavior when using the provided detection.
+
+====Detections====
+* Detect Baron Samedit CVE-2021-3156
+* Detect Baron Samedit CVE-2021-3156 Segfault
+* Detect Baron Samedit CVE-2021-3156 via OSQuery
+
+====Data Models====
+
+====Tags====
+
+=====ATT&CK=====
+* T1068
+
+=====Kill Chain Phases=====
+* Exploitation
+
+=====CIS=====
+* CIS 12
+* CIS 16
+* CIS 8
+
+=====NIST=====
+* DE.CM
+
+====References====
+* https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit
+
+date = 2021-01-27
+
+version = 1
+
+
+
diff --git a/automated_detection_testing/requirements.txt b/automated_detection_testing/requirements.txt
index 0ee3ae800f..937cfc1345 100644
--- a/automated_detection_testing/requirements.txt
+++ b/automated_detection_testing/requirements.txt
@@ -1,4 +1,4 @@
-ansible==2.10.6
+ansible==2.10.7
ansible-runner==1.4.6
apipkg==1.5
aspy.yaml==1.3.0
@@ -8,7 +8,7 @@ attrs==20.3.0
azure-common==1.1.26
azure-core==1.10.0
azure-identity==1.5.0
-azure-mgmt-compute==18.1.0
+azure-mgmt-compute==18.2.0
azure-mgmt-core==1.2.2
azure-mgmt-network==17.1.0
azure-mgmt-resource==15.0.0
@@ -16,18 +16,18 @@ bcrypt==3.2.0
boto3==1.16.61
botocore==1.19.63
certifi==2020.12.5
-cffi==1.14.4
+cffi==1.14.5
cfgv==2.0.1
chardet==4.0.0
configparser==4.0.2
contextlib2==0.6.0.post1
-cryptography==3.3.1
+cryptography==3.3.2
Deprecated==1.2.11
dnspython==2.1.0
docutils==0.16
execnet==1.8.0
gitdb==4.0.5
-GitPython==3.1.12
+GitPython==3.1.13
identify==1.5.13
idna==2.8
importlib-metadata==3.4.0
diff --git a/baselines/baseline_of_api_calls_per_user_arn.yml b/baselines/baseline_of_api_calls_per_user_arn.yml
index 70a7a6e837..c29df505a0 100644
--- a/baselines/baseline_of_api_calls_per_user_arn.yml
+++ b/baselines/baseline_of_api_calls_per_user_arn.yml
@@ -2,21 +2,28 @@ name: Baseline of API Calls per User ARN
id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63
version: 1
date: '2018-04-09'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
description: This search establishes, on a per-hour basis, the average and the standard
deviation of the number of API calls made by each user. Also recorded is the number
of data points for each user. This table is then outputted to a lookup file to allow
the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
- and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
- inputs.
-author: David Dorsey, Splunk
search: '`cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+ and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+ inputs.
+references: []
tags:
- analytics_story:
+ analytic_story:
- AWS User Monitoring
detections:
- Detect Spike in AWS API Activity
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml b/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml
index a4f764b1af..ecd04d8b11 100644
--- a/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml
+++ b/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml
@@ -2,15 +2,14 @@ name: Baseline of blocked outbound traffic from AWS
id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63
version: 1
date: '2018-05-07'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
description: This search establishes, on a per-hour basis, the average and the standard
deviation of the number of outbound connections blocked in your VPC flow logs by
each source IP address (IP address of your EC2 instances). Also recorded is the
number of data points for each source IP. This table outputs to a lookup file to
allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
- and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow
- logs.`.
-author: Bhavin Patel, Splunk
search: '`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12
OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16)
| bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip
@@ -19,10 +18,18 @@ search: '`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=17
as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints,
avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections
| stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+ and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow
+ logs.`.
+references: []
tags:
- analytics_story:
+ analytic_story:
- AWS Network ACL Activity
- Command and Control
- Suspicious AWS Traffic
detections:
- Detect Spike in blocked Outbound Traffic from your AWS
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml b/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml
index 706647ec1b..f11949b56a 100644
--- a/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml
+++ b/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml
@@ -2,36 +2,42 @@ name: Baseline Of Cloud Infrastructure API Calls Per User
id: 1da5d5ea-4382-447d-98a9-87c358c95fcb
version: 1
date: '2020-09-07'
-description: This search is used to build a Machine Learning Toolkit (MLTK) model
- for how many API calls are performed by each user. By default, the search uses
- the last 90 days of data to build the model and the model is rebuilt weekly. The
- model created by this search is then used in the corresponding detection search,
- which identifies subsequent outliers in the number of instances created in a
- small time window.
-how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will need
- to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed,
- along with any required dependencies. Depending on the number of users in your environment,
- you may also need to adjust the value for max_inputs in the MLTK settings for the
- DensityFunction algorithm, then ensure that the search completes in a reasonable
- timeframe. By default, the search builds the model using the past 90 days of data.
- You can modify the search window to build the model over a longer period of time,
- which may give you better results. You may also want to periodically re-run this
- search to rebuild the model with the latest data.'
author: David Dorsey, Splunk
-search: '| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h
-| `drop_dm_object_name("All_Changes")`
-| eval HourOfDay=strftime(_time, "%H")
-| eval HourOfDay=floor(HourOfDay/4)*4
-| eval DayOfWeek=strftime(_time, "%w")
-| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
-| table _time api_calls, user, HourOfDay, isWeekend
-| eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend
-| where api_calls >= 1
-| fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true'
+type: batch
+datamodel:
+- Change
+description: This search is used to build a Machine Learning Toolkit (MLTK) model
+ for how many API calls are performed by each user. By default, the search uses the
+ last 90 days of data to build the model and the model is rebuilt weekly. The model
+ created by this search is then used in the corresponding detection search, which
+ identifies subsequent outliers in the number of instances created in a small time
+ window.
+search: '| tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown
+ All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
+ | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
+ DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+ <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls)
+ as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction
+ api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm
+ show_density=true'
+how_to_implement: You must have Enterprise Security 6.0 or later, if not you will
+ need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
+ installed, along with any required dependencies. Depending on the number of users
+ in your environment, you may also need to adjust the value for max_inputs in the
+ MLTK settings for the DensityFunction algorithm, then ensure that the search completes
+ in a reasonable timeframe. By default, the search builds the model using the past
+ 90 days of data. You can modify the search window to build the model over a longer
+ period of time, which may give you better results. You may also want to periodically
+ re-run this search to rebuild the model with the latest data.
+references: []
tags:
- analytics_story:
+ analytic_story:
- Suspicious Cloud User Activities
+ deployments:
+ - Weekly Model Rebuild 90 Day Lookback
detections:
- Abnormally High Number Of Cloud Infrastructure API Calls
- deployments:
- - Weekly Model Rebuild 90 Day Lookback
\ No newline at end of file
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_cloud_instances_destroyed.yml b/baselines/baseline_of_cloud_instances_destroyed.yml
index 5953151366..b122c9c1c1 100644
--- a/baselines/baseline_of_cloud_instances_destroyed.yml
+++ b/baselines/baseline_of_cloud_instances_destroyed.yml
@@ -2,37 +2,45 @@ name: Baseline Of Cloud Instances Destroyed
id: a2f701f8-5296-4d74-829c-0b7eb346d549
version: 1
date: '2020-08-25'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
description: This search is used to build a Machine Learning Toolkit (MLTK) model
- for how many instances are destroyed in the environment. By default, the search uses
- the last 90 days of data to build the model and the model is rebuilt weekly. The
- model created by this search is then used in the corresponding detection search,
- which identifies subsequent outliers in the number of instances destroyed in a
- small time window.
-how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will need
- to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed,
- along with any required dependencies. Depending on the number of users in your environment,
- you may also need to adjust the value for max_inputs in the MLTK settings for the
- DensityFunction algorithm, then ensure that the search completes in a reasonable
- timeframe. By default, the search builds the model using the past 30 days of data.
- You can modify the search window to build the model over a longer period of time,
- which may give you better results. You may also want to periodically re-run this
- search to rebuild the model with the latest data.\
+ for how many instances are destroyed in the environment. By default, the search
+ uses the last 90 days of data to build the model and the model is rebuilt weekly.
+ The model created by this search is then used in the corresponding detection search,
+ which identifies subsequent outliers in the number of instances destroyed in a small
+ time window.
+search: '| tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted
+ AND All_Changes.status=success AND All_Changes.object_category=instance by _time
+ span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed,
+ (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
+ | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+ <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction
+ instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1
+ dist=expon show_density=true'
+how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will
+ need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
+ installed, along with any required dependencies. Depending on the number of users
+ in your environment, you may also need to adjust the value for max_inputs in the
+ MLTK settings for the DensityFunction algorithm, then ensure that the search completes
+ in a reasonable timeframe. By default, the search builds the model using the past
+ 30 days of data. You can modify the search window to build the model over a longer
+ period of time, which may give you better results. You may also want to periodically
+ re-run this search to rebuild the model with the latest data.\
More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-author: David Dorsey, Splunk
-search: '| tstats count as instances_destroyed from datamodel=Change where
- All_Changes.action=deleted
- AND All_Changes.status=success AND All_Changes.object_category=instance
- by _time span=1h
- | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001)
- | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
- | table _time instances_destroyed, HourOfDay, isWeekend
- | fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true'
+references: []
tags:
- analytics_story:
+ analytic_story:
- Suspicious Cloud Instance Activities
- Cloud Cryptomining
+ deployments:
+ - Weekly Model Rebuild 90 Day Lookback
detections:
- Abnormally High Number Of Cloud Instances Destroyed
- deployments:
- - Weekly Model Rebuild 90 Day Lookback
\ No newline at end of file
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_cloud_instances_launched.yml b/baselines/baseline_of_cloud_instances_launched.yml
index 8f4345bd0a..4534c2fdf0 100644
--- a/baselines/baseline_of_cloud_instances_launched.yml
+++ b/baselines/baseline_of_cloud_instances_launched.yml
@@ -2,37 +2,45 @@ name: Baseline Of Cloud Instances Launched
id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc
version: 1
date: '2020-08-14'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Change
description: This search is used to build a Machine Learning Toolkit (MLTK) model
for how many instances are created in the environment. By default, the search uses
the last 90 days of data to build the model and the model is rebuilt weekly. The
model created by this search is then used in the corresponding detection search,
- which identifies subsequent outliers in the number of instances created in a
- small time window.
-how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will need
- to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed,
- along with any required dependencies. Depending on the number of users in your environment,
- you may also need to adjust the value for max_inputs in the MLTK settings for the
- DensityFunction algorithm, then ensure that the search completes in a reasonable
- timeframe. By default, the search builds the model using the past 90 days of data.
- You can modify the search window to build the model over a longer period of time,
- which may give you better results. You may also want to periodically re-run this
- search to rebuild the model with the latest data.\
+ which identifies subsequent outliers in the number of instances created in a small
+ time window.
+search: '| tstats count as instances_launched from datamodel=Change where (All_Changes.action=created)
+ AND All_Changes.status=success AND All_Changes.object_category=instance by _time
+ span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched,
+ (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4
+ | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+ <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction
+ instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1
+ dist=expon show_density=true'
+how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will
+ need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
+ installed, along with any required dependencies. Depending on the number of users
+ in your environment, you may also need to adjust the value for max_inputs in the
+ MLTK settings for the DensityFunction algorithm, then ensure that the search completes
+ in a reasonable timeframe. By default, the search builds the model using the past
+ 90 days of data. You can modify the search window to build the model over a longer
+ period of time, which may give you better results. You may also want to periodically
+ re-run this search to rebuild the model with the latest data.\
More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-author: David Dorsey, Splunk
-search: '| tstats count as instances_launched from datamodel=Change where
- (All_Changes.action=created)
- AND All_Changes.status=success AND All_Changes.object_category=instance
- by _time span=1h
- | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001)
- | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
- | table _time instances_launched, HourOfDay, isWeekend
- | fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true'
+references: []
tags:
- analytics_story:
+ analytic_story:
- Cloud Cryptomining
- Suspicious Cloud Instance Activities
- detections:
- - Abnormally High Number Of Cloud Instances Launched
deployments:
- Weekly Model Rebuild 90 Day Lookback
+ detections:
+ - Abnormally High Number Of Cloud Instances Launched
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml b/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml
index f77290031e..fe20e6b2dc 100644
--- a/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml
+++ b/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml
@@ -2,33 +2,41 @@ name: Baseline Of Cloud Security Group API Calls Per User
id: 67b84d51-8329-4909-849f-8d38ce54260a
version: 1
date: '2020-09-07'
-description: This search is used to build a Machine Learning Toolkit (MLTK) model
- for how many API calls for security groups are performed by each user. By default, the search uses
- the last 90 days of data to build the model and the model is rebuilt weekly.
-how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you will need
- to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed,
- along with any required dependencies. Depending on the number of users in your environment,
- you may also need to adjust the value for max_inputs in the MLTK settings for the
- DensityFunction algorithm, then ensure that the search completes in a reasonable
- timeframe. By default, the search builds the model using the past 90 days of data.
- You can modify the search window to build the model over a longer period of time,
- which may give you better results. You may also want to periodically re-run this
- search to rebuild the model with the latest data.'
author: David Dorsey, Splunk
-search: '| tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h
-| `drop_dm_object_name("All_Changes")`
-| eval HourOfDay=strftime(_time, "%H")
-| eval HourOfDay=floor(HourOfDay/4)*4
-| eval DayOfWeek=strftime(_time, "%w")
-| eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1)
-| table _time security_group_api_calls, user, HourOfDay, isWeekend
-| eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend
-| where security_group_api_calls >= 1
-| fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true'
+type: batch
+datamodel:
+- Change
+description: This search is used to build a Machine Learning Toolkit (MLTK) model
+ for how many API calls for security groups are performed by each user. By default,
+ the search uses the last 90 days of data to build the model and the model is rebuilt
+ weekly.
+search: '| tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall
+ All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")`
+ | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval
+ DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek
+ <= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend |
+ eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay,
+ isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls
+ by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm
+ show_density=true'
+how_to_implement: You must have Enterprise Security 6.0 or later, if not you will
+ need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is
+ installed, along with any required dependencies. Depending on the number of users
+ in your environment, you may also need to adjust the value for max_inputs in the
+ MLTK settings for the DensityFunction algorithm, then ensure that the search completes
+ in a reasonable timeframe. By default, the search builds the model using the past
+ 90 days of data. You can modify the search window to build the model over a longer
+ period of time, which may give you better results. You may also want to periodically
+ re-run this search to rebuild the model with the latest data.
+references: []
tags:
- analytics_story:
+ analytic_story:
- Suspicious Cloud User Activities
+ deployments:
+ - Weekly Model Rebuild 90 Day Lookback
detections:
- Abnormally High Number Of Cloud Security Group API Calls
- deployments:
- - Weekly Model Rebuild 90 Day Lookback
\ No newline at end of file
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_command_line_length___mltk.yml b/baselines/baseline_of_command_line_length___mltk.yml
index 28205e56d9..929bf94c16 100644
--- a/baselines/baseline_of_command_line_length___mltk.yml
+++ b/baselines/baseline_of_command_line_length___mltk.yml
@@ -2,11 +2,19 @@ name: Baseline of Command Line Length - MLTK
id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459
version: 1
date: '2019-05-08'
+author: Rico Valdez, Splunk
+type: batch
+datamodel: []
description: This search is used to build a Machine Learning Toolkit (MLTK) model
to characterize the length of the command lines observed for each user in the environment.
By default, the search uses the last 30 days of data to build the model. The model
created by this search is then used in the corresponding detection search, which
identifies outliers in the length of the command line.
+search: '| tstats `security_content_summariesonly` count min(_time) as start_time
+ max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest
+ Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search
+ user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`|
+ eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel'
how_to_implement: You must be ingesting endpoint data and populating the Endpoint
data model. In addition, you must have the Machine Learning Toolkit (MLTK) version
>= 4.2 installed, along with any required dependencies. Depending on the number
@@ -17,14 +25,9 @@ how_to_implement: You must be ingesting endpoint data and populating the Endpoin
a longer period of time, which may give you better results. You may also want to
periodically re-run this search to rebuild the model with the latest data. More
information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
-author: Rico Valdez, Splunk
-search: '| tstats `security_content_summariesonly` count min(_time) as start_time
- max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest
- Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search
- user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`|
- eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel'
+references: []
tags:
- analytics_story:
+ analytic_story:
- Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns
- Ransomware
- Suspicious Command-Line Executions
@@ -33,3 +36,7 @@ tags:
detections:
- Detect Prohibited Applications Spawning cmd.exe
- Unusually Long Command Line - MLTK
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_dns_query_length___mltk.yml b/baselines/baseline_of_dns_query_length___mltk.yml
index 2cd47fc291..5862243550 100644
--- a/baselines/baseline_of_dns_query_length___mltk.yml
+++ b/baselines/baseline_of_dns_query_length___mltk.yml
@@ -2,11 +2,19 @@ name: Baseline of DNS Query Length - MLTK
id: c914844c-0ff5-4efc-8d44-c063443129ba
version: 1
date: '2019-05-08'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Network_Resolution
description: This search is used to build a Machine Learning Toolkit (MLTK) model
to characterize the length of the DNS queries for each DNS record type observed
in the environment. By default, the search uses the last 30 days of data to build
the model. The model created by this search is then used in the corresponding detection
search, which uses it to identify outliers in the length of the DNS query.
+search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
+ by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")`
+ | eval query_length = len(query) | fit DensityFunction query_length by record_type
+ into dns_query_pdfmodel'
how_to_implement: To successfully implement this search, you will need to ensure that
DNS data is populating the Network_Resolution data model. In addition, you must
have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any
@@ -15,15 +23,15 @@ how_to_implement: To successfully implement this search, you will need to ensure
period of time, which may give you better results. You may also want to periodically
re-run this search to rebuild the model with the latest data. More information on
the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
-author: Rico Valdez, Splunk
-search: '| tstats `security_content_summariesonly` count from datamodel=Network_Resolution
- by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")`
- | eval query_length = len(query) | fit DensityFunction query_length by record_type
- into dns_query_pdfmodel'
+references: []
tags:
- analytics_story:
+ analytic_story:
- Command and Control
- Hidden Cobra Malware
- Suspicious DNS Traffic
detections:
- DNS Query Length Outliers - MLTK
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml
index 843d4e139b..89b19ba4ec 100644
--- a/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml
+++ b/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml
@@ -2,11 +2,17 @@ name: Baseline of Excessive AWS Instances Launched by User - MLTK
id: fa5634df-fb05-4b4b-aba0-6115138bb1ba
version: 1
date: '2019-11-14'
+author: Jason Brewer, Splunk
+type: batch
+datamodel: []
description: This search is used to build a Machine Learning Toolkit (MLTK) model
for how many RunInstances users do in the environment. By default, the search uses
the last 90 days of data to build the model. The model created by this search is
then used in the corresponding detection search, which identifies subsequent outliers
in the number of RunInstances performed by a user in a small time window.
+search: '`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter`
+ | bucket span=10m _time | stats count as instances_launched by _time src_user |
+ fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1'
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.\
@@ -21,13 +27,14 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
search to rebuild the model with the latest data.\
More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-author: Jason Brewer, Splunk
-search: '`cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter`
- | bucket span=10m _time | stats count as instances_launched by _time src_user |
- fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1'
+references: []
tags:
- analytics_story:
+ analytic_story:
- AWS Cryptomining
- Suspicious AWS EC2 Activities
detections:
- Abnormally High AWS Instances Launched by User - MLTK
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml
index d342dddd11..2ae61114e3 100644
--- a/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml
+++ b/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml
@@ -2,12 +2,18 @@ name: Baseline of Excessive AWS Instances Terminated by User - MLTK
id: b28ed6de-e4ba-40f7-ae0a-93a088c774ab
version: 1
date: '2019-11-14'
+author: Jason Brewer, Splunk
+type: batch
+datamodel: []
description: This search is used to build a Machine Learning Toolkit (MLTK) model
for how many TerminateInstances users do in the environment. By default, the search
uses the last 90 days of data to build the model. The model created by this search
is then used in the corresponding detection search, which identifies subsequent
outliers in the number of TerminateInstances performed by a user in a small time
window.
+search: '`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter`
+ | bucket span=10m _time | stats count as instances_terminated by _time src_user
+ | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1'
how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs.\
@@ -22,12 +28,13 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat
search to rebuild the model with the latest data.\
More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.'
-author: Jason Brewer, Splunk
-search: '`cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter`
- | bucket span=10m _time | stats count as instances_terminated by _time src_user
- | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1'
+references: []
tags:
- analytics_story:
+ analytic_story:
- Suspicious AWS EC2 Activities
detections:
- Abnormally High AWS Instances Terminated by User - MLTK
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_network_acl_activity_by_arn.yml b/baselines/baseline_of_network_acl_activity_by_arn.yml
index 8d815ed92a..40fdcb8dc9 100644
--- a/baselines/baseline_of_network_acl_activity_by_arn.yml
+++ b/baselines/baseline_of_network_acl_activity_by_arn.yml
@@ -2,22 +2,29 @@ name: Baseline of Network ACL Activity by ARN
id: fc0edd96-ff2b-4810-9f1f-63da3783fd63
version: 1
date: '2018-05-21'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
description: This search establishes, on a per-hour basis, the average and the standard
deviation of the number of API calls that were related to network ACLs made by each
user. Also recorded is the number of data points for each user. This table is then
outputted to a lookup file to allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
- and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
- inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
-author: Bhavin Patel, Splunk
search: '`cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats
count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+ and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+ inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`.
+references: []
tags:
- analytics_story:
+ analytic_story:
- AWS Network ACL Activity
detections:
- Detect Spike in Network ACL Activity
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml b/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml
index 1b0075050d..23c168289d 100644
--- a/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml
+++ b/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml
@@ -2,21 +2,28 @@ name: Baseline of S3 Bucket deletion activity by ARN
id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63
version: 1
date: '2018-07-17'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
description: This search establishes, on a per-hour basis, the average and standard
deviation for the number of API calls related to deleting an S3 bucket by each user.
Also recorded is the number of data points for each user. This table is then outputted
to a lookup file to allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
- and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
- inputs.
-author: Bhavin Patel, Splunk
search: '`cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+ and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+ inputs.
+references: []
tags:
- analytics_story:
+ analytic_story:
- Suspicious AWS S3 Activities
detections:
- Detect Spike in S3 Bucket deletion
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_security_group_activity_by_arn.yml b/baselines/baseline_of_security_group_activity_by_arn.yml
index 1c0b705c71..78c5e7356a 100644
--- a/baselines/baseline_of_security_group_activity_by_arn.yml
+++ b/baselines/baseline_of_security_group_activity_by_arn.yml
@@ -2,22 +2,29 @@ name: Baseline of Security Group Activity by ARN
id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63
version: 1
date: '2018-04-17'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
description: This search establishes, on a per-hour basis, the average and the standard
deviation for the number of API calls related to security groups made by each user.
Also recorded is the number of data points for each user. This table is then outputted
to a lookup file to allow the detection search to operate quickly.
-how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
- and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
- inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
-author: Bhavin Patel, Splunk
search: '`cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn
| bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls)
as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls,
stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints,
avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats
count'
+how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
+ and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail
+ inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`.
+references: []
tags:
- analytics_story:
+ analytic_story:
- AWS User Monitoring
detections:
- Detect Spike in Security Group Activity
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/baseline_of_smb_traffic___mltk.yml b/baselines/baseline_of_smb_traffic___mltk.yml
index e5b850a63c..bf066b6b19 100644
--- a/baselines/baseline_of_smb_traffic___mltk.yml
+++ b/baselines/baseline_of_smb_traffic___mltk.yml
@@ -2,12 +2,21 @@ name: Baseline of SMB Traffic - MLTK
id: df98763b-0b08-4281-8ef9-08db7ac572a9
version: 1
date: '2019-05-08'
+author: Rico Valdez, Splunk
+type: batch
+datamodel:
+- Network_Traffic
description: This search is used to build a Machine Learning Toolkit (MLTK) model
to characterize the number of SMB connections observed each hour for every day of
week. By default, the search uses the last 30 days of data to build the model. The
model created by this search is then used in the corresponding detection search
to identify outliers in the number of SMB connections for that hour and day of the
week.
+search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
+ where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb
+ by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval
+ DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction
+ count by "HourOfDay,DayOfWeek" into smb_pdfmodel'
how_to_implement: You must be ingesting network traffic and populating the Network_Traffic
data model. In addition, you must have the Machine Learning Toolkit (MLTK) version
>= 4.2 installed, along with any required dependencies. To improve your results,
@@ -21,14 +30,9 @@ how_to_implement: You must be ingesting network traffic and populating the Netwo
which may give you better results. You may also want to periodically re-run this
search to rebuild the model with the latest data. More information on the algorithm
used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.
-author: Rico Valdez, Splunk
-search: '| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
- where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb
- by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval
- DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction
- count by "HourOfDay,DayOfWeek" into smb_pdfmodel'
+references: []
tags:
- analytics_story:
+ analytic_story:
- DHS Report TA18-074A
- Disabling Security Tools
- 'Emotet Malware DHS Report TA18-201A '
@@ -38,3 +42,7 @@ tags:
detections:
- Processes launching netsh
- SMB Traffic Spike - MLTK
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/count_of_assets_by_category.yml b/baselines/count_of_assets_by_category.yml
index 66fd875219..ceabf9c8ca 100644
--- a/baselines/count_of_assets_by_category.yml
+++ b/baselines/count_of_assets_by_category.yml
@@ -2,18 +2,25 @@ name: Count of assets by category
id: dcfd6b40-42f9-469d-a433-2e53f7489ff9
version: 1
date: '2017-09-13'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
description: This search shows you every asset category you have and the assets that
belong to those categories.
+search: '| from datamodel Identity_Management.All_Assets | stats count values(nt_host)
+ by category | sort -count'
how_to_implement: To successfully implement this search you must first leverage the
Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv
file which should then be mapped to the Identity_Management data model. The Identity_Management
data model will contain a list of known authorized company assets. Ensure that all
inventoried systems are constantly vetted and updated.
-author: Bhavin Patel, Splunk
-search: '| from datamodel Identity_Management.All_Assets | stats count values(nt_host)
- by category | sort -count'
+references: []
tags:
- analytics_story:
+ analytic_story:
- Asset Tracking
detections:
- Detect Unauthorized Assets by MAC address
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/count_of_unique_ips_connecting_to_ports.yml b/baselines/count_of_unique_ips_connecting_to_ports.yml
index 6b36cfaeae..0a8511f52f 100644
--- a/baselines/count_of_unique_ips_connecting_to_ports.yml
+++ b/baselines/count_of_unique_ips_connecting_to_ports.yml
@@ -2,12 +2,20 @@ name: Count of Unique IPs Connecting to Ports
id: 9f3bae5a-9fe3-49df-8c84-5edc51d84b7f
version: 1
date: '2017-09-13'
+author: David Dorsey, Splunk
+type: batch
+datamodel:
+- Network_Traffic
description: The search counts the number of times a connection was observed to each
destination port, and the number of unique source IPs connecting to them.
-how_to_implement: To successfully implement this search, you must be ingesting network
- traffic, and populating the Network_Traffic data model.
-author: David Dorsey, Splunk
search: '| tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts
from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")`
| sort - count'
-tags: {}
+how_to_implement: To successfully implement this search, you must be ingesting network
+ traffic, and populating the Network_Traffic data model.
+references: []
+tags:
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/create_a_list_of_approved_aws_service_accounts.yml b/baselines/create_a_list_of_approved_aws_service_accounts.yml
index 29516b810e..c7d9285e4a 100644
--- a/baselines/create_a_list_of_approved_aws_service_accounts.yml
+++ b/baselines/create_a_list_of_approved_aws_service_accounts.yml
@@ -2,20 +2,27 @@ name: Create a list of approved AWS service accounts
id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43
version: 2
date: '2018-12-03'
+author: Bhavin Patel, Splunk
+type: batch
+datamodel: []
description: This search looks for successful API activity in CloudTrail within the
last 30 days, filters out known users from the identity table, and outputs values
of users into `aws_service_accounts.csv` lookup file.
+search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
+ [inputlookup identity_lookup_expanded | fields identity] | stats count by identity
+ | table identity | outputlookup aws_service_accounts | stats count'
how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later)
and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail
inputs. Please validate the service account entires in `aws_service_accounts.csv`,
which is a lookup file created as a result of running this support search. Please
remove the entries of service accounts that are not legitimate.
-author: Bhavin Patel, Splunk
-search: '`cloudtrail` errorCode=success | rename userName as identity | search NOT
- [inputlookup identity_lookup_expanded | fields identity] | stats count by identity
- | table identity | outputlookup aws_service_accounts | stats count'
+references: []
tags:
- analytics_story:
+ analytic_story:
- AWS User Monitoring
detections:
- Detect AWS API Activities From Unapproved Accounts
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml b/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml
index c694c89152..e24ce8914c 100644
--- a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml
+++ b/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml
@@ -2,19 +2,26 @@ name: Add Prohibited Processes to Enterprise Security
id: 251930a5-1451-4428-bb13-eed5775be0ce
version: 1
date: '2017-09-15'
+author: David Dorsey, Splunk
+type: batch
+datamodel: []
description: This search takes the existing interesting process table from ES, filters
out any existing additions added by ESCU and then updates the table with processes
identified by ESCU that should be prohibited on your endpoints.
+search: '| inputlookup prohibited_processes | search note!=ESCU* | inputlookup append=T
+ prohibited_processes | fillnull value=* dest dest_pci_domain | fillnull value=false
+ is_required is_secure | fillnull value=true is_prohibited | outputlookup prohibited_processes
+ | stats count'
how_to_implement: This search should be run on each new install of ESCU.
-author: David Dorsey, Splunk
-search: '| inputlookup prohibited_processes | search note!=ESCU* | inputlookup
- append=T prohibited_processes | fillnull value=* dest dest_pci_domain | fillnull
- value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup
- prohibited_processes | stats count'
+references: []
tags:
- analytics_story:
+ analytic_story:
- 'Emotet Malware DHS Report TA18-201A '
- Monitor for Unauthorized Software
- SamSam Ransomware
detections:
- Prohibited Software On Endpoint
+ product:
+ - Splunk Enterprise
+ - Splunk Enterprise Security
+ - Splunk Cloud
diff --git a/baselines/discover_dns_records.yml b/baselines/discover_dns_records.yml
index 805dd07e7b..80821f7d93 100644
--- a/baselines/discover_dns_records.yml
+++ b/baselines/discover_dns_records.yml
@@ -2,15 +2,14 @@ name: Discover DNS records
id: c096f721-8842-42ce-bfc7-74bd8c72b7c3
version: 1
date: '2019-02-14'
+author: Jose Hernandez, Splunk
+type: batch
+datamodel:
+- Network_Resolution
description: The search takes corporate and common cloud provider domains configured
under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv`
finds their responses across the last 30 days from data in the `Network_Resolution
` datamodel, then stores the output under the `discovered_dns_records.csv` lookup
-how_to_implement: To successfully implement this search, you must be ingesting DNS
- logs, and populating the Network_Resolution data model. Also make sure that the
- cim_corporate_web_domains and cim_corporate_email_domains lookups are populated
- with the domains owned by your corporation
-author: Jose Hernandez, Splunk
search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv
| inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain,
"\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type)
@@ -19,8 +18,17 @@ search: '| inputlookup cim_corporate_email_domains.csv | inputlookup append=T ci
where query!="unknown" | rex field=query "(?