diff --git a/detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml similarity index 84% rename from detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml rename to detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml index 2b62c07a0e..b4ca012384 100644 --- a/detections/endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml +++ b/detections/endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml @@ -1,4 +1,4 @@ -name: Windows IPC Share Accessed On Multiple Hosts +name: Windows Administrative Shares Accessed On Multiple Hosts id: d92f2d95-05fb-48a7-910f-4d3d61ab8655 version: 1 date: '2023-03-23' @@ -6,11 +6,11 @@ author: Mauricio Velazco, Splunk type: TTP datamodel: [] description: UPDATE_DESCRIPTION -search: ' `wineventlog_security` EventCode=5140 ShareName="\\\\*\\IPC$" +search: ' `wineventlog_security` EventCode=5140 (ShareName="\\\\*\\ADMIN$" OR ShareName="\\\\*\\IPC$" OR ShareName="\\\\*\\C$") | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, SubjectUserName, ShareName | where unique_targets > 40 - | `windows_ipc_share_accessed_on_multiple_hosts_filter`' + | `windows_administrative_shares_accessed_on_multiple_hosts_filter`' how_to_implement: UPDATE_HOW_TO_IMPLEMENT known_false_positives: UPDATE_KNOWN_FALSE_POSITIVES references: diff --git a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml index 2f8dc28fc6..f0a126a874 100644 --- a/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml +++ b/detections/endpoint/windows_large_number_of_computer_service_tickets_requested.yml @@ -28,6 +28,7 @@ references: tags: analytic_story: - Active Directory Privilege Escalation + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_local_administrator_credential_stuffing.yml b/detections/endpoint/windows_local_administrator_credential_stuffing.yml index c0c7a5c991..068aed38e0 100644 --- a/detections/endpoint/windows_local_administrator_credential_stuffing.yml +++ b/detections/endpoint/windows_local_administrator_credential_stuffing.yml @@ -29,6 +29,7 @@ references: tags: analytic_story: - Active Directory Privilege Escalation + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/detections/endpoint/windows_powershell_gpp_discovery.yml b/detections/endpoint/windows_powersploit_gpp_discovery.yml similarity index 96% rename from detections/endpoint/windows_powershell_gpp_discovery.yml rename to detections/endpoint/windows_powersploit_gpp_discovery.yml index 757300a686..0920d85b9c 100644 --- a/detections/endpoint/windows_powershell_gpp_discovery.yml +++ b/detections/endpoint/windows_powersploit_gpp_discovery.yml @@ -1,4 +1,4 @@ -name: Windows PowerShell GPP Discovery +name: Windows PowerSploit GPP Discovery id: 0130a0df-83a1-4647-9011-841e950ff302 version: 1 date: '2023-03-16' @@ -12,7 +12,7 @@ description: The following analytic identifies the use of the Get-GPPPassword Po search: ' `powershell` EventCode=4104 (ScriptBlockText=Get-GPPPassword OR ScriptBlockText=Get-CachedGPPPassword) | stats count min(_time) as firstTime max(_time) as lastTime by Opcode Computer UserID EventCode ScriptBlockText | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` - | `windows_powershell_gpp_discovery_filter`' + | `windows_powersploit_gpp_discovery_filter`' how_to_implement: To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml index 59e80a14d8..bd34f9604c 100644 --- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -1,4 +1,4 @@ -name: Windows Rapid Authentication on Multiple Hosts +name: Windows Rapid Authentication On Multiple Hosts id: 62606c77-d53d-4182-9371-b02cdbbbcef7 version: 1 date: '2023-03-23' @@ -21,6 +21,7 @@ references: tags: analytic_story: - Active Directory Privilege Escalation + - Active Directory Lateral Movement asset_type: Endpoint cis20: - CIS 3 diff --git a/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml b/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml index 03f543afa5..b8d0cf2ab6 100644 --- a/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml +++ b/tests/endpoint/windows_ipc_share_accessed_on_multiple_hosts.test.yml @@ -1,7 +1,7 @@ -name: Windows IPC Share Accessed On Multiple Hosts Unit Test +name: Windows Administrative Shares Accessed On Multiple Hosts Unit Test tests: -- name: Windows IPC Share Accessed On Multiple Hosts - file: endpoint/windows_ipc_share_accessed_on_multiple_hosts.yml +- name: Windows Administrative Shares Accessed On Multiple Hosts + file: endpoint/windows_administrative_shares_accessed_on_multiple_hosts.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_powershell_gpp_discovery.test.yml b/tests/endpoint/windows_powersploit_gpp_discovery.test.yml similarity index 73% rename from tests/endpoint/windows_powershell_gpp_discovery.test.yml rename to tests/endpoint/windows_powersploit_gpp_discovery.test.yml index d3235611f6..3b915003f1 100644 --- a/tests/endpoint/windows_powershell_gpp_discovery.test.yml +++ b/tests/endpoint/windows_powersploit_gpp_discovery.test.yml @@ -1,7 +1,7 @@ -name: Windows PowerShell GPP Discovery Unit Test +name: Windows PowerSploit GPP Discovery Unit Test tests: -- name: Windows PowerShell GPP Discovery - file: endpoint/windows_powershell_gpp_discovery.yml +- name: Windows PowerSploit GPP Discovery + file: endpoint/windows_powersploit_gpp_discovery.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h latest_time: now diff --git a/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml b/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml index 75ad70d461..b6a499035f 100644 --- a/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml +++ b/tests/endpoint/windows_rapid_authentication_on_multiple_hosts.test.yml @@ -1,6 +1,6 @@ -name: Windows Rapid Authentication on Multiple Hosts Unit Test +name: Windows Rapid Authentication On Multiple Hosts Unit Test tests: -- name: Windows Rapid Authentication on Multiple Hosts +- name: Windows Rapid Authentication On Multiple Hosts file: endpoint/windows_rapid_authentication_on_multiple_hosts.yml pass_condition: '| stats count | where count > 0' earliest_time: -24h