admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Branch was auto-updated.

Browse Source
This commit is contained in:
Bhavin Patel
2021-12-08 09:36:28 -08:00
committed by GitHub
parent a71bd19bdb 0934e5ea2f
commit 5673f80041
90 changed files with 923 additions and 323 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml → detections/deprecated/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+22 -12
View File
@@ -1,30 +1,35 @@
name: Applying Stolen Credentials via Mimikatz modules
id: 759a653f-cb92-40f9-94c9-ec4e47b0f709
version: 1
date: '2020-11-03'
version: 2
date: '2021-11-24'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token
attack, Golden or Silver kerberos ticket attack, and Skeleton key attack.
- Endpoint_Processes
description: 'The following analytic identifites the use of Mimikatz modules attempting to perform Pass-the-Ticket, Golden or Silver Kerberos ticket attacks and Skeleton Key attack. This behavior is typically performed within interactive Mimikatz memory space, however it may be identified on the command-line.
A Pass-the-Ticket (ptt) attack is performed once an adversary has established access to a single endpoint and retrieved the kerberos ticket to now begin moving laterally using this method. Typically, it blends in with logon activity as the ticket can be copied to another system and passed into the current session effectively simulating a logon without any communication with the Domain Controller.
A Golden or Silver ticket attack requires some setup by the adversary, but once performed it will simulate lateral based authentication to additional endpoints.'
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
/(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
OR match_regex(cmd_line, /(?i)misc::skeleton/)=true )
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
how_to_implement: To successfully implement this search, you need to be ingesting logs
with the process name, parent process, and command-line executions from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: None identified as this is strictly identifying known command-line attributes related to Mimikatz.
references:
- https://github.com/gentilkiwi/mimikatz
- https://adsecurity.org/?p=1275
- https://github.com/gentilkiwi/mimikatz
- https://adsecurity.org/?p=1275
- https://adsecurity.org/?p=1515
- https://adsecurity.org/?page_id=1821#KERBEROSPTT
- https://attack.mitre.org/software/S0002/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.002/T1550.002.md#atomic-test-1---mimikatz-pass-the-hash
tags:
analytic_story:
- Credential Dumping
@@ -58,6 +63,10 @@ tags:
- T1554
- T1556
- T1558
- T1558.002
- T1558.001
- T1003
- T1003.001
nist:
- PR.AC
- PR.IP
@@ -81,6 +90,7 @@ tags:
- dest_user_id
- process
- _time
- cmd_line
risk_score: 90
risk_severity: high
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml → detections/deprecated/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+13 -11
View File
@@ -1,15 +1,13 @@
name: Applying Stolen Credentials via PowerSploit modules
id: 270b482d-2af2-448f-9923-9cf005f61be4
version: 1
date: '2020-11-03'
version: 2
date: '2021-11-24'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: Stolen credentials are applied by methods such as user impersonation,
credential injection, spoofing of authentication processes or getting hold of critical
accounts. This detection indicates such activities carried out by PowerSploit exploit
kit APIs.
- Endpoint_Processes
description: 'The following analytic identifies commonly used PowerSploit modules that perform credential access, spoofing of authentication processes, user impersonation and attempting to manipulate tokens. Specifically, the following modules `Invoke-CredentialInjection`, `Invoke-TokenManipulation`, `Invoke-UserImpersonation`, `Get-System`, and `Invoke-RevertToSelf` were identfiied as modules used to access credentials.
PowerSploit is an archived project on GitHub, but much of its modules and scripts are still utilized today by adversaries. This behavior is typically performed within interactive PowerShell sessions or injected into processes, however it may be identified on the command-line.'
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -24,11 +22,13 @@ search: '| from read_ssa_enriched_events()
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
how_to_implement: To successfully implement this search, you need to be ingesting logs
with the process name, parent process, and command-line executions from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: None identified as this is strictly identifying known command-line attributes related to PowerSploit.
references:
- https://github.com/PowerShellMafia/PowerSploit
- https://github.com/PowerShellMafia/PowerSploit
- https://attack.mitre.org/software/S0194/
tags:
analytic_story:
- Credential Dumping
@@ -62,6 +62,7 @@ tags:
- T1554
- T1555
- T1558
- T1059.001
nist:
- PR.AC
- PR.IP
@@ -85,6 +86,7 @@ tags:
- dest_user_id
- process
- _time
- cmd_line
risk_score: 90
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml → detections/deprecated/ssa___assess_credential_strength_via_dsinternals_modules.yml
+13 -9
View File
@@ -1,13 +1,12 @@
name: Assessment of Credential Strength via DSInternals modules
id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
version: 1
date: '2020-11-03'
version: 2
date: '2021-11-24'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This detection identifies use of DSInternals modules that verify password
strength, i.e., identify weak accounts that would be easily compromised.
- Endpoint_Processes
description: 'The following analytic identifies the use of a DSInternals module, `Test-PasswordQuality`, that verifies password strength. Adversaries have utilized this module to determine password complexity or to identify accounts with weak passwords.'
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -19,11 +18,13 @@ search: '| from read_ssa_enriched_events()
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
| into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
how_to_implement: To successfully implement this search, you need to be ingesting logs
with the process name, parent process, and command-line executions from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
references:
- https://github.com/MichaelGrafnetter/DSInternals
- https://github.com/MichaelGrafnetter/DSInternals
- https://attack.mitre.org/techniques/T1059/001/
tags:
analytic_story:
- Credential Dumping
@@ -49,6 +50,8 @@ tags:
- T1201
- T1552
- T1555
- T1059.001
- T1059
nist:
- PR.AC
- PR.IP
@@ -72,6 +75,7 @@ tags:
- process
- dest_device_id
- dest_user_id
- cmd_line
risk_score: 25
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml → detections/deprecated/ssa___credential_extraction_dsinternals_conversion_modules.yml
+21 -18
View File
@@ -1,16 +1,14 @@
name: Credential Extraction indicative of use of DSInternals credential conversion
modules
id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
version: 1
date: '2020-10-21'
version: 2
date: '2021-11-29'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. DSInternals
is a collection of PowerShell modules commonly employed in exploits.
- Endpoint_Processes
description: 'The following analytic identifies modules within DSInternals that are used for extracting credentials from Active Directory. Modules include `ConvertFrom-ADManagedPasswordBlob`, `ConvertFrom-GPPrefPassword`, `ConvertFrom-UnicodePasswor`, `ConvertTo-GPPrefPassword`,`ConvertTo-KerberosKey`, `ConvertTo-LMHash`, `ConvertTo-NTHash` `ConvertTo-OrgIdHash` or `ConvertTo-UnicodePassword`.
Adversaries may use these modules for decrypting or transforming the stored credentials.'
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -30,11 +28,14 @@ search: '| from read_ssa_enriched_events()
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
references:
- https://github.com/MichaelGrafnetter/DSInternals
- https://github.com/MichaelGrafnetter/DSInternals
- https://attack.mitre.org/techniques/T1059/001/
tags:
analytic_story:
- Credential Dumping
@@ -53,10 +54,12 @@ tags:
kill_chain_phases:
- Actions on Objectives
message: DSInternals tool kit is converting stolen credential material to a form
applicable to authentications. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
applicable to authentications. Operation is performed on the device $dest_device_id$,
by the account $dest_user_id$ via process $process_name$.
mitre_attack_id:
- T1003
- T1003.002
- T1059.001
nist:
- PR.AC
- PR.IP
@@ -69,10 +72,10 @@ tags:
type: Hostname
role:
- Victim
- name: cmd_line
type: processname
- name: process_name
type: process
role:
- Others
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
@@ -82,7 +85,7 @@ tags:
- _time
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 70
risk_severity: high
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml → detections/deprecated/ssa___credential_extraction_dsinternals_modules.yml
+20 -16
View File
@@ -1,15 +1,13 @@
name: Credential Extraction indicative of use of DSInternals modules
id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
version: 1
date: '2020-10-21'
version: 2
date: '2021-11-29'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. DSInternals
is a collection of PowerShell modules commonly employed in exploits.
datamodel:
- Endpoint_Processes
description: 'The following analytic identifies modules of DSInternals being used on the associated endpoint.
Adversaries may use these modules for manipulating data related to Active Directory and credentials.'
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -31,11 +29,14 @@ search: '| from read_ssa_enriched_events()
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: None identified as this is strictly identifying known command-line attributes related to DSInternals.
references:
- https://github.com/MichaelGrafnetter/DSInternals
- https://github.com/MichaelGrafnetter/DSInternals
- https://attack.mitre.org/techniques/T1059/001/
tags:
analytic_story:
- Credential Dumping
@@ -56,9 +57,11 @@ tags:
message: DSInternals tool kit is accessing sensitive credential material such as
KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
via process $process_name$
mitre_attack_id:
- T1003
- T1003.002
- T1059.001
nist:
- PR.AC
- PR.IP
@@ -71,10 +74,10 @@ tags:
type: Hostname
role:
- Victim
- name: cmd_line
type: processname
- name: process_name
type: Process
role:
- Others
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
@@ -85,6 +88,7 @@ tags:
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 70
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml → detections/deprecated/ssa___credential_extraction_fgdump_cachedump_s_option.yml
+21 -17
View File
@@ -1,17 +1,13 @@
name: Credential Extraction indicative of FGDump and CacheDump with s option
id: 312582f2-5e91-42c1-a275-cd67f31373c8
version: 1
date: '2020-10-18'
version: 2
date: '2021-11-29'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. FGdump is
a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
Windows. Cachedump is a publicly-available tool that extracts cached password hashes
from a system's registry.
- Endpoint_Processes
description: 'The following analytic identifies the use of CacheDump with the `-s` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes
from a system''s registry.'
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -28,10 +24,16 @@ search: ' | from read_ssa_enriched_events()
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
references: []
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed.
references:
- https://attack.mitre.org/software/S0119/
- https://en.kali.tools/all/?tool=182
- http://foofus.net/goons/fizzgig/fgdump/
- https://attack.mitre.org/software/S0120/
tags:
analytic_story:
- Unusual Processes
@@ -51,9 +53,10 @@ tags:
- Actions on Objectives
message: Malicious actor is accessing stored credentials via FGDump or CacheDump
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
via process $process_name$.
mitre_attack_id:
- T1003
- T1003.002
nist:
- PR.AC
- PR.IP
@@ -66,10 +69,10 @@ tags:
type: Hostname
role:
- Victim
- name: cmd_line
type: processname
- name: process_name
type: Process
role:
- Others
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
@@ -80,6 +83,7 @@ tags:
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 70
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml → detections/deprecated/ssa___credential_extraction_fgdump_cachedump_v_option.yml
+21 -16
View File
@@ -1,17 +1,13 @@
name: Credential Extraction indicative of FGDump and CacheDump with v option
id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38
version: 1
date: '2020-10-18'
version: 2
date: '2021-11-29'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: Credential extraction is often an illegal recovery of credential material
from secured authentication resources and repositories. This process may also involve
decryption or other transformations of the stored credential material. FGdump is
a newer version of pwdump tool that extracts NTLM and LanMan password hashes from
Windows. Cachedump is a publicly-available tool that extracts cached password hashes
from a system's registry.
- Endpoint_Processes
description: 'The following analytic identifies the use of CacheDump with the `-v` parameter to dump cached credentials on the associated endpoint. Adversaries use Cachedump as it is a publicly-available tool that extracts cached password hashes
from a system''s registry.'
search: ' | from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
@@ -26,9 +22,16 @@ search: ' | from read_ssa_enriched_events()
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
including the event ID 4688 with enabled command line logging.
known_false_positives: None identified.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: False positives will be limited as this analytic targets specific credential dumping process names. Filter as needed.
references:
- https://attack.mitre.org/software/S0119/
- https://en.kali.tools/all/?tool=182
- http://foofus.net/goons/fizzgig/fgdump/
- https://attack.mitre.org/software/S0120/
references: []
tags:
analytic_story:
@@ -49,9 +52,10 @@ tags:
- Actions on Objectives
message: Malicious actor is accessing stored credentials via FGDump or CacheDump
tools. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
via process $process_name$
mitre_attack_id:
- T1003
- T1003.002
nist:
- PR.AC
- PR.IP
@@ -64,10 +68,10 @@ tags:
type: Hostname
role:
- Victim
- name: cmd_line
type: processname
- name: process_name
type: Process
role:
- Others
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
@@ -77,6 +81,7 @@ tags:
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 63
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml → detections/deprecated/ssa___credential_extraction_getaddbaccount_from_dump.yml
View File
detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml → detections/deprecated/ssa___credential_extraction_lazagne_command_options.yml
View File
detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml → detections/deprecated/ssa___credential_extraction_mimikatz_modules.yml
View File
detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml → detections/deprecated/ssa___credential_extraction_ms_debuggers_kernel_peek.yml
View File
detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml → detections/deprecated/ssa___credential_extraction_ms_debuggers_z_option.yml
View File
detections/endpoint/ssa___credential_extraction_powersploit_modules.yml → detections/deprecated/ssa___credential_extraction_powersploit_modules.yml
View File
detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml → detections/deprecated/ssa___illegal_access_user_content_via_powersploit_modules.yml
View File
detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml → detections/deprecated/ssa___illegal_account_creation_via_powersploit_modules.yml
View File
detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml → detections/deprecated/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml
View File
detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml → detections/deprecated/ssa___illegal_log_deletion_via_mimikatz_modules.yml
View File
detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml → detections/deprecated/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml
View File
detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml → detections/deprecated/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml
View File
detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml → detections/deprecated/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
View File
detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml → detections/deprecated/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
View File
detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml → detections/deprecated/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
View File
detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml → detections/deprecated/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
View File
detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml → detections/deprecated/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
View File
detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml → detections/deprecated/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml
View File
detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml → detections/deprecated/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml
View File
detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml → detections/deprecated/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml
View File
detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml → detections/deprecated/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml
View File
detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml → detections/deprecated/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml
View File
detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml → detections/deprecated/ssa___recon_and_use_computers_via_mimikatz_modules.yml
View File
detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml → detections/deprecated/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml
View File
detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml → detections/deprecated/ssa___recon_and_use_shares_via_mimikatz_modules.yml
View File
detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml → detections/deprecated/ssa___recon_and_use_shares_via_powersploit_modules.yml
View File
detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml → detections/deprecated/ssa___recon_connectivity_via_powersploit_modules.yml
View File
detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml → detections/deprecated/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml
View File
detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml → detections/deprecated/ssa___recon_defensive_tools_via_powersploit_modules.yml
View File
detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml → detections/deprecated/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml
View File
detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml → detections/deprecated/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml
View File
detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml → detections/deprecated/ssa___recon_processes_and_services_via_mimikatz_modules.yml
View File
detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml → detections/deprecated/ssa___setting_credentials_via_dsinternals_modules.yml
View File
detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml → detections/deprecated/ssa___setting_credentials_via_mimikatz_modules.yml
View File
detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml → detections/deprecated/ssa___setting_credentials_via_powersploit_modules.yml
View File
detections/endpoint/net_localgroup_discovery.yml
+1
View File
@@ -28,6 +28,7 @@ references:
tags:
analytic_story:
- Active Directory Discovery
- Windows Discovery Techniques
automated_detection_testing: passed
confidence: 50
context:
detections/endpoint/ssa___attempt_to_delete_services.yml
+11 -12
View File
@@ -1,16 +1,13 @@
name: Attempt To Delete Services
id: a0c8c292-d01a-11eb-aa18-acde48001122
version: 3
date: '2021-11-30'
date: '2021-11-24'
author: Teoderick Contreras, splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies Windows Service Control, `sc.exe`,
attempting to delete a service. This is typically identified in parallel with other
instances of service enumeration of attempts to stop a service and then delete it.
Adversaries utilize this technique to terminate security services or other related
services to continue there objective and evade detections.
- Endpoint_Processes
description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to delete a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then delete it. Adversaries utilize this technique to terminate security services or other related services to continue
there objective and evade detections.'
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -26,11 +23,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
known_false_positives: It is possible administrative scripts may start/stop/delete
services. Filter as needed.
Sysmon TA.
known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
tags:
analytic_story:
- XMRig
@@ -52,6 +49,8 @@ tags:
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
mitre_attack_id:
- T1489
- T1543
- T1543.003
nist:
- PR.DS
- PR.IP
@@ -85,4 +84,4 @@ tags:
- cmd_line
risk_score: 36
risk_severity: high
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___attempt_to_disable_services.yml
+10 -14
View File
@@ -1,16 +1,13 @@
name: Attempt To Disable Services
id: afb31de4-d023-11eb-98d5-acde48001122
version: 3
date: '2021-11-30'
date: '2021-11-24'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytic identifies Windows Service Control, `sc.exe`,
attempting to disable a service. This is typically identified in parallel with other
instances of service enumeration of attempts to stop a service and then disable
it. Adversaries utilize this technique to terminate security services or other related
services to continue there objective and evade detections.
- Endpoint_Processes
description: 'The following analytic identifies Windows Service Control, `sc.exe`, attempting to disable a service. This is typically identified in parallel with other instances of service enumeration of attempts to stop a service and then disable it. Adversaries utilize this technique to terminate security services or other related services to continue
there objective and evade detections.'
search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
"_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
@@ -27,13 +24,12 @@ search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(inpu
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
known_false_positives: It is possible administrative scripts may start/stop/delete
services. Filter as needed.
Sysmon TA.
known_false_positives: It is possible administrative scripts may start/stop/delete services. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
tags:
analytic_story:
- XMRig
@@ -87,4 +83,4 @@ tags:
- process
risk_score: 36
risk_severity: medium
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+17 -15
View File
@@ -1,13 +1,12 @@
name: Attempted Credential Dump From Registry via Reg exe
id: 14038953-e5f2-4daf-acff-5452062baf03
version: 1
date: 2020-6-04
version: 2
date: '2021-11-29'
author: Jose Hernandez, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: Monitor for execution of reg.exe with parameters specifying an export
of keys that contain hashed credentials that attackers may try to crack offline.
- Endpoint_Processes
description: 'The following analytic identifies the use of `reg.exe` attempting to export Windows registry keys that contain hashed credentials. Adversaries will utilize this technique to capture and perform offline password cracking.'
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval process_name=lower(ucast(map_get(input_event,
"process_name"), "string", null)), cmd_line=ucast(map_get(input_event, "process"),
@@ -22,11 +21,14 @@ search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(ma
= timestamp, end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name])
| into write_ssa_detected_events(); '
how_to_implement: You must be ingesting windows endpoint data that tracks process
activity, including parent-child relationships from your endpoints.
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: None identified.
references:
- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets
tags:
analytic_story:
- Credential Dumping
@@ -43,11 +45,10 @@ tags:
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Malicious actor is dumping stored credentials from the registry sections
SAM, Security, or System. Operation is performed at the device $dest_device_id$,
by the account $dest_user_id$ via command $cmd_line$
message: An attempt to save registry keys storing credentials has been performed on $dest_device_id$ by $dest_user_id$ via process $process_name$.
mitre_attack_id:
- T1003
- T1003.002
nist:
- DE.CM
observable:
@@ -59,10 +60,10 @@ tags:
type: Hostname
role:
- Victim
- name: cmd_line
type: processname
- name: process_name
type: process
role:
- Others
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
@@ -71,6 +72,7 @@ tags:
- dest_device_id
- dest_user_id
- process
- cmd_line
risk_score: 63
risk_severity: low
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___bcdedit_failure_recovery_modification.yml
+84
View File
@@ -0,0 +1,84 @@
name: BCDEdit Failure Recovery Modification
id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search looks for flags passed to bcdedit.exe modifications to the
built-in Windows error recovery boot configurations. This is typically used by ransomware
to prevent recovery.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe" AND
(like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%"))
| eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
tags:
analytic_story:
- Ryuk Ransomware
- Ransomware
cis20:
- CIS 8
confidence: 80
context:
- Source:Endpoint
- Stage:Impact
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
impact: 100
kill_chain_phases:
- Actions on Objectives
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability to recover the
endpoint.
mitre_attack_id:
- T1490
nist:
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 80
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___delete_a_net_user.yml
+8 -9
View File
@@ -5,7 +5,7 @@ date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
- Endpoint_Processes
description: This analytic will detect a suspicious net.exe/net1.exe command-line
to delete a user on a system. This technique may be use by an administrator for
legitimate purposes, however this behavior has been used in the wild to impair some
@@ -18,14 +18,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND like(cmd_line, "%user%")
AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: o successfully implement this search, you need to be ingesting logs
cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting logs
with the process name, parent process, and command-line executions from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
Tune and filter known instances where renamed net.exe may be used.
detections/endpoint/ssa___deny_permission_using_cacls_utility.yml
+7 -9
View File
@@ -1,15 +1,12 @@
name: Deny Permission using Cacls Utility
id: b76eae28-cd25-11eb-9c92-acde48001122
version: 2
date: '2021-06-14'
version: 3
date: '2021-11-29'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This analytic identifies a potential adversary that changes the security
permission of a specific file or directory. This technique is commonly seen in APT
tradecraft, ransomware or coinminer scripts. This behavior is meant to evade detection
and prevent access to their component files.
- Endpoint_Processes
description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the deny permission on a file or directory. Adversaries perform this behavior to prevent responders from reviewing or gaining access to adversary files on disk.'
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
known_false_positives: network administrator may use this windows utility but this
is not a common practice.
known_false_positives: System administrators may use cacls utilities but this
is not a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
@@ -71,6 +68,7 @@ tags:
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 35
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+18 -24
View File
@@ -1,29 +1,29 @@
name: Detect Dump LSASS Memory using comsvcs
id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
version: 2
date: '2020-09-15'
date: '2021-11-29'
author: Jose Hernandez, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search detects the memory of lsass.exe being dumped for offline
credential theft attack.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)), process=lower(ucast(map_get(input_event,
"process"), "string", null)), event_id=ucast(map_get(input_event, "event_id"), "string",
null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process, /(?i)comsvcs.dll[,\s]+MiniDump/)=true
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id)
| eval body=create_map(["event_id", event_id, "process_name", process_name, "process",
process]) | into write_ssa_detected_events();'
datamodel:
- Endpoint_Processes
description: 'The following analytic identifies credential dumping using comsvcs.dll with `regsvr32.exe`. This technique is common with adversaries who would like to dump the memory of lsass.exe and perform offline password cracking.'
search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
"_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
"string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
"event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
/(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
"process_name", process_name, "process", process]) | into write_ssa_detected_events();'
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including Windows command line logging. You can see how we test this with [Event
Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
known_false_positives: None identified.
known_false_positives: False positives should be limited, filter as needed.
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll
tags:
analytic_story:
- Credential Dumping
@@ -41,9 +41,7 @@ tags:
impact: 70
kill_chain_phases:
- Actions on Objectives
message: Malicious actor is dumping encoded credentials via Microsoft's native comsvc
DLL. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
via command $cmd_line$
message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$ by user $dest_device_user$.
mitre_attack_id:
- T1003.003
- T1003
@@ -58,10 +56,6 @@ tags:
type: Hostname
role:
- Victim
- name: cmd_line
type: processname
role:
- Others
product:
- Splunk Behavioral Analytics
required_fields:
@@ -72,4 +66,4 @@ tags:
- process
risk_score: 70
risk_severity: low
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___detect_rclone_command_line_usage.yml
+90
View File
@@ -0,0 +1,90 @@
name: Detect RClone Command-Line Usage
id: e8b74268-5454-11ec-a799-acde48001122
version: 1
date: '2021-12-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This analytic identifies commonly used command-line arguments used by
`rclone.exe` to initiate a file transfer. Some arguments were negated as they are
specific to the configuration used by adversaries. In particular, an adversary may
list the files or directories of the remote file share using `ls` or `lsd`, which
is not indicative of malicious behavior. During triage, at this stage of a ransomware
event, exfiltration is about to occur or has already. Isolate the endpoint and continue
investigating by review file modifications and parallel processes.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe" AND
(like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%")
OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line, "%--progress%")
OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line, "%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%")
OR like (cmd_line, "%--transfers%") OR like (cmd_line, "%--multi-thread-streams%"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: False positives should be limited as this is restricted to
the Rclone process name. Filter or tune the analytic as needed.
references:
- https://redcanary.com/blog/rclone-mega-extortion/
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
tags:
analytic_story:
- DarkSide Ransomware
- Ransomware
automated_detection_testing: passed
confidence: 70
context:
- Source:Endpoint
- Stage:Exfiltration
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
impact: 50
kill_chain_phases:
- Exfiltration
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a remote cloud service
to move files or folders.
mitre_attack_id:
- T1020
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 35
security_domain: endpoint
detections/endpoint/ssa___disable_net_user_account.yml
+9 -9
View File
@@ -1,15 +1,14 @@
name: Disable Net User Account
id: ba858b08-d26c-11eb-af9b-acde48001122
version: 3
date: '2021-12-01'
date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
- Endpoint_Processes
description: This analytic will identify a suspicious command-line that disables a
user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
may used by the adversaries to interrupt availability of accounts and continue the
impact against the organization.
user account using the native `net.exe` or `net1.exe` utility to Windows. This technique may used
by the adversaries to interrupt availability of accounts and continue the impact against the organization.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -28,8 +27,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
used.
known_false_positives: System administrators or automated scripts may disable an account
but not a common practice. Filter as needed.
known_false_positives: System administrators or automated scripts may disable an
account but not a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
@@ -52,6 +51,7 @@ tags:
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
mitre_attack_id:
- T1489
- T1078
nist:
- PR.AC
- PR.IP
@@ -83,6 +83,6 @@ tags:
- dest_user_id
- process
- cmd_line
risk_score: 49
risk_severity: medium
security_domain: endpoint
risk_score: 49
security_domain: endpoint
detections/endpoint/ssa___dns_exfiltration_using_nslookup_app.yml
+86
View File
@@ -0,0 +1,86 @@
name: DNS Exfiltration Using Nslookup App
id: 2452e632-9e0d-11eb-34ba-acde48001122
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search is to detect potential DNS exfiltration using nslookup application.
This technique are seen in couple of malware and APT group to exfiltrated collected
data in a infected machine or infected network. This detection is looking for unique
use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
commonly used by attacker and also the retry parameter which is designed to query
C2 DNS multiple tries.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe" AND
(like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line, "%-q=%")
OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: It is possible for some legitimate administrative utilities to use similar cmd_line parameters. Filter as needed.
references:
- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
- https://www.varonis.com/blog/dns-tunneling/
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
tags:
analytic_story:
- Suspicious DNS Traffic
- Dynamic DNS
- Command and Control
- Data Exfiltration
automated_detection_testing: passed
confidence: 80
context:
- Source:Endpoint
- Stage:Exfiltration
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
impact: 90
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related to DNS exfiltration.
mitre_attack_id:
- T1048
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 72
security_domain: endpoint
detections/endpoint/ssa___first_time_seen_cmd_line.yml
+13 -12
View File
@@ -1,14 +1,15 @@
name: First time seen command line argument
id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
version: 3
date: 2021-2-1
version: 4
date: '2021-11-30'
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
- Endpoint_Processes
description: This search looks for command-line arguments that use a `/c` parameter
to execute a command that has not previously been seen. This is an implementation
on SPL2 of the rule `First time seen command line argument` by @bpatel.
'The following analytic identifies first time seen command-line arguments on a single endpoint. The analytic looks for arguments instantiated by `cmd.exe /c` and the associated command-line. Adversaries automate or spawn multiple processes using this method, this analytic may assist with identifying the first time it's been found on this endpoint.'
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
"string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
@@ -26,12 +27,13 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name]) | into write_ssa_detected_events();'
how_to_implement: You must be populating the endpoint data model for SSA and specifically
the process_name and the process fields
known_false_positives: Legitimate programs can also use command-line arguments to
execute. Please verify the command-line arguments to check what command/program
is being executed. We recommend customizing the `first_time_seen_cmd_line_filter`
macro to exclude legitimate parent_process_name
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Legitimate programs use command-line arguments to
execute. Verify the command-line arguments to check what command/program
is being executed. Filtering will be needed.
references: []
tags:
analytic_story:
@@ -47,11 +49,9 @@ tags:
kill_chain_phases:
- Command and Control
- Actions on Objectives
message: A cmd process $process_name$ with commandline $cmd_line$ try to execute
command has not previously seen in host $dest_device_id$
message: A process $process_name$ ha been identified in the environment with a command-line $cmd_line$ not previously seen before on host $dest_device_id$
mitre_attack_id:
- T1059
- T1117
- T1202
nist:
- PR.PT
@@ -74,6 +74,7 @@ tags:
- dest_device_id
- dest_user_id
- process
- cmd_line
risk_score: 30
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___fsutil_zeroing_file.yml
+83
View File
@@ -0,0 +1,83 @@
name: Fsutil Zeroing File
id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search is to detect a suspicious fsutil process to zeroing a target
file. This technique was seen in lockbit ransomware where it tries to zero out its
malware path as part of its defense evasion after encrypting the compromised host.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe" AND
(like (cmd_line, "%setzerodata%"))
| eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search, you need to be ingesting logs
with the process name, parent process, and command-line executions from your endpoints.
If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA.
Tune and filter known instances where renamed net.exe may be used.
known_false_positives: System administrators or scripts may delete user accounts via
this technique. Filter as needed.
references:
- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
tags:
analytic_story:
- Ransomware
confidence: 90
context:
- Source:Endpoint
- stage:Defense Evasion
dataset: []
impact: 60
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file deletion.
mitre_attack_id:
- T1070
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 54
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___grant_permission_using_cacls_utility.yml
+7 -9
View File
@@ -1,15 +1,12 @@
name: Grant Permission Using Cacls Utility
id: c6da561a-cd29-11eb-ae65-acde48001122
version: 2
date: '2021-06-14'
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This analytic identifies potential adversaries that modify the security
permission of a specific file or directory. This technique is commonly seen in APT
tradecraft, ransomware and coinminer scripts to evade detections and restrict access
to their component files.
- Endpoint_Processes
description: 'The following analytic identifies the use of `cacls.exe`, `icacls.exe` or `xcacls.exe` placing the grant permission on a file or directory. Adversaries perform this behavior to allow components of their files to run, however it allows responders to review or gaining access to adversary files on disk.'
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
@@ -26,8 +23,8 @@ how_to_implement: To successfully implement this search, you need to be ingestin
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
known_false_positives: network administrator may use this windows utility but this
is not a common practice.
known_false_positives: System administrators may use cacls utilities but this
is not a common practice. Filter as needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
tags:
@@ -71,6 +68,7 @@ tags:
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 35
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+5 -4
View File
@@ -1,7 +1,7 @@
name: Modify ACLs Permission Of Files Or Folders
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
version: 1
date: '2021-06-15'
version: 2
date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
@@ -10,7 +10,7 @@ description: This analytic identifies suspicious modification of ACL permission
a files or folder to make it available to everyone or to a specific user. This technique
may be used by the adversary to evade ACLs or protected files access. This changes
is commonly configured by the file or directory owner with appropriate permission.
This behavior is a good indicator if this command seen on a machine utilized by
This behavior raises suspicion if this command is seen on an endpoint utilized by
an account with no permission to do so.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
@@ -29,7 +29,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
known_false_positives: network administrator may use this windows utility. filter
known_false_positives: System administrators may use this windows utility. filter
is needed.
references:
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
@@ -74,6 +74,7 @@ tags:
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 35
risk_severity: medium
security_domain: endpoint
detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+6 -9
View File
@@ -4,15 +4,11 @@ version: 2
date: '2020-11-10'
author: Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: The following analytic identifies parent processes, browsers, Windows
terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
many applications spawn cmd.exe natively or built into macros. Much of this will
need to be tuned to further enhance the risk. During triage, review parallel process
execution and identify any file modifications that may have occurred. Capture any
artifacts and review further.
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
datamodel:
- Endpoint_Processes
description: 'The following analytic identifies parent processes, browsers, Windows terminal applications, Office Products and Java spawning cmd.exe. By its very nature, many applications spawn cmd.exe natively or built into macros. Much of this will need to be tuned to further enhance the risk.'
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
@@ -82,6 +78,7 @@ tags:
- _time
- dest_device_id
- dest_user_id
- cmd_line
risk_score: 35
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___ptt_pth_kerb_ntlm_dest_device.yml
+5 -4
View File
@@ -1,13 +1,13 @@
name: Potential Pass the Token or Hash Observed at the Destination Device
id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
version: 2
date: '2021-11-05'
version: 3
date: '2021-11-30'
author: Stanislav Miskovic, Splunk
type: TTP
datamodel:
- Authentication
description: This detection identifies potential Pass the Token or Pass the Hash credential
exploits. We detect the main side effect of these attacks, which is a transition
stealing. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
by a detination device.
search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
@@ -45,7 +45,8 @@ how_to_implement: You must be ingesting Windows Security logs from endpoint devi
known_false_positives: Environments in which NTLM is used extremely rarely and for
benign purposes (such as a rare use of SMB shares).
references:
- https://attack.mitre.org/techniques/T1550/002/
- https://attack.mitre.org/techniques/T1550/002/
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
tags:
analytic_story:
- Lateral Movement
detections/endpoint/ssa___ptt_pth_kerb_ntlm_origin_device.yml
+3 -2
View File
@@ -7,7 +7,7 @@ type: TTP
datamodel:
- Authentication
description: This detection identifies potential Pass the Token or Pass the Hash credential
exploits. We detect the main side effect of these attacks, which is a transition
stealing. We detect the main side effect of these attacks, which is a transition
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
by an event-collecting device (i.e., a specific domain controller or an endpoint
destination).
@@ -47,7 +47,8 @@ how_to_implement: You must be ingesting Windows Security logs from devices of in
known_false_positives: Environments in which NTLM is used extremely rarely and for
benign purposes (such as a rare use of SMB shares).
references:
- https://attack.mitre.org/techniques/T1550/002/
- https://attack.mitre.org/techniques/T1550/002/
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
tags:
analytic_story:
- Lateral Movement
detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml
+8 -8
View File
@@ -1,13 +1,13 @@
name: Rare Parent-Child Process Relationship
id: cf090c78-bcc6-11eb-8529-0242ac130003
version: 1
date: '2021-05-20'
version: 2
date: '2021-11-30'
author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: An attacker may use LOLBAS tools spawned from vulnerable applications
not typically used by system administrators. This search leverages the Splunk Streaming
not typically used by system administrators. This analytic leverages the Splunk Streaming
ML DSP plugin to find rare parent/child relationships. The list of application has
been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
@@ -52,12 +52,11 @@ search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map
"input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
cmd_line]) | into write_ssa_detected_events();'
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
known_false_positives: 'Some custom tools used by admins could be used rarely to launch
known_false_positives: 'Some custom tools used by administrators could be used rarely to launch
remotely applications. This might trigger false positives at the beginning when
it hasn''t collected yet enough data to construct the baseline.
'
references: []
it has not collected yet enough data to construct the baseline.'
references:
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
tags:
analytic_story:
- Unusual Processes
@@ -82,5 +81,6 @@ tags:
- _time
- dest_device_id
- dest_user_id
- cmd_line
risk_severity: low
security_domain: endpoint
detections/endpoint/ssa___resize_shadowstorage_volume.yml
+6 -11
View File
@@ -1,17 +1,13 @@
name: Resize Shadowstorage Volume
id: dbc30554-d27e-11eb-9e5e-acde48001122
version: 2
date: '2021-06-21'
version: 3
date: '2021-11-30'
author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: The following analytics identifies the resizing of shadowstorage by ransomware
malware to avoid the shadow volumes being made again. this technique is an alternative
by ransomware attacker than deleting the shadowstorage which is known alert in defensive
team. one example of ransomware that use this technique is CLOP ransomware where
it drops a .bat file that will resize the shadowstorage to minimum size as much
as possible
description: The following analytic identifies the resizing of shadowstorage using vssadmin.exe to avoid the shadow volumes being made again. This technique is typically found used by adversaries during a ransomware event
and a precursor to deleting the shadowstorage.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
@@ -29,8 +25,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: System administrators may resize the shadowstorage for valid
purposes. Filter as needed.
known_false_positives: System administrators may resize the shadowstorage for valid purposes. Filter as needed.
references:
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
@@ -88,4 +83,4 @@ tags:
- cmd_line
risk_score: 64
risk_severity: high
security_domain: endpoint
security_domain: endpoint
detections/endpoint/ssa___sdelete_application_execution.yml
+42 -41
View File
@@ -5,34 +5,30 @@ date: '2021-11-15'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint_Processes
description: This analytic will detect the execution of sdelete.exe attempting to
delete potentially important files that may related to adversary or insider threats
to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
to securely delete files on disk. This tool is commonly used to clear tracks and
artifact on the targeted host.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
"string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
(like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
%") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
"%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
"%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
"%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
"%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
"%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line,
"%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
"%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
process_name, "process_path", process_path, "parent_process_name", parent_process_name,
"parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
- Endpoint_Processes
description: This analytic will detect the execution of sdelete.exe attempting to delete potentially important files
that may related to adversary or insider threats to destroy evidence or information sabotage. Sdelete is a SysInternals utility
meant to securely delete files on disk. This tool is commonly used to clear tracks and artifact on the targeted host.
search: '| from read_ssa_enriched_events()
| eval timestamp=parse_long(ucast(map_get(input_event,"_time"), "string", null)),
cmd_line=lower(ucast(map_get(input_event, "process"), "string", null)),
process_name=lower(ucast(map_get(input_event, "process_name"), "string", null)),
process_path=ucast(map_get(input_event, "process_path"), "string", null),
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string", null),
parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%")
AND (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %") OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %")
OR like (cmd_line, "%-s %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%")
OR like (cmd_line, "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%")
OR like (cmd_line, "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%")
OR like (cmd_line, "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%")
OR like (cmd_line, "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%")
OR like (cmd_line, "%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%")
OR like (cmd_line, "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line, "%.xls%"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name, "process_path", process_path, "parent_process_name", parent_process_name, "parent_cmd_line", parent_cmd_line])
| into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
@@ -52,27 +48,32 @@ tags:
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
impact: 60
risk_score: 42
kill_chain_phases:
- Exploitation
message: sdelete process $process_name$ executed on $dest$ attempting to permanently
delete files.
mitre_attack_id:
- T1485
- T1070.004
- T1070
message: Sdelete process $process_name$ executed on $dest_device_id$ attempting to permanently
delete files by $dest_user_id$.
observable:
- name: dest
type: Endpoint
role:
- Victim
- name: user
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
mitre_attack_id:
- T1485
- T1070.004
- T1070
product:
- Splunk Behavioral Analytics
required_fields:
@@ -85,5 +86,5 @@ tags:
- process
- process_id
- process_path
risk_score: 42
security_domain: endpoint
- cmd_line
security_domain: endpoint
detections/endpoint/ssa___wbadmin_delete_system_backups.yml
+86
View File
@@ -0,0 +1,86 @@
name: WBAdmin Delete System Backups
id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
version: 1
date: '2021-12-07'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
Tool) that delete backup files. This is typically used by ransomware to prevent
recovery.
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe" AND
like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line, "%systemstatebackup%")
| eval start_time=timestamp,
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
"parent_process_name", parent_process_name, "process_path", process_path]) | into
write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: Administrators may modify the boot configuration.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
- https://thedfirreport.com/2020/10/08/ryuks-return/
- https://attack.mitre.org/techniques/T1490/
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
tags:
analytic_story:
- Ryuk Ransomware
- Ransomware
cis20:
- CIS 8
confidence: 50
context:
- Source:Endpoint
- stage:Defense Evasion
dataset: []
impact: 30
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system backups.
mitre_attack_id:
- T1490
nist:
- PR.AC
- PR.IP
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 15
risk_severity: high
security_domain: endpoint
detections/endpoint/ssa___windows_curl_upload_to_remote_destination.yml
+98
View File
@@ -0,0 +1,98 @@
name: Windows Curl Upload to Remote Destination
id: cc8d046a-543b-11ec-b864-acde48001122
version: 1
date: '2021-12-03'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint_Processes
description: 'The following analytic identifies the use of Windows Curl.exe uploading
a file to a remote destination. \
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
\
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
web application, and it is, for example, how most common HTML forms on the web work.
\
HTTP multipart formposts are done with `-F`, but this appears to not be compatible
with the Windows version of Curl. Will update if identified adversary tradecraft.
\
Adversaries may use one of the three methods based on the remote destination and
what they are attempting to upload (zip vs txt). During triage, review parallel
processes for further behavior. In addition, identify if the upload was successful
in network logs. If a file was uploaded, isolate the endpoint and review.'
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe" AND
(like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line, "%-d %")
OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %"))
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
process_path]) | into write_ssa_detected_events();'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint_Processess` datamodel.
known_false_positives: False positives may be limited to source control applications
and may be required to be filtered out.
references:
- https://everything.curl.dev/usingcurl/uploads
- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
- https://twitter.com/d1r4c/status/1279042657508081664?s=20
tags:
analytic_story:
- Ingress Tool Transfer
automated_detection_testing: passed
confidence: 100
context:
- Source:Endpoint
- Stage:Defense Evasion
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
impact: 80
kill_chain_phases:
- Exfiltration
message: An instance of $parent_process_name$ spawning $process_name$ was identified
on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote destination.
mitre_attack_id:
- T1105
observable:
- name: dest_user_id
type: User
role:
- Victim
- name: dest_device_id
type: Hostname
role:
- Victim
- name: parent_process_name
type: Parent Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Behavioral Analytics
required_fields:
- _time
- dest_device_id
- process_name
- parent_process_name
- process_path
- dest_user_id
- process
- cmd_line
risk_score: 80
security_domain: endpoint
tests/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.test.yml
+1 -1
View File
@@ -7,7 +7,7 @@ tests:
latest_time: 'now'
baselines:
- name: Baseline Of Cloud Infrastructure API Calls Per User
file: baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml
file: detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/abnormally_high_number_of_cloud_security_group_api_calls.test.yml
+1 -1
View File
@@ -7,7 +7,7 @@ tests:
latest_time: 'now'
baselines:
- name: Baseline Of Cloud Security Group API Calls Per User
file: baselines/baseline_of_cloud_security_group_api_calls_per_user.yml
file: detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/aws_cross_account_activity_from_previously_unseen_account.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen AWS Cross Account Activity - Initial
file: baselines/previously_seen_aws_cross_account_activity_initial.yml
file: detections/cloud/previously_seen_aws_cross_account_activity_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen AWS Cross Account Activity - Update
file: baselines/previously_seen_aws_cross_account_activity_update.yml
file: detections/cloud/previously_seen_aws_cross_account_activity_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/cloud_api_calls_from_previously_unseen_user_roles.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Cloud API Calls Per User Role - Initial
file: baselines/previously_seen_cloud_api_calls_per_user_role_initial.yml
file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Cloud API Calls Per User Role - Update
file: baselines/previously_seen_cloud_api_calls_per_user_role_update.yml
file: detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/cloud_compute_instance_created_by_previously_unseen_user.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Cloud Compute Creations By User - Initial
file: baselines/previously_seen_cloud_compute_creations_by_user_initial.yml
file: detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Cloud Compute Creations By User - Update
file: baselines/previously_seen_cloud_compute_creations_by_user_update.yml
file: detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/cloud_compute_instance_created_in_previously_unused_region.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Cloud Regions - Initial
file: baselines/previously_seen_cloud_regions_initial.yml
file: detections/cloud/previously_seen_cloud_regions_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Cloud Regions - Update
file: baselines/previously_seen_cloud_regions_update.yml
file: detections/cloud/previously_seen_cloud_regions_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/cloud_compute_instance_created_with_previously_unseen_image.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Cloud Compute Images - Initial
file: baselines/previously_seen_cloud_compute_images_initial.yml
file: detections/cloud/previously_seen_cloud_compute_images_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Cloud Compute Images - Update
file: baselines/previously_seen_cloud_compute_images_update.yml
file: detections/cloud/previously_seen_cloud_compute_images_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Cloud Compute Instance Types - Initial
file: baselines/previously_seen_cloud_compute_instance_types_initial.yml
file: detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Cloud Compute Instance Types - Update
file: baselines/previously_seen_cloud_compute_instance_types_update.yml
file: detections/cloud/previously_seen_cloud_compute_instance_types_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/cloud_instance_modified_with_previously_unseen_user.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Cloud Instance Modifications By User - Initial
file: baselines/previously_seen_cloud_instance_modifications_by_user_initial.yml
file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Cloud Instance Modifications By User - Update
file: baselines/previously_seen_cloud_instance_modifications_by_user_update.yml
file: detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/cloud_provisioning_from_previously_unseen_city.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Cloud Provisioning Activity Sources - Initial
file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Cloud Provisioning Activity Sources - Update
file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/cloud_provisioning_from_previously_unseen_country.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Cloud Provisioning Activity Sources - Initial
file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Cloud Provisioning Activity Sources - Update
file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/cloud_provisioning_from_previously_unseen_ip_address.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Cloud Provisioning Activity Sources - Initial
file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Cloud Provisioning Activity Sources - Update
file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/cloud_provisioning_from_previously_unseen_region.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Cloud Provisioning Activity Sources - Initial
file: baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Cloud Provisioning Activity Sources - Update
file: baselines/previously_seen_cloud_provisioning_activity_sources_update.yml
file: detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/detect_aws_console_login_by_new_user.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Users In Cloudtrail - Initial
file: baselines/previously_seen_users_in_cloudtrail_initial.yml
file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Users In Cloudtrail - Update
file: baselines/previously_seen_users_in_cloudtrail_update.yml
file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/detect_aws_console_login_by_user_from_new_city.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Users In Cloudtrail - Initial
file: baselines/previously_seen_users_in_cloudtrail_initial.yml
file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Users In Cloudtrail - Update
file: baselines/previously_seen_users_in_cloudtrail_update.yml
file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/detect_aws_console_login_by_user_from_new_country.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Users In Cloudtrail - Initial
file: baselines/previously_seen_users_in_cloudtrail_initial.yml
file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Users In Cloudtrail - Update
file: baselines/previously_seen_users_in_cloudtrail_update.yml
file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/cloud/detect_aws_console_login_by_user_from_new_region.test.yml
+2 -2
View File
@@ -7,12 +7,12 @@ tests:
latest_time: 'now'
baselines:
- name: Previously Seen Users In Cloudtrail - Initial
file: baselines/previously_seen_users_in_cloudtrail_initial.yml
file: detections/cloud/previously_seen_users_in_cloudtrail_initial.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
- name: Previously Seen Users In Cloudtrail - Update
file: baselines/previously_seen_users_in_cloudtrail_update.yml
file: detections/cloud/previously_seen_users_in_cloudtrail_update.yml
pass_condition: '| stats count | where count > 0'
earliest_time: '-30d'
latest_time: '-1d'
tests/endpoint/ssa___bcdedit_failure_recovery_modification.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: BCDEdit Failure Recovery Modification - SSA Unit Test
tests:
- name: BCDEdit Failure Recovery Modification
file: endpoint/ssa___bcdedit_failure_recovery_modification.yml
pass_condition: '@count_gt(0)'
description: Test detection of BCDEdit Failure Recovery Modification
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
tests/endpoint/ssa___detect_rclone_command_line_usage.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Detect RClone Command-Line Usage Unit Test
tests:
- name: Detect RClone Command-Line Usage
file: endpoint/ssa___detect_rclone_command_line_usage.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
tests/endpoint/ssa___dns_exfiltration_using_nslookup_app.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: DNS Exfiltration Using Nslookup App Unit Test
tests:
- name: DNS Exfiltration Using Nslookup App
file: endpoint/ssa_dns_exfiltration_using_nslookup_app.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
tests/endpoint/ssa___fsutil_zeroing_file.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: FSUtil Zeroing File - SSA Unit Test
tests:
- name: FSUtil Zeroing File
file: endpoint/ssa___fsutil_zeroing_file.yml
pass_condition: '@count_gt(0)'
description: Test detection of FSUtil Zeroing File
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
tests/endpoint/ssa___wbadmin_delete_system_backups.test.yml
+10
View File
@@ -0,0 +1,10 @@
name: WBAdmin Delete System Backups - SSA Unit Test
tests:
- name: WBAdmin Delete System Backups
file: endpoint/ssa___wbadmin_delete_system_backups.yml
pass_condition: '@count_gt(0)'
description: Test detection of WBAdmin Delete System Backups
attack_data:
- file_name: windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
tests/endpoint/ssa___windows_curl_upload_to_remote_destination.test.yml
+9
View File
@@ -0,0 +1,9 @@
name: Windows Curl Upload to Remote Destination Unit Test
tests:
- name: Windows Curl Upload to Remote Destination
file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml
pass_condition: '@count_gt(0)'
attack_data:
- file_name: windows-sysmon_curl_upload.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-sysmon_curl_upload.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
tests/cloud/abnormally_high_cloud_instances_destroyed.test.yml → tests/experimental/cloud/abnormally_high_cloud_instances_destroyed.test.yml
View File
tests/cloud/abnormally_high_cloud_instances_launched.test.yml → tests/experimental/cloud/abnormally_high_cloud_instances_launched.test.yml
View File