Branch was auto-updated.

detections/experimental/network/ssa___unusual_volume_download_from_internal_server.yml

@@ -0,0 +1,72 @@
+name: Unusual Volume of Data Download from Internal Server Per Entity
+id: cca028f4-77dd-11ec-bc09-acde48001122
+version: 1
+date: '2022-01-17'
+author: Xiao Lin, Splunk
+type: Anomaly
+datamodel:
+- Network_Traffic
+description: Insider might conduct information collection before data exfiltration, and unusual volume of data
+  download from internal server is an indicator of such potential threat. This detection evaluates the total 
+  bytes downloaded from internal servers at specific time window per entity level, and then flagged these that 
+  are higher than 99.999% percentile as an anamaly. A behavior will be reported as long as the downloaded byte 
+  volume is unusual even though that operation is benigh, which causes false positive. It is therefore advised 
+  to adjust threshold and time window based on detection performance whenever necessary. It should be noted that 
+  seasonality is not modeled in the current approach.
+search: '| from read_ssa_enriched_events() 
+  | eval sourcetype = ucast(map_get(input_event, "sourcetype"), "string", null)
+  | eval timestamp = parse_long(ucast(map_get(input_event, "_time"), "string", null))
+  | where sourcetype == "pan:traffic"
+  | eval src_device_scope = map_get(input_event, "src_device_scope")
+  | eval dest_device_scope = map_get(input_event, "src_device_scope")
+  | where src_device_scope IS NOT NULL AND dest_device_scope IS NOT NULL
+  | eval dest_device = map_get(input_event, "dest_device_ips")
+  | where dest_device IS NOT NULL AND dest_device_scope == "INTERNAL"
+  | eval src_device = map_get(input_event, "source_device_ips")
+  | where src_device IS NOT NULL AND src_device_scope == "INTERNAL"
+  | eval download_bytes = parse_double(ucast(map_get(input_event, "bytes_in"), "string", null))
+  | where download_bytes IS NOT NULL
+  | eval tenant = map_get(input_event, "_tenant"), event_id = map_get(input_event, "event_id")
+  | adaptive_threshold algorithm="quantile" value="download_bytes" entity="dest_device" threshold=0.001 window=86400L
+  | eval end_time = timestamp
+  | eval start_time = end_time - 86400
+  | eval body = create_map(["event_id", event_id, "tenant", tenant])
+  | select start_time, end_time, dest_device, label, body
+  | into write_ssa_detected_events();'
+how_to_implement: Ingest PAN traffic logs 
+known_false_positives: Benign large volume data download might be flagged as (false) positive.
+references:
+- https://github.com/twitter/AnomalyDetection
+tags:
+  analytic_story:
+  - Insider Threat
+  dataset:
+  - https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt
+  kill_chain_phases:
+  - Weaponization
+  mitre_attack_id:
+  - T1213
+  - T1039
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest_device_scope
+  - bytes_in
+  - src_device_ips
+  security_domain: network
+  impact: 50
+  confidence: 50
+  risk_score: 25
+  risk_severity: low
+  context:
+  message: $src_device_ip downloaded unusually amount of data from internal server within one day
+  observable:
+    - name: src_device_ip
+      type: Host IP
+      role:
+      - Others
+  nist:
+  - DE.AE
+  cis20:
+  - CIS 13

tests/experimental/network/ssa___unusual_volume_download_from_internal_server.test.yml

@@ -0,0 +1,13 @@
+name: Unusual Volume of Data Download from Internal Server Per Entity - SSA Unit Test
+tests:
+- name: Unusual Volume of Data Download from Internal Server Per Entity
+  file: experimental/network/ssa___unusual_volume_download_from_internal_server.yml
+  pass_condition: '| stats count | where count > 0'
+  description: Test unusual volume of data download from internal server per entity
+  earliest_time: '-24h'
+  latest_time: 'now'
+  attack_data:
+  - file_name: unusual_volume_data_download.txt
+    data: https://github.com/splunk/attack_data/blob/master/datasets/suspicious_behaviour/unusual_data_download/unusual_volume_data_download.txt
+    source: PAN Traffic Log
+    sourcetype: 'pan:traffic'