mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
second pass at fixing whitespace and related update fields
This commit is contained in:
pyth0n1c
@@ -1,7 +1,7 @@
|
||||
name: Okta Multi-Factor Authentication Disabled
|
||||
id: 7c0348ce-bdf9-45f6-8a57-c18b5976f00a
|
||||
version: 2
|
||||
date: '2024-05-13'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Mauricio Velazco, Splunk
|
||||
data_source:
|
||||
- Okta
|
||||
@@ -15,7 +15,7 @@ description: The following analytic identifies an attempt to disable multi-facto
|
||||
could enable attackers to bypass additional security layers, potentially leading
|
||||
to unauthorized access to sensitive information and prolonged undetected presence
|
||||
in the network.
|
||||
search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime,
|
||||
search: '| tstats `security_content_summariesonly` count max(_time) as lastTime,
|
||||
min(_time) as firstTime from datamodel=Change where sourcetype="OktaIM2:log" All_Changes.object_category=User
|
||||
AND All_Changes.action=modified All_Changes.command=user.mfa.factor.deactivate by
|
||||
All_Changes.user All_Changes.result All_Changes.command sourcetype All_Changes.src
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Okta Multiple Users Failing To Authenticate From Ip
|
||||
id: de365ffa-42f5-46b5-b43f-fa72290b8218
|
||||
version: 2
|
||||
date: '2024-05-28'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Michael Haag, Mauricio Velazco, Splunk
|
||||
data_source:
|
||||
- Okta
|
||||
@@ -15,7 +15,7 @@ description: The following analytic identifies instances where more than 10 uniq
|
||||
behavior suggests an external entity is attempting to compromise multiple user accounts,
|
||||
potentially leading to unauthorized access to organizational resources and data
|
||||
breaches.
|
||||
search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime,
|
||||
search: '| tstats `security_content_summariesonly` count max(_time) as lastTime,
|
||||
min(_time) as firstTime dc(Authentication.user) as unique_accounts values(Authentication.signature)
|
||||
as signature values(Authentication.user) as user values(Authentication.app) as app
|
||||
values(Authentication.authentication_method) as authentication_method from datamodel=Authentication
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Okta New API Token Created
|
||||
id: c3d22720-35d3-4da4-bd0a-740d37192bd4
|
||||
version: 3
|
||||
date: '2024-05-11'
|
||||
version: 4
|
||||
date: '2024-09-24'
|
||||
author: Michael Haag, Mauricio Velazco, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
@@ -15,7 +15,7 @@ description: The following analytic detects the creation of a new API token with
|
||||
environment.
|
||||
data_source:
|
||||
- Okta
|
||||
search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime,
|
||||
search: '| tstats `security_content_summariesonly` count max(_time) as lastTime,
|
||||
min(_time) as firstTime from datamodel=Change where All_Changes.action=created AND
|
||||
All_Changes.command=system.api_token.create by _time span=5m All_Changes.user All_Changes.result
|
||||
All_Changes.command sourcetype All_Changes.src All_Changes.action All_Changes.object_category
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Okta New Device Enrolled on Account
|
||||
id: bb27cbce-d4de-432c-932f-2e206e9130fb
|
||||
version: 3
|
||||
date: '2024-05-24'
|
||||
version: 4
|
||||
date: '2024-09-24'
|
||||
author: Michael Haag, Mauricio Velazco, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
@@ -15,7 +15,7 @@ description: The following analytic identifies when a new device is enrolled on
|
||||
and mitigating unauthorized access attempts.
|
||||
data_source:
|
||||
- Okta
|
||||
search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime,
|
||||
search: '| tstats `security_content_summariesonly` count max(_time) as lastTime,
|
||||
min(_time) as firstTime from datamodel=Change where All_Changes.action=created All_Changes.command=device.enrollment.create
|
||||
by _time span=5m All_Changes.user All_Changes.result All_Changes.command sourcetype
|
||||
All_Changes.src All_Changes.action All_Changes.object_category | `drop_dm_object_name("All_Changes")`
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes Anomalous Inbound Outbound Network IO
|
||||
id: 4f3b0c97-657e-4547-a89a-9a50c656e3cd
|
||||
version: 2
|
||||
date: '2024-05-13'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Matthew Moore, Splunk
|
||||
status: experimental
|
||||
type: Anomaly
|
||||
@@ -63,7 +63,7 @@ how_to_implement: 'To implement this detection, follow these steps:
|
||||
|
||||
* Leave all other settings at their default values.
|
||||
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio '
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio'
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/signalfx/splunk-otel-collector-chart
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes Anomalous Inbound to Outbound Network IO Ratio
|
||||
id: 9d8f6e3f-39df-46d8-a9d4-96173edc501f
|
||||
version: 2
|
||||
date: '2024-05-26'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Matthew Moore, Splunk
|
||||
status: experimental
|
||||
type: Anomaly
|
||||
@@ -67,7 +67,7 @@ how_to_implement: 'To implement this detection, follow these steps:
|
||||
|
||||
* Leave all other settings at their default values.
|
||||
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio '
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio'
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/signalfx/splunk-otel-collector-chart
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes Previously Unseen Container Image Name
|
||||
id: fea515a4-b1d8-4cd6-80d6-e0d71397b891
|
||||
version: 2
|
||||
date: '2024-05-27'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Matthew Moore, Splunk
|
||||
status: experimental
|
||||
type: Anomaly
|
||||
@@ -54,7 +54,7 @@ how_to_implement: 'To implement this detection, follow these steps:
|
||||
|
||||
* Leave all other settings at their default values.
|
||||
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio '
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio'
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/signalfx/splunk-otel-collector-chart
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes Previously Unseen Process
|
||||
id: c8119b2f-d7f7-40be-940a-1c582870e8e2
|
||||
version: 2
|
||||
date: '2024-05-13'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Matthew Moore, Splunk
|
||||
status: experimental
|
||||
type: Anomaly
|
||||
@@ -53,7 +53,7 @@ how_to_implement: 'To implement this detection, follow these steps:
|
||||
|
||||
* Leave all other settings at their default values.
|
||||
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio '
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio'
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/signalfx/splunk-otel-collector-chart
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes Process Running From New Path
|
||||
id: 454076fb-0e9e-4adf-b93a-da132621c5e6
|
||||
version: 2
|
||||
date: '2024-05-27'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Matthew Moore, Splunk
|
||||
status: experimental
|
||||
type: Anomaly
|
||||
@@ -54,7 +54,7 @@ how_to_implement: 'To implement this detection, follow these steps:
|
||||
|
||||
* Leave all other settings at their default values.
|
||||
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio '
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio'
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/signalfx/splunk-otel-collector-chart
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes Process with Anomalous Resource Utilisation
|
||||
id: 25ca9594-7a0d-4a95-a5e5-3228d7398ec8
|
||||
version: 2
|
||||
date: '2024-05-27'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Matthew Moore, Splunk
|
||||
status: experimental
|
||||
type: Anomaly
|
||||
@@ -62,7 +62,7 @@ how_to_implement: 'To implement this detection, follow these steps:
|
||||
|
||||
* Leave all other settings at their default values.
|
||||
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio '
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio'
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/signalfx/splunk-otel-collector-chart
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes Process with Resource Ratio Anomalies
|
||||
id: 0d42b295-0f1f-4183-b75e-377975f47c65
|
||||
version: 2
|
||||
date: '2024-05-30'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Matthew Moore, Splunk
|
||||
status: experimental
|
||||
type: Anomaly
|
||||
@@ -61,7 +61,7 @@ how_to_implement: 'To implement this detection, follow these steps:
|
||||
|
||||
* Leave all other settings at their default values.
|
||||
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio '
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio'
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/signalfx/splunk-otel-collector-chart
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes Shell Running on Worker Node
|
||||
id: efebf0c4-dcf4-496f-85a2-5ab7ad8fa876
|
||||
version: 2
|
||||
date: '2024-05-25'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Matthew Moore, Splunk
|
||||
status: experimental
|
||||
type: Anomaly
|
||||
@@ -51,7 +51,7 @@ how_to_implement: 'To implement this detection, follow these steps:
|
||||
|
||||
* Leave all other settings at their default values.
|
||||
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio '
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio'
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/signalfx/splunk-otel-collector-chart/tree/main
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes Shell Running on Worker Node with CPU Activity
|
||||
id: cc1448e3-cc7a-4518-bc9f-2fa48f61a22b
|
||||
version: 2
|
||||
date: '2024-05-11'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Matthew Moore, Splunk
|
||||
status: experimental
|
||||
type: Anomaly
|
||||
@@ -52,7 +52,7 @@ how_to_implement: 'To implement this detection, follow these steps:
|
||||
|
||||
* Leave all other settings at their default values.
|
||||
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio '
|
||||
* Run the Search Baseline Of Kubernetes Container Network IO Ratio'
|
||||
known_false_positives: unknown
|
||||
references:
|
||||
- https://github.com/signalfx/splunk-otel-collector-chart/tree/main
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
name: O365 Application Available To Other Tenants
|
||||
id: 942548a3-0273-47a4-8dbd-e5202437395c
|
||||
version: 1
|
||||
date: '2024-04-11'
|
||||
version: 2
|
||||
date: '2024-09-24'
|
||||
author: Steven Dick
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies the configuration of Azure Active Directory Applications in a manner that allows authentication from external tenants or personal accounts. This configuration can lead to inappropriate or malicious access of any data or capabilities the application is allowed to access. This detection leverages the O365 Universal Audit Log data source.
|
||||
data_source:
|
||||
- Office 365 Universal Audit Log
|
||||
search: >
|
||||
search: >-
|
||||
`o365_management_activity` Workload=AzureActiveDirectory Operation IN ("Add application.","Update application.") ModifiedProperties{}.Name=AvailableToOtherTenants
|
||||
| eval result = case(match(mvindex('ModifiedProperties{}.NewValue',mvfind('ModifiedProperties{}.Name',"AvailableToOtherTenants")),"false"),"removed",true(),"added"), object_name=mvindex('Target{}.ID', 3), signature=Operation, object_attrs = "AvailableToOtherTenants", user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0))
|
||||
| search result = "added"
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
name: O365 Cross-Tenant Access Change
|
||||
id: 7c0fa490-12b0-4d0b-b9f5-e101d1e0e06f
|
||||
version: 1
|
||||
date: '2024-04-11'
|
||||
version: 2
|
||||
date: '2024-09-24'
|
||||
author: Steven Dick
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies when cross-tenant access/synchronization policies are changed in an Azure tenant. Adversaries have been observed altering victim cross-tenant policies as a method of lateral movement or maintaining persistent access to compromised environments. These policies should be considered sensitive and monitored for changes and/or loose configuration.
|
||||
data_source:
|
||||
- Office 365 Universal Audit Log
|
||||
search: >
|
||||
search: >-
|
||||
`o365_management_activity` Workload=AzureActiveDirectory Operation IN ("Add a partner to cross-tenant access setting.","Delete partner specific cross-tenant access setting.")
|
||||
| eval user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0))
|
||||
| stats values(Workload) as category, values(ClientIP) as src, values(ModifiedProperties{}.Name) as object_name, values(ModifiedProperties{}.NewValue) as object_attrs, count, min(_time) as firstTime, max(_time) as lastTime by Id,user,Operation
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
name: O365 DLP Rule Triggered
|
||||
id: 63a8a537-36fd-4aac-a3ea-1a96afd2c871
|
||||
version: 1
|
||||
date: '2024-04-01'
|
||||
version: 2
|
||||
date: '2024-09-24'
|
||||
author: Steven Dick
|
||||
status: production
|
||||
type: Anomaly
|
||||
description: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to determine what, if any, security relevance the underlying DLP events contain.
|
||||
data_source:
|
||||
- O365 Universal Audit Log
|
||||
search: >
|
||||
search: >-
|
||||
`o365_management_activity` Operation=DLPRuleMatch
|
||||
| eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location')
|
||||
| stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by src_user,recipient,signature_id,reason
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
name: O365 External Guest User Invited
|
||||
id: 8c6d52ec-d5f2-4b2f-8ba1-f32c047a71fa
|
||||
version: 1
|
||||
date: '2024-04-11'
|
||||
version: 2
|
||||
date: '2024-09-24'
|
||||
author: Steven Dick
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies the invitation of an external guest user within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`. This detection leverages the Universal Audit Log (UAL)/o365:management:activity sourcetype as a detection data source.
|
||||
data_source:
|
||||
- Office 365 Universal Audit Log
|
||||
search: >
|
||||
search: >-
|
||||
`o365_management_activity` Workload=AzureActiveDirectory AND Operation="Add user*" AND ModifiedProperties{}.NewValue="[*Guest*]" AND ModifiedProperties{}.NewValue="[*Invitation*]"
|
||||
| eval user = (mvindex('ModifiedProperties{}.NewValue',5)), src_user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0))
|
||||
| rex field=user "(?<user>[\\w\\.-]+@[\\w-]+\\.[\\w-]{2,4})"
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
name: O365 External Identity Policy Changed
|
||||
id: 29af1725-7a72-4d2d-8a18-e697e79a62d3
|
||||
version: 1
|
||||
date: '2024-04-11'
|
||||
version: 2
|
||||
date: '2024-09-24'
|
||||
author: Steven Dick
|
||||
status: production
|
||||
type: TTP
|
||||
description: The following analytic identifies when changes are made to the external guest policies within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. This detection also attempts to highlight what may have changed. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`.
|
||||
data_source:
|
||||
- Office 365 Universal Audit Log
|
||||
search: >
|
||||
search: >-
|
||||
`o365_management_activity` Workload=AzureActiveDirectory Operation="Update policy." Target{}.ID="B2BManagementPolicy"
|
||||
| eval object_attrs = mvindex('ModifiedProperties{}.NewValue',0), object_attrs_old = mvindex('ModifiedProperties{}.OldValue',0), object_name = mvindex('Target{}.ID',3), signature=Operation, user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0))
|
||||
| spath input=object_attrs_old output=B2BOld path={}
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: O365 SharePoint Allowed Domains Policy Changed
|
||||
id: b0cc6fa8-39b1-49ac-a4fe-f2f2a668e06c
|
||||
version: 1
|
||||
date: '2024-04-01'
|
||||
version: 2
|
||||
date: '2024-09-24'
|
||||
author: Steven Dick
|
||||
status: production
|
||||
type: TTP
|
||||
@@ -18,7 +18,7 @@ search: >
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `o365_sharepoint_allowed_domains_policy_changed_filter`
|
||||
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
|
||||
how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events.
|
||||
known_false_positives: Business approved changes by known administrators.
|
||||
references:
|
||||
- https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
name: AWS Cloud Provisioning From Previously Unseen City
|
||||
id: 344a1778-0b25-490c-adb1-de8beddf59cd
|
||||
version: 2
|
||||
date: '2024-08-16'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: David Dorsey, Splunk
|
||||
status: deprecated
|
||||
type: Anomaly
|
||||
description: 'This search looks for AWS provisioning activities from previously unseen
|
||||
cities. Provisioning activities are defined broadly as any event that begins with
|
||||
"Run" or "Create." This search is deprecated and have been translated to use the
|
||||
latest Change Datamodel. '
|
||||
latest Change Datamodel.'
|
||||
data_source: []
|
||||
search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress
|
||||
| search City=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
name: AWS Cloud Provisioning From Previously Unseen Country
|
||||
id: ceb8d3d8-06cb-49eb-beaf-829526e33ff0
|
||||
version: 2
|
||||
date: '2024-08-15'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: David Dorsey, Splunk
|
||||
status: deprecated
|
||||
type: Anomaly
|
||||
description: 'This search looks for AWS provisioning activities from previously unseen
|
||||
countries. Provisioning activities are defined broadly as any event that begins
|
||||
with "Run" or "Create." This search is deprecated and have been translated to use
|
||||
the latest Change Datamodel. '
|
||||
the latest Change Datamodel.'
|
||||
data_source: []
|
||||
search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress
|
||||
| search Country=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) |
|
||||
|
||||
@@ -1,14 +1,14 @@
|
||||
name: AWS Cloud Provisioning From Previously Unseen IP Address
|
||||
id: 42e15012-ac14-4801-94f4-f1acbe64880b
|
||||
version: 2
|
||||
date: '2024-08-15'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: David Dorsey, Splunk
|
||||
status: deprecated
|
||||
type: Anomaly
|
||||
description: 'This search looks for AWS provisioning activities from previously unseen
|
||||
IP addresses. Provisioning activities are defined broadly as any event that begins
|
||||
with "Run" or "Create." This search is deprecated and have been translated to use
|
||||
the latest Change Datamodel. '
|
||||
the latest Change Datamodel.'
|
||||
data_source: []
|
||||
search: '`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail` (eventName=Run*
|
||||
OR eventName=Create*) | iplocation sourceIPAddress | search Country=* | stats earliest(_time)
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes AWS detect sensitive role access
|
||||
id: b6013a7b-85e0-4a45-b051-10b252d69569
|
||||
version: 2
|
||||
date: '2024-08-15'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Rod Soto, Splunk
|
||||
status: deprecated
|
||||
type: Hunting
|
||||
@@ -15,7 +15,7 @@ search: '`aws_cloudwatchlogs_eks` objectRef.resource=clusterroles OR clusterrole
|
||||
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This
|
||||
search works with cloudwatch logs.
|
||||
known_false_positives: 'Sensitive role resource access is necessary for cluster operation,
|
||||
however source IP, namespace and user group may indicate possible malicious use. '
|
||||
however source IP, namespace and user group may indicate possible malicious use.'
|
||||
references: []
|
||||
tags:
|
||||
analytic_story:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Kubernetes Azure detect sensitive role access
|
||||
id: f27349e5-1641-4f6a-9e68-30402be0ad4c
|
||||
version: 2
|
||||
date: '2024-08-15'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Rod Soto, Splunk
|
||||
status: deprecated
|
||||
type: Hunting
|
||||
@@ -15,7 +15,7 @@ search: '`kubernetes_azure` category=kube-audit | spath input=properties.log| se
|
||||
how_to_implement: You must install the Add-on for Microsoft Cloud Services and Configure
|
||||
Kube-Audit data diagnostics
|
||||
known_false_positives: 'Sensitive role resource access is necessary for cluster operation,
|
||||
however source IP, namespace and user group may indicate possible malicious use. '
|
||||
however source IP, namespace and user group may indicate possible malicious use.'
|
||||
references: []
|
||||
tags:
|
||||
analytic_story:
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: LOLBAS With Network Traffic
|
||||
id: 2820f032-19eb-497e-8642-25b04a880359
|
||||
version: 2
|
||||
date: '2024-05-11'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Steven Dick
|
||||
status: production
|
||||
type: TTP
|
||||
@@ -38,7 +38,7 @@ how_to_implement: To successfully implement this detection you must ingest event
|
||||
of this type this data type.
|
||||
known_false_positives: 'Legitmate usage of internal automation or scripting, espically
|
||||
powershell.exe internal to internal or logon scripts. It may be necessary to omit
|
||||
internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1") '
|
||||
internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1")'
|
||||
references:
|
||||
- https://lolbas-project.github.io/#
|
||||
- https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Malicious PowerShell Process With Obfuscation Techniques
|
||||
id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4
|
||||
version: 6
|
||||
date: '2024-05-18'
|
||||
version: 7
|
||||
date: '2024-09-24'
|
||||
author: David Dorsey, Splunk
|
||||
status: production
|
||||
type: TTP
|
||||
@@ -23,7 +23,7 @@ search: "| tstats `security_content_summariesonly` count values(Processes.proces
|
||||
`security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,\"\
|
||||
`\"))-1) + (mvcount(split(process, \"^\"))-1) + (mvcount(split(process, \"'\"))-1)
|
||||
| `malicious_powershell_process_with_obfuscation_techniques_filter` | search num_obfuscation
|
||||
> 10 "
|
||||
> 10"
|
||||
how_to_implement: The detection is based on data that originates from Endpoint Detection
|
||||
and Response (EDR) agents. These agents are designed to provide security-related
|
||||
telemetry from the endpoints where the agent is installed. To implement this search,
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Windows DISM Install PowerShell Web Access
|
||||
id: fa6142a7-c364-4d11-9954-895dd9efb2d4
|
||||
version: 1
|
||||
date: '2024-09-03'
|
||||
version: 2
|
||||
date: '2024-09-24'
|
||||
author: Michael Haag, Splunk
|
||||
data_sources:
|
||||
- Windows Event Log Security 4688
|
||||
@@ -9,7 +9,7 @@ data_sources:
|
||||
type: TTP
|
||||
status: production
|
||||
description: The following analytic detects the installation of PowerShell Web Access using the Deployment Image Servicing and Management (DISM) tool. It leverages Sysmon Event ID 1 to identify the execution of `dism.exe` with specific parameters related to enabling the WindowsPowerShellWebAccess feature. This activity is significant because enabling PowerShell Web Access can facilitate remote execution of PowerShell commands, potentially allowing an attacker to gain unauthorized access to systems and networks. If confirmed malicious, this action could lead to further exploitation and compromise of the affected system.
|
||||
search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
|
||||
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime
|
||||
from datamodel=Endpoint.Processes
|
||||
where Processes.process_name=dism.exe
|
||||
(Processes.process="*WindowsPowerShellWebAccess*" AND Processes.process="*/online*" AND Processes.process="*/enable-feature*")
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Windows Rapid Authentication On Multiple Hosts
|
||||
id: 62606c77-d53d-4182-9371-b02cdbbbcef7
|
||||
version: 2
|
||||
date: '2024-05-16'
|
||||
version: 3
|
||||
date: '2024-09-24'
|
||||
author: Mauricio Velazco, Splunk
|
||||
type: TTP
|
||||
status: production
|
||||
@@ -14,7 +14,7 @@ description: The following analytic detects a source computer authenticating to
|
||||
movement or network share enumeration by an adversary. If confirmed malicious, this
|
||||
could lead to unauthorized access to multiple systems, potentially compromising
|
||||
sensitive data and escalating privileges within the network.
|
||||
search: ' `wineventlog_security` EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS
|
||||
search: '`wineventlog_security` EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS
|
||||
LOGON" TargetUserName!="*$" | bucket span=5m _time | stats dc(Computer) AS unique_targets
|
||||
values(Computer) as host_targets by _time, IpAddress, TargetUserName | where unique_targets
|
||||
> 30 | `windows_rapid_authentication_on_multiple_hosts_filter`'
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
name: Detect Windows DNS SIGRed via Zeek
|
||||
id: c5c622e4-d073-11ea-87d0-0242ac130003
|
||||
version: 3
|
||||
date: '2024-08-19'
|
||||
version: 4
|
||||
date: '2024-09-24'
|
||||
author: Shannon Davis, Splunk
|
||||
status: experimental
|
||||
type: TTP
|
||||
@@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Network_
|
||||
| append [| tstats `security_content_summariesonly` count from datamodel=Network_Traffic
|
||||
where All_Traffic.bytes_in>65000 by All_Traffic.flow_id | rename All_Traffic.flow_id
|
||||
as flow_id] | `detect_windows_dns_sigred_via_zeek_filter` | stats count by flow_id
|
||||
| where count>1 | fields - count '
|
||||
| where count>1 | fields - count'
|
||||
how_to_implement: You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek
|
||||
data should also be getting ingested in JSON format. We are detecting SIG and KEY
|
||||
records via bro:dns:json and TCP payload over 65KB in size via bro:conn:json. The
|
||||
|
||||
Reference in New Issue
Block a user