From 5b75e85ef87d699509f052dab4bb965bd8f40661 Mon Sep 17 00:00:00 2001 From: pyth0n1c Date: Tue, 24 Sep 2024 16:53:25 -0700 Subject: [PATCH] second pass at fixing whitespace and related update fields --- .../okta_multi_factor_authentication_disabled.yml | 6 +++--- .../okta_multiple_users_failing_to_authenticate_from_ip.yml | 6 +++--- detections/application/okta_new_api_token_created.yml | 6 +++--- .../application/okta_new_device_enrolled_on_account.yml | 6 +++--- .../kubernetes_anomalous_inbound_outbound_network_io.yml | 6 +++--- ...netes_anomalous_inbound_to_outbound_network_io_ratio.yml | 6 +++--- .../kubernetes_previously_unseen_container_image_name.yml | 6 +++--- detections/cloud/kubernetes_previously_unseen_process.yml | 6 +++--- .../cloud/kubernetes_process_running_from_new_path.yml | 6 +++--- ...bernetes_process_with_anomalous_resource_utilisation.yml | 6 +++--- .../kubernetes_process_with_resource_ratio_anomalies.yml | 6 +++--- .../cloud/kubernetes_shell_running_on_worker_node.yml | 6 +++--- ...netes_shell_running_on_worker_node_with_cpu_activity.yml | 6 +++--- .../cloud/o365_application_available_to_other_tenants.yml | 6 +++--- detections/cloud/o365_cross_tenant_access_change.yml | 6 +++--- detections/cloud/o365_dlp_rule_triggered.yml | 6 +++--- detections/cloud/o365_external_guest_user_invited.yml | 6 +++--- detections/cloud/o365_external_identity_policy_changed.yml | 6 +++--- .../o365_sharepoint_allowed_domains_policy_changed.yml | 6 +++--- .../aws_cloud_provisioning_from_previously_unseen_city.yml | 6 +++--- ...ws_cloud_provisioning_from_previously_unseen_country.yml | 6 +++--- ...cloud_provisioning_from_previously_unseen_ip_address.yml | 6 +++--- .../kubernetes_aws_detect_sensitive_role_access.yml | 6 +++--- .../kubernetes_azure_detect_sensitive_role_access.yml | 6 +++--- detections/endpoint/lolbas_with_network_traffic.yml | 6 +++--- ...cious_powershell_process_with_obfuscation_techniques.yml | 6 +++--- .../endpoint/windows_dism_install_powershell_web_access.yml | 6 +++--- .../windows_rapid_authentication_on_multiple_hosts.yml | 6 +++--- detections/network/detect_windows_dns_sigred_via_zeek.yml | 6 +++--- 29 files changed, 87 insertions(+), 87 deletions(-) diff --git a/detections/application/okta_multi_factor_authentication_disabled.yml b/detections/application/okta_multi_factor_authentication_disabled.yml index 478f4dbbac..7f271e7198 100644 --- a/detections/application/okta_multi_factor_authentication_disabled.yml +++ b/detections/application/okta_multi_factor_authentication_disabled.yml @@ -1,7 +1,7 @@ name: Okta Multi-Factor Authentication Disabled id: 7c0348ce-bdf9-45f6-8a57-c18b5976f00a -version: 2 -date: '2024-05-13' +version: 3 +date: '2024-09-24' author: Mauricio Velazco, Splunk data_source: - Okta @@ -15,7 +15,7 @@ description: The following analytic identifies an attempt to disable multi-facto could enable attackers to bypass additional security layers, potentially leading to unauthorized access to sensitive information and prolonged undetected presence in the network. -search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime, +search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Change where sourcetype="OktaIM2:log" All_Changes.object_category=User AND All_Changes.action=modified All_Changes.command=user.mfa.factor.deactivate by All_Changes.user All_Changes.result All_Changes.command sourcetype All_Changes.src diff --git a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml index 4f1af7ca0b..81455e311b 100644 --- a/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml +++ b/detections/application/okta_multiple_users_failing_to_authenticate_from_ip.yml @@ -1,7 +1,7 @@ name: Okta Multiple Users Failing To Authenticate From Ip id: de365ffa-42f5-46b5-b43f-fa72290b8218 -version: 2 -date: '2024-05-28' +version: 3 +date: '2024-09-24' author: Michael Haag, Mauricio Velazco, Splunk data_source: - Okta @@ -15,7 +15,7 @@ description: The following analytic identifies instances where more than 10 uniq behavior suggests an external entity is attempting to compromise multiple user accounts, potentially leading to unauthorized access to organizational resources and data breaches. -search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime, +search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime dc(Authentication.user) as unique_accounts values(Authentication.signature) as signature values(Authentication.user) as user values(Authentication.app) as app values(Authentication.authentication_method) as authentication_method from datamodel=Authentication diff --git a/detections/application/okta_new_api_token_created.yml b/detections/application/okta_new_api_token_created.yml index 4c4200cccb..6bd87dae20 100644 --- a/detections/application/okta_new_api_token_created.yml +++ b/detections/application/okta_new_api_token_created.yml @@ -1,7 +1,7 @@ name: Okta New API Token Created id: c3d22720-35d3-4da4-bd0a-740d37192bd4 -version: 3 -date: '2024-05-11' +version: 4 +date: '2024-09-24' author: Michael Haag, Mauricio Velazco, Splunk status: production type: TTP @@ -15,7 +15,7 @@ description: The following analytic detects the creation of a new API token with environment. data_source: - Okta -search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime, +search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Change where All_Changes.action=created AND All_Changes.command=system.api_token.create by _time span=5m All_Changes.user All_Changes.result All_Changes.command sourcetype All_Changes.src All_Changes.action All_Changes.object_category diff --git a/detections/application/okta_new_device_enrolled_on_account.yml b/detections/application/okta_new_device_enrolled_on_account.yml index 76288f15e1..91bacfb731 100644 --- a/detections/application/okta_new_device_enrolled_on_account.yml +++ b/detections/application/okta_new_device_enrolled_on_account.yml @@ -1,7 +1,7 @@ name: Okta New Device Enrolled on Account id: bb27cbce-d4de-432c-932f-2e206e9130fb -version: 3 -date: '2024-05-24' +version: 4 +date: '2024-09-24' author: Michael Haag, Mauricio Velazco, Splunk status: production type: TTP @@ -15,7 +15,7 @@ description: The following analytic identifies when a new device is enrolled on and mitigating unauthorized access attempts. data_source: - Okta -search: ' | tstats `security_content_summariesonly` count max(_time) as lastTime, +search: '| tstats `security_content_summariesonly` count max(_time) as lastTime, min(_time) as firstTime from datamodel=Change where All_Changes.action=created All_Changes.command=device.enrollment.create by _time span=5m All_Changes.user All_Changes.result All_Changes.command sourcetype All_Changes.src All_Changes.action All_Changes.object_category | `drop_dm_object_name("All_Changes")` diff --git a/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml b/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml index 36e40b25e4..41cf89bcfe 100644 --- a/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml +++ b/detections/cloud/kubernetes_anomalous_inbound_outbound_network_io.yml @@ -1,7 +1,7 @@ name: Kubernetes Anomalous Inbound Outbound Network IO id: 4f3b0c97-657e-4547-a89a-9a50c656e3cd -version: 2 -date: '2024-05-13' +version: 3 +date: '2024-09-24' author: Matthew Moore, Splunk status: experimental type: Anomaly @@ -63,7 +63,7 @@ how_to_implement: 'To implement this detection, follow these steps: * Leave all other settings at their default values. - * Run the Search Baseline Of Kubernetes Container Network IO Ratio ' + * Run the Search Baseline Of Kubernetes Container Network IO Ratio' known_false_positives: unknown references: - https://github.com/signalfx/splunk-otel-collector-chart diff --git a/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml b/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml index a115c50b9f..660cb4ac26 100644 --- a/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml +++ b/detections/cloud/kubernetes_anomalous_inbound_to_outbound_network_io_ratio.yml @@ -1,7 +1,7 @@ name: Kubernetes Anomalous Inbound to Outbound Network IO Ratio id: 9d8f6e3f-39df-46d8-a9d4-96173edc501f -version: 2 -date: '2024-05-26' +version: 3 +date: '2024-09-24' author: Matthew Moore, Splunk status: experimental type: Anomaly @@ -67,7 +67,7 @@ how_to_implement: 'To implement this detection, follow these steps: * Leave all other settings at their default values. - * Run the Search Baseline Of Kubernetes Container Network IO Ratio ' + * Run the Search Baseline Of Kubernetes Container Network IO Ratio' known_false_positives: unknown references: - https://github.com/signalfx/splunk-otel-collector-chart diff --git a/detections/cloud/kubernetes_previously_unseen_container_image_name.yml b/detections/cloud/kubernetes_previously_unseen_container_image_name.yml index 893fa07fce..27483d2891 100644 --- a/detections/cloud/kubernetes_previously_unseen_container_image_name.yml +++ b/detections/cloud/kubernetes_previously_unseen_container_image_name.yml @@ -1,7 +1,7 @@ name: Kubernetes Previously Unseen Container Image Name id: fea515a4-b1d8-4cd6-80d6-e0d71397b891 -version: 2 -date: '2024-05-27' +version: 3 +date: '2024-09-24' author: Matthew Moore, Splunk status: experimental type: Anomaly @@ -54,7 +54,7 @@ how_to_implement: 'To implement this detection, follow these steps: * Leave all other settings at their default values. - * Run the Search Baseline Of Kubernetes Container Network IO Ratio ' + * Run the Search Baseline Of Kubernetes Container Network IO Ratio' known_false_positives: unknown references: - https://github.com/signalfx/splunk-otel-collector-chart diff --git a/detections/cloud/kubernetes_previously_unseen_process.yml b/detections/cloud/kubernetes_previously_unseen_process.yml index 605ca069bb..5c5c73f4be 100644 --- a/detections/cloud/kubernetes_previously_unseen_process.yml +++ b/detections/cloud/kubernetes_previously_unseen_process.yml @@ -1,7 +1,7 @@ name: Kubernetes Previously Unseen Process id: c8119b2f-d7f7-40be-940a-1c582870e8e2 -version: 2 -date: '2024-05-13' +version: 3 +date: '2024-09-24' author: Matthew Moore, Splunk status: experimental type: Anomaly @@ -53,7 +53,7 @@ how_to_implement: 'To implement this detection, follow these steps: * Leave all other settings at their default values. - * Run the Search Baseline Of Kubernetes Container Network IO Ratio ' + * Run the Search Baseline Of Kubernetes Container Network IO Ratio' known_false_positives: unknown references: - https://github.com/signalfx/splunk-otel-collector-chart diff --git a/detections/cloud/kubernetes_process_running_from_new_path.yml b/detections/cloud/kubernetes_process_running_from_new_path.yml index 41b969d36b..17bf0230ed 100644 --- a/detections/cloud/kubernetes_process_running_from_new_path.yml +++ b/detections/cloud/kubernetes_process_running_from_new_path.yml @@ -1,7 +1,7 @@ name: Kubernetes Process Running From New Path id: 454076fb-0e9e-4adf-b93a-da132621c5e6 -version: 2 -date: '2024-05-27' +version: 3 +date: '2024-09-24' author: Matthew Moore, Splunk status: experimental type: Anomaly @@ -54,7 +54,7 @@ how_to_implement: 'To implement this detection, follow these steps: * Leave all other settings at their default values. - * Run the Search Baseline Of Kubernetes Container Network IO Ratio ' + * Run the Search Baseline Of Kubernetes Container Network IO Ratio' known_false_positives: unknown references: - https://github.com/signalfx/splunk-otel-collector-chart diff --git a/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml b/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml index 44d9d3dce9..5ca1eb40fc 100644 --- a/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml +++ b/detections/cloud/kubernetes_process_with_anomalous_resource_utilisation.yml @@ -1,7 +1,7 @@ name: Kubernetes Process with Anomalous Resource Utilisation id: 25ca9594-7a0d-4a95-a5e5-3228d7398ec8 -version: 2 -date: '2024-05-27' +version: 3 +date: '2024-09-24' author: Matthew Moore, Splunk status: experimental type: Anomaly @@ -62,7 +62,7 @@ how_to_implement: 'To implement this detection, follow these steps: * Leave all other settings at their default values. - * Run the Search Baseline Of Kubernetes Container Network IO Ratio ' + * Run the Search Baseline Of Kubernetes Container Network IO Ratio' known_false_positives: unknown references: - https://github.com/signalfx/splunk-otel-collector-chart diff --git a/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml b/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml index 870ba66146..bbae2e0b0f 100644 --- a/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml +++ b/detections/cloud/kubernetes_process_with_resource_ratio_anomalies.yml @@ -1,7 +1,7 @@ name: Kubernetes Process with Resource Ratio Anomalies id: 0d42b295-0f1f-4183-b75e-377975f47c65 -version: 2 -date: '2024-05-30' +version: 3 +date: '2024-09-24' author: Matthew Moore, Splunk status: experimental type: Anomaly @@ -61,7 +61,7 @@ how_to_implement: 'To implement this detection, follow these steps: * Leave all other settings at their default values. - * Run the Search Baseline Of Kubernetes Container Network IO Ratio ' + * Run the Search Baseline Of Kubernetes Container Network IO Ratio' known_false_positives: unknown references: - https://github.com/signalfx/splunk-otel-collector-chart diff --git a/detections/cloud/kubernetes_shell_running_on_worker_node.yml b/detections/cloud/kubernetes_shell_running_on_worker_node.yml index 53ba59cfd2..1e391eed9a 100644 --- a/detections/cloud/kubernetes_shell_running_on_worker_node.yml +++ b/detections/cloud/kubernetes_shell_running_on_worker_node.yml @@ -1,7 +1,7 @@ name: Kubernetes Shell Running on Worker Node id: efebf0c4-dcf4-496f-85a2-5ab7ad8fa876 -version: 2 -date: '2024-05-25' +version: 3 +date: '2024-09-24' author: Matthew Moore, Splunk status: experimental type: Anomaly @@ -51,7 +51,7 @@ how_to_implement: 'To implement this detection, follow these steps: * Leave all other settings at their default values. - * Run the Search Baseline Of Kubernetes Container Network IO Ratio ' + * Run the Search Baseline Of Kubernetes Container Network IO Ratio' known_false_positives: unknown references: - https://github.com/signalfx/splunk-otel-collector-chart/tree/main diff --git a/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml b/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml index 7440e985c8..28efa94614 100644 --- a/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml +++ b/detections/cloud/kubernetes_shell_running_on_worker_node_with_cpu_activity.yml @@ -1,7 +1,7 @@ name: Kubernetes Shell Running on Worker Node with CPU Activity id: cc1448e3-cc7a-4518-bc9f-2fa48f61a22b -version: 2 -date: '2024-05-11' +version: 3 +date: '2024-09-24' author: Matthew Moore, Splunk status: experimental type: Anomaly @@ -52,7 +52,7 @@ how_to_implement: 'To implement this detection, follow these steps: * Leave all other settings at their default values. - * Run the Search Baseline Of Kubernetes Container Network IO Ratio ' + * Run the Search Baseline Of Kubernetes Container Network IO Ratio' known_false_positives: unknown references: - https://github.com/signalfx/splunk-otel-collector-chart/tree/main diff --git a/detections/cloud/o365_application_available_to_other_tenants.yml b/detections/cloud/o365_application_available_to_other_tenants.yml index afe0f18efd..4299ba60ea 100644 --- a/detections/cloud/o365_application_available_to_other_tenants.yml +++ b/detections/cloud/o365_application_available_to_other_tenants.yml @@ -1,14 +1,14 @@ name: O365 Application Available To Other Tenants id: 942548a3-0273-47a4-8dbd-e5202437395c -version: 1 -date: '2024-04-11' +version: 2 +date: '2024-09-24' author: Steven Dick status: production type: TTP description: The following analytic identifies the configuration of Azure Active Directory Applications in a manner that allows authentication from external tenants or personal accounts. This configuration can lead to inappropriate or malicious access of any data or capabilities the application is allowed to access. This detection leverages the O365 Universal Audit Log data source. data_source: - Office 365 Universal Audit Log -search: > +search: >- `o365_management_activity` Workload=AzureActiveDirectory Operation IN ("Add application.","Update application.") ModifiedProperties{}.Name=AvailableToOtherTenants | eval result = case(match(mvindex('ModifiedProperties{}.NewValue',mvfind('ModifiedProperties{}.Name',"AvailableToOtherTenants")),"false"),"removed",true(),"added"), object_name=mvindex('Target{}.ID', 3), signature=Operation, object_attrs = "AvailableToOtherTenants", user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | search result = "added" diff --git a/detections/cloud/o365_cross_tenant_access_change.yml b/detections/cloud/o365_cross_tenant_access_change.yml index 6f6cb2f0e1..a37e15202a 100644 --- a/detections/cloud/o365_cross_tenant_access_change.yml +++ b/detections/cloud/o365_cross_tenant_access_change.yml @@ -1,14 +1,14 @@ name: O365 Cross-Tenant Access Change id: 7c0fa490-12b0-4d0b-b9f5-e101d1e0e06f -version: 1 -date: '2024-04-11' +version: 2 +date: '2024-09-24' author: Steven Dick status: production type: TTP description: The following analytic identifies when cross-tenant access/synchronization policies are changed in an Azure tenant. Adversaries have been observed altering victim cross-tenant policies as a method of lateral movement or maintaining persistent access to compromised environments. These policies should be considered sensitive and monitored for changes and/or loose configuration. data_source: - Office 365 Universal Audit Log -search: > +search: >- `o365_management_activity` Workload=AzureActiveDirectory Operation IN ("Add a partner to cross-tenant access setting.","Delete partner specific cross-tenant access setting.") | eval user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | stats values(Workload) as category, values(ClientIP) as src, values(ModifiedProperties{}.Name) as object_name, values(ModifiedProperties{}.NewValue) as object_attrs, count, min(_time) as firstTime, max(_time) as lastTime by Id,user,Operation diff --git a/detections/cloud/o365_dlp_rule_triggered.yml b/detections/cloud/o365_dlp_rule_triggered.yml index b41bb2c6c1..842be25ee5 100644 --- a/detections/cloud/o365_dlp_rule_triggered.yml +++ b/detections/cloud/o365_dlp_rule_triggered.yml @@ -1,14 +1,14 @@ name: O365 DLP Rule Triggered id: 63a8a537-36fd-4aac-a3ea-1a96afd2c871 -version: 1 -date: '2024-04-01' +version: 2 +date: '2024-09-24' author: Steven Dick status: production type: Anomaly description: The following analytic detects when Microsoft Office 365 Data Loss Prevention (DLP) rules have been triggered. DLP rules can be configured for any number of security, regulatory, or business compliance reasons, as such this analytic will only be as accurate as the upstream DLP configuration. Detections from this analytic should be evaluated thoroughly to determine what, if any, security relevance the underlying DLP events contain. data_source: - O365 Universal Audit Log -search: > +search: >- `o365_management_activity` Operation=DLPRuleMatch | eval recipient = 'ExchangeMetaData.To{}', signature_id = 'ExchangeMetaData.UniqueID', signature = 'PolicyDetails{}.Rules{}.RuleName' , src_user = UserId, reason ='PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.SensitiveInformationTypeName', result='PolicyDetails{}.Rules{}.Actions{}', file_name=case(NOT match('PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location',"Message Body"),'PolicyDetails{}.Rules{}.ConditionsMatched.SensitiveInformation{}.Location') | stats min(_time) as firstTime max(_time) as lastTime values(signature) as signature values(file_name) as file_name values(ExchangeMetaData.Subject) AS subject values(Workload) as app values(result) as result by src_user,recipient,signature_id,reason diff --git a/detections/cloud/o365_external_guest_user_invited.yml b/detections/cloud/o365_external_guest_user_invited.yml index a00581e3d9..97748a260c 100644 --- a/detections/cloud/o365_external_guest_user_invited.yml +++ b/detections/cloud/o365_external_guest_user_invited.yml @@ -1,14 +1,14 @@ name: O365 External Guest User Invited id: 8c6d52ec-d5f2-4b2f-8ba1-f32c047a71fa -version: 1 -date: '2024-04-11' +version: 2 +date: '2024-09-24' author: Steven Dick status: production type: TTP description: The following analytic identifies the invitation of an external guest user within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`. This detection leverages the Universal Audit Log (UAL)/o365:management:activity sourcetype as a detection data source. data_source: - Office 365 Universal Audit Log -search: > +search: >- `o365_management_activity` Workload=AzureActiveDirectory AND Operation="Add user*" AND ModifiedProperties{}.NewValue="[*Guest*]" AND ModifiedProperties{}.NewValue="[*Invitation*]" | eval user = (mvindex('ModifiedProperties{}.NewValue',5)), src_user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | rex field=user "(?[\\w\\.-]+@[\\w-]+\\.[\\w-]{2,4})" diff --git a/detections/cloud/o365_external_identity_policy_changed.yml b/detections/cloud/o365_external_identity_policy_changed.yml index a9dbb3c6f0..1e25e96c5e 100644 --- a/detections/cloud/o365_external_identity_policy_changed.yml +++ b/detections/cloud/o365_external_identity_policy_changed.yml @@ -1,14 +1,14 @@ name: O365 External Identity Policy Changed id: 29af1725-7a72-4d2d-8a18-e697e79a62d3 -version: 1 -date: '2024-04-11' +version: 2 +date: '2024-09-24' author: Steven Dick status: production type: TTP description: The following analytic identifies when changes are made to the external guest policies within Azure AD. With Azure AD B2B collaboration, users and administrators can invite external users to collaborate with internal users. This detection also attempts to highlight what may have changed. External guest account invitations should be monitored by security teams as they could potentially lead to unauthorized access. An example of this attack vector was described at BlackHat 2022 by security researcher Dirk-Jan during his tall `Backdooring and Hijacking Azure AD Accounts by Abusing External Identities`. data_source: - Office 365 Universal Audit Log -search: > +search: >- `o365_management_activity` Workload=AzureActiveDirectory Operation="Update policy." Target{}.ID="B2BManagementPolicy" | eval object_attrs = mvindex('ModifiedProperties{}.NewValue',0), object_attrs_old = mvindex('ModifiedProperties{}.OldValue',0), object_name = mvindex('Target{}.ID',3), signature=Operation, user = case(match(mvindex('Actor{}.ID',-1),"User"),mvindex('Actor{}.ID',0),match(mvindex('Actor{}.ID',-1),"ServicePrincipal"),mvindex('Actor{}.ID',3),true(),mvindex('Actor{}.ID',0)) | spath input=object_attrs_old output=B2BOld path={} diff --git a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml index e150b2ab53..360385d549 100644 --- a/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml +++ b/detections/cloud/o365_sharepoint_allowed_domains_policy_changed.yml @@ -1,7 +1,7 @@ name: O365 SharePoint Allowed Domains Policy Changed id: b0cc6fa8-39b1-49ac-a4fe-f2f2a668e06c -version: 1 -date: '2024-04-01' +version: 2 +date: '2024-09-24' author: Steven Dick status: production type: TTP @@ -18,7 +18,7 @@ search: > | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `o365_sharepoint_allowed_domains_policy_changed_filter` -how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. +how_to_implement: You must install the Splunk Microsoft Office 365 Add-on and ingest Office 365 management activity events. known_false_positives: Business approved changes by known administrators. references: - https://learn.microsoft.com/en-us/sharepoint/external-sharing-overview diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml index 0d5eb040d0..8808ce6cc9 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml @@ -1,14 +1,14 @@ name: AWS Cloud Provisioning From Previously Unseen City id: 344a1778-0b25-490c-adb1-de8beddf59cd -version: 2 -date: '2024-08-16' +version: 3 +date: '2024-09-24' author: David Dorsey, Splunk status: deprecated type: Anomaly description: 'This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use the - latest Change Datamodel. ' + latest Change Datamodel.' data_source: [] search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | search City=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml index 364b9ab482..ce54603fd7 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml @@ -1,14 +1,14 @@ name: AWS Cloud Provisioning From Previously Unseen Country id: ceb8d3d8-06cb-49eb-beaf-829526e33ff0 -version: 2 -date: '2024-08-15' +version: 3 +date: '2024-09-24' author: David Dorsey, Splunk status: deprecated type: Anomaly description: 'This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use - the latest Change Datamodel. ' + the latest Change Datamodel.' data_source: [] search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | search Country=* [search `cloudtrail` (eventName=Run* OR eventName=Create*) | diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml index fd2b906142..6305f54912 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml @@ -1,14 +1,14 @@ name: AWS Cloud Provisioning From Previously Unseen IP Address id: 42e15012-ac14-4801-94f4-f1acbe64880b -version: 2 -date: '2024-08-15' +version: 3 +date: '2024-09-24' author: David Dorsey, Splunk status: deprecated type: Anomaly description: 'This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins with "Run" or "Create." This search is deprecated and have been translated to use - the latest Change Datamodel. ' + the latest Change Datamodel.' data_source: [] search: '`cloudtrail` (eventName=Run* OR eventName=Create*) [search `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | search Country=* | stats earliest(_time) diff --git a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml index 7d39a1e05b..ce7746332b 100644 --- a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml @@ -1,7 +1,7 @@ name: Kubernetes AWS detect sensitive role access id: b6013a7b-85e0-4a45-b051-10b252d69569 -version: 2 -date: '2024-08-15' +version: 3 +date: '2024-09-24' author: Rod Soto, Splunk status: deprecated type: Hunting @@ -15,7 +15,7 @@ search: '`aws_cloudwatchlogs_eks` objectRef.resource=clusterroles OR clusterrole how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with cloudwatch logs. known_false_positives: 'Sensitive role resource access is necessary for cluster operation, - however source IP, namespace and user group may indicate possible malicious use. ' + however source IP, namespace and user group may indicate possible malicious use.' references: [] tags: analytic_story: diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml index 6534ebeab7..57bc8af26b 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml @@ -1,7 +1,7 @@ name: Kubernetes Azure detect sensitive role access id: f27349e5-1641-4f6a-9e68-30402be0ad4c -version: 2 -date: '2024-08-15' +version: 3 +date: '2024-09-24' author: Rod Soto, Splunk status: deprecated type: Hunting @@ -15,7 +15,7 @@ search: '`kubernetes_azure` category=kube-audit | spath input=properties.log| se how_to_implement: You must install the Add-on for Microsoft Cloud Services and Configure Kube-Audit data diagnostics known_false_positives: 'Sensitive role resource access is necessary for cluster operation, - however source IP, namespace and user group may indicate possible malicious use. ' + however source IP, namespace and user group may indicate possible malicious use.' references: [] tags: analytic_story: diff --git a/detections/endpoint/lolbas_with_network_traffic.yml b/detections/endpoint/lolbas_with_network_traffic.yml index d60a07c41e..76d5bb52d3 100644 --- a/detections/endpoint/lolbas_with_network_traffic.yml +++ b/detections/endpoint/lolbas_with_network_traffic.yml @@ -1,7 +1,7 @@ name: LOLBAS With Network Traffic id: 2820f032-19eb-497e-8642-25b04a880359 -version: 2 -date: '2024-05-11' +version: 3 +date: '2024-09-24' author: Steven Dick status: production type: TTP @@ -38,7 +38,7 @@ how_to_implement: To successfully implement this detection you must ingest event of this type this data type. known_false_positives: 'Legitmate usage of internal automation or scripting, espically powershell.exe internal to internal or logon scripts. It may be necessary to omit - internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1") ' + internal IP ranges if extremely noisy. ie NOT dest_ip IN ("10.0.0.0/8","172.16.0.0/12","192.168.0.0/16","170.98.0.0/16","0:0:0:0:0:0:0:1")' references: - https://lolbas-project.github.io/# - https://www.sans.org/presentations/lolbin-detection-methods-seven-common-attacks-revealed/ diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 38e345f8f3..c84e69682d 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -1,7 +1,7 @@ name: Malicious PowerShell Process With Obfuscation Techniques id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4 -version: 6 -date: '2024-05-18' +version: 7 +date: '2024-09-24' author: David Dorsey, Splunk status: production type: TTP @@ -23,7 +23,7 @@ search: "| tstats `security_content_summariesonly` count values(Processes.proces `security_content_ctime(lastTime)`| eval num_obfuscation = (mvcount(split(process,\"\ `\"))-1) + (mvcount(split(process, \"^\"))-1) + (mvcount(split(process, \"'\"))-1) | `malicious_powershell_process_with_obfuscation_techniques_filter` | search num_obfuscation - > 10 " + > 10" how_to_implement: The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, diff --git a/detections/endpoint/windows_dism_install_powershell_web_access.yml b/detections/endpoint/windows_dism_install_powershell_web_access.yml index a8d8e8c986..25b873a0d4 100644 --- a/detections/endpoint/windows_dism_install_powershell_web_access.yml +++ b/detections/endpoint/windows_dism_install_powershell_web_access.yml @@ -1,7 +1,7 @@ name: Windows DISM Install PowerShell Web Access id: fa6142a7-c364-4d11-9954-895dd9efb2d4 -version: 1 -date: '2024-09-03' +version: 2 +date: '2024-09-24' author: Michael Haag, Splunk data_sources: - Windows Event Log Security 4688 @@ -9,7 +9,7 @@ data_sources: type: TTP status: production description: The following analytic detects the installation of PowerShell Web Access using the Deployment Image Servicing and Management (DISM) tool. It leverages Sysmon Event ID 1 to identify the execution of `dism.exe` with specific parameters related to enabling the WindowsPowerShellWebAccess feature. This activity is significant because enabling PowerShell Web Access can facilitate remote execution of PowerShell commands, potentially allowing an attacker to gain unauthorized access to systems and networks. If confirmed malicious, this action could lead to further exploitation and compromise of the affected system. -search: ' | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=dism.exe (Processes.process="*WindowsPowerShellWebAccess*" AND Processes.process="*/online*" AND Processes.process="*/enable-feature*") diff --git a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml index 745a615e16..677e24ead8 100644 --- a/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml +++ b/detections/endpoint/windows_rapid_authentication_on_multiple_hosts.yml @@ -1,7 +1,7 @@ name: Windows Rapid Authentication On Multiple Hosts id: 62606c77-d53d-4182-9371-b02cdbbbcef7 -version: 2 -date: '2024-05-16' +version: 3 +date: '2024-09-24' author: Mauricio Velazco, Splunk type: TTP status: production @@ -14,7 +14,7 @@ description: The following analytic detects a source computer authenticating to movement or network share enumeration by an adversary. If confirmed malicious, this could lead to unauthorized access to multiple systems, potentially compromising sensitive data and escalating privileges within the network. -search: ' `wineventlog_security` EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS +search: '`wineventlog_security` EventCode=4624 LogonType=3 TargetUserName!="ANONYMOUS LOGON" TargetUserName!="*$" | bucket span=5m _time | stats dc(Computer) AS unique_targets values(Computer) as host_targets by _time, IpAddress, TargetUserName | where unique_targets > 30 | `windows_rapid_authentication_on_multiple_hosts_filter`' diff --git a/detections/network/detect_windows_dns_sigred_via_zeek.yml b/detections/network/detect_windows_dns_sigred_via_zeek.yml index 1290d1c7be..68417ddda1 100644 --- a/detections/network/detect_windows_dns_sigred_via_zeek.yml +++ b/detections/network/detect_windows_dns_sigred_via_zeek.yml @@ -1,7 +1,7 @@ name: Detect Windows DNS SIGRed via Zeek id: c5c622e4-d073-11ea-87d0-0242ac130003 -version: 3 -date: '2024-08-19' +version: 4 +date: '2024-09-24' author: Shannon Davis, Splunk status: experimental type: TTP @@ -13,7 +13,7 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Network_ | append [| tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.bytes_in>65000 by All_Traffic.flow_id | rename All_Traffic.flow_id as flow_id] | `detect_windows_dns_sigred_via_zeek_filter` | stats count by flow_id - | where count>1 | fields - count ' + | where count>1 | fields - count' how_to_implement: You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek data should also be getting ingested in JSON format. We are detecting SIG and KEY records via bro:dns:json and TCP payload over 65KB in size via bro:conn:json. The