admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'develop' into spec_update

Browse Source
This commit is contained in:
Jose Enrique Hernandez
2019-04-23 15:59:44 -04:00
committed by GitHub
parent c472e2271e e4ac436819
commit 5e4ba79fa0
7 changed files with 12 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/outlook_writing_zip.json
+1 -1
View File
@@ -39,7 +39,7 @@
"earliest_time": "-70m@m",
"latest_time": "-10m@m"
},
"search": "| tstats `summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user| `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | join [| tstats `summariesonly` values(Filesystem.file_path) as file_path count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*.zip by Filesystem.process_id Filesystem.file_hash Filesystem.dest Filesystem.file_name| `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | fields process_id dest file_path file_name file_hash]",
"search": "| tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe OR Processes.process_name=explorer.exe by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | rename process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id type=inner[| tstats `summariesonly` count values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\\\Users* OR Filesystem.file_path=*Local\\\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash Filesystem.dest | `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | rename process_id as malicious_id| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] | table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name file_path | where file_name != \"\"",
"suppress": {
"suppress_fields": "dest,file_name",
"suppress_period": "86400s"
spec/v2/detections.spec.json
+5 -8
View File
@@ -614,10 +614,7 @@
"Sysmon",
"Tanium",
"Ziften",
"OSquery",
"Censys",
"Passive Total",
"WHOIS"
"OSquery"
]
},
"minItems": 0,
@@ -707,8 +704,7 @@
"src_user",
"src",
"user",
"query",
"answer"
"query"
]
},
"minItems": 0,
@@ -898,6 +894,8 @@
"Initial Access",
"Execution",
"Persistence",
"Spearphishing Attachment",
"Spearphishing Link",
"Privilege Escalation",
"Defense Evasion",
"Credential Access",
@@ -1011,8 +1009,7 @@
"Windows Management Instrumentation",
"Windows Remote Management",
"Winlogon Helper DLL",
"Exploitation for Privilege Escalation",
"Spearphishing Attachment"
"Exploitation for Privilege Escalation"
]
},
"minItems": 0,
src/default/analytic_stories.conf
+1 -1
View File
@@ -380,7 +380,7 @@ narrative = Attackers employ a variety of tactics in order to avoid detection an
category = "Malware"
creation_date = 2017-11-21
modification_date = 2018-09-06
id = 8169f17b-ef68-4b59-aae8-5869073014e1
id = 8169f17b-ef68-4b59-aae8-586907301221
version = 2.0
reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"]
detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule"]
src/default/savedsearches.conf
+1 -1
View File
@@ -2008,7 +2008,7 @@ quantity = 0
realtime_schedule = 0
schedule_window = auto
is_visible = false
search = | tstats `summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user| `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | join [| tstats `summariesonly` values(Filesystem.file_path) as file_path count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*.zip by Filesystem.process_id Filesystem.file_hash Filesystem.dest Filesystem.file_name| `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | fields process_id dest file_path file_name file_hash]
search = | tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe OR Processes.process_name=explorer.exe by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | rename process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id type=inner[| tstats `summariesonly` count values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* OR Filesystem.file_path=*Local\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash Filesystem.dest | `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | rename process_id as malicious_id| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] | table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name file_path | where file_name != ""
[ESCU - Detect Outbound SMB Traffic - Rule]
action.escu = 0
src/default/use_case_library.conf
+2 -2
View File
@@ -1,6 +1,6 @@
#############
# Automatically generated by generator.py in splunk/security-content
# On Date: 2019-04-23T19:54:43 UTC
# On Date: 2019-04-22T21:14:43 UTC
# Author: Splunk Security Research
# Contact: research@splunk.com
#############
@@ -522,7 +522,7 @@ reference = []
maintainers = [{"company": "Splunk", "email": "research@splunk.com", "name": "Splunk Research Team"}]
spec_version = 2
searches = ["ESCU - Detect Oulook.exe writing a .zip file - Rule", "ESCU - Suspicious LNK file launching a process - Rule"]
description = XXXX - Placeholder for Phishing description
description = This story contains analytics around detecting payloads from a phishing attack
narrative = XXXX - Placeholder for Phishing narrative
[analytic_story://Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns]
stories/dynamic_dns.json
+1 -1
View File
@@ -3,7 +3,7 @@
"channel": "ESCU",
"creation_date": "2017-11-21",
"description": "Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.",
"id": "8169f17b-ef68-4b59-aae8-5869073014e1",
"id": "8169f17b-ef68-4b59-aae8-586907301221",
"maintainers": [
{
"company": "Splunk",
stories/phishing_payloads.json
+1 -1
View File
@@ -5,7 +5,7 @@
],
"channel": "ESCU",
"creation_date": "2019-04-10",
"description": "XXXX - Placeholder for Phishing description",
"description": "This story contains analytics around detecting payloads from a phishing attack",
"detections": [
{
"detection_id": "a51bfe1a-94f0-4822-b1e4-16ae10145893",