diff --git a/detections/outlook_writing_zip.json b/detections/outlook_writing_zip.json index 44af466162..5e65049a93 100644 --- a/detections/outlook_writing_zip.json +++ b/detections/outlook_writing_zip.json @@ -39,7 +39,7 @@ "earliest_time": "-70m@m", "latest_time": "-10m@m" }, - "search": "| tstats `summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user| `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | join [| tstats `summariesonly` values(Filesystem.file_path) as file_path count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*.zip by Filesystem.process_id Filesystem.file_hash Filesystem.dest Filesystem.file_name| `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | fields process_id dest file_path file_name file_hash]", + "search": "| tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe OR Processes.process_name=explorer.exe by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | rename process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id type=inner[| tstats `summariesonly` count values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\\\Users* OR Filesystem.file_path=*Local\\\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash Filesystem.dest | `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | rename process_id as malicious_id| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] | table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name file_path | where file_name != \"\"", "suppress": { "suppress_fields": "dest,file_name", "suppress_period": "86400s" diff --git a/spec/v2/detections.spec.json b/spec/v2/detections.spec.json index 0bdc38fd2f..866181c414 100644 --- a/spec/v2/detections.spec.json +++ b/spec/v2/detections.spec.json @@ -614,10 +614,7 @@ "Sysmon", "Tanium", "Ziften", - "OSquery", - "Censys", - "Passive Total", - "WHOIS" + "OSquery" ] }, "minItems": 0, @@ -707,8 +704,7 @@ "src_user", "src", "user", - "query", - "answer" + "query" ] }, "minItems": 0, @@ -898,6 +894,8 @@ "Initial Access", "Execution", "Persistence", + "Spearphishing Attachment", + "Spearphishing Link", "Privilege Escalation", "Defense Evasion", "Credential Access", @@ -1011,8 +1009,7 @@ "Windows Management Instrumentation", "Windows Remote Management", "Winlogon Helper DLL", - "Exploitation for Privilege Escalation", - "Spearphishing Attachment" + "Exploitation for Privilege Escalation" ] }, "minItems": 0, diff --git a/src/default/analytic_stories.conf b/src/default/analytic_stories.conf index c7a1ffd909..aa24b09732 100644 --- a/src/default/analytic_stories.conf +++ b/src/default/analytic_stories.conf @@ -380,7 +380,7 @@ narrative = Attackers employ a variety of tactics in order to avoid detection an category = "Malware" creation_date = 2017-11-21 modification_date = 2018-09-06 -id = 8169f17b-ef68-4b59-aae8-5869073014e1 +id = 8169f17b-ef68-4b59-aae8-586907301221 version = 2.0 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] detection_searches = ["ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule"] diff --git a/src/default/savedsearches.conf b/src/default/savedsearches.conf index f3117d0d90..96daf0f31f 100644 --- a/src/default/savedsearches.conf +++ b/src/default/savedsearches.conf @@ -2008,7 +2008,7 @@ quantity = 0 realtime_schedule = 0 schedule_window = auto is_visible = false -search = | tstats `summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe by Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user| `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | join [| tstats `summariesonly` values(Filesystem.file_path) as file_path count FROM datamodel=Endpoint.Filesystem where Filesystem.file_path=*.zip by Filesystem.process_id Filesystem.file_hash Filesystem.dest Filesystem.file_name| `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | fields process_id dest file_path file_name file_hash] +search = | tstats `summariesonly` min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_name=outlook.exe OR Processes.process_name=explorer.exe by _time span=5m Processes.parent_process_id Processes.process_id Processes.dest Processes.process_name Processes.parent_process_name Processes.user | `drop_dm_object_name(Processes)` | `ctime(firstTime)` | `ctime(lastTime)` | rename process_id as malicious_id| rename parent_process_id as outlook_id| join malicious_id type=inner[| tstats `summariesonly` count values(Filesystem.file_path) as file_path values(Filesystem.file_name) as file_name FROM datamodel=Endpoint.Filesystem where (Filesystem.file_path=*zip* OR Filesystem.file_name=*.lnk ) AND (Filesystem.file_path=C:\\Users* OR Filesystem.file_path=*Local\\Temp*) by _time span=5m Filesystem.process_id Filesystem.file_hash Filesystem.dest | `drop_dm_object_name(Filesystem)` | `ctime(firstTime)` | `ctime(lastTime)` | rename process_id as malicious_id| fields malicious_id outlook_id dest file_path file_name file_hash count file_id] | table firstTime lastTime user malicious_id outlook_id process_name parent_process_name file_name file_path | where file_name != "" [ESCU - Detect Outbound SMB Traffic - Rule] action.escu = 0 diff --git a/src/default/use_case_library.conf b/src/default/use_case_library.conf index 3131ed3a6c..28a89fa2b1 100644 --- a/src/default/use_case_library.conf +++ b/src/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2019-04-23T19:54:43 UTC +# On Date: 2019-04-22T21:14:43 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -522,7 +522,7 @@ reference = [] maintainers = [{"company": "Splunk", "email": "research@splunk.com", "name": "Splunk Research Team"}] spec_version = 2 searches = ["ESCU - Detect Oulook.exe writing a .zip file - Rule", "ESCU - Suspicious LNK file launching a process - Rule"] -description = XXXX - Placeholder for Phishing description +description = This story contains analytics around detecting payloads from a phishing attack narrative = XXXX - Placeholder for Phishing narrative [analytic_story://Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns] diff --git a/stories/dynamic_dns.json b/stories/dynamic_dns.json index c08671698e..b5618ba85f 100644 --- a/stories/dynamic_dns.json +++ b/stories/dynamic_dns.json @@ -3,7 +3,7 @@ "channel": "ESCU", "creation_date": "2017-11-21", "description": "Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists.", - "id": "8169f17b-ef68-4b59-aae8-5869073014e1", + "id": "8169f17b-ef68-4b59-aae8-586907301221", "maintainers": [ { "company": "Splunk", diff --git a/stories/phishing_payloads.json b/stories/phishing_payloads.json index 6f10f9ac44..287f2ff25c 100644 --- a/stories/phishing_payloads.json +++ b/stories/phishing_payloads.json @@ -5,7 +5,7 @@ ], "channel": "ESCU", "creation_date": "2019-04-10", - "description": "XXXX - Placeholder for Phishing description", + "description": "This story contains analytics around detecting payloads from a phishing attack", "detections": [ { "detection_id": "a51bfe1a-94f0-4822-b1e4-16ae10145893",