From 5f7f42e48749dec277602e59d1ca9fe8709fcfaa Mon Sep 17 00:00:00 2001 From: bpatel Date: Wed, 24 Apr 2019 18:10:40 -0700 Subject: [PATCH] update to use spec 1 --- bin/generate.py | 18 ++- detections/outlook_writing_zip.json | 8 +- src/default/analytic_stories.conf | 177 +++++++++++++++++++--------- src/default/savedsearches.conf | 6 +- src/default/use_case_library.conf | 4 +- 5 files changed, 148 insertions(+), 65 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index 8fd2967723..d86b447d18 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -612,6 +612,7 @@ def write_analytics_story_confv1(stories, detections, investigations, baselines, output_file.write("### STORIES ###\n\n") # Finish the story for story_name, story in sorted(stories.iteritems()): + print story_name output_file.write("[%s]\n" % story_name) output_file.write("category = {0}\n".format(json.dumps(story['category'][0]))) output_file.write("creation_date = %s\n" % story['creation_date']) @@ -662,12 +663,27 @@ def write_analytics_story_confv1(stories, detections, investigations, baselines, data_models.append(dm) output_file.write("data_models = %s\n" % (json.dumps(sorted(set(data_models))))) - # generate providing tech + # generate providing_technologies from detections -daftpunk providing_technologies = [] for d in story['detections']: if 'providing_technologies' in detections[d['name']]: for pt in detections[d['name']]['providing_technologies']: providing_technologies.append(pt) + + # generate providing_technologies from investgationv1 -daftpunk + if story['spec_version'] == 1: + for d in story['investigations']: + if 'providing_technologies' in investigations[d['name']]: + for pt in investigations[d['name']]['providing_technologies']: + providing_technologies.append(pt) + output_file.write("providing_technologies = %s\n" % (json.dumps(sorted(set(providing_technologies))))) + + # generate providing_technologies from investgationv1 -daftpunk + if story['spec_version'] == 1: + for d in story['baselines']: + if 'providing_technologies' in baselines[d['name']]: + for pt in baselines[d['name']]['providing_technologies']: + providing_technologies.append(pt) output_file.write("providing_technologies = %s\n" % (json.dumps(sorted(set(providing_technologies))))) # REMOVE THIS FUNCTION MAKE SURE ALL DESCRIPTIONs ARE NATIVELY IN MARKDOWN diff --git a/detections/outlook_writing_zip.json b/detections/outlook_writing_zip.json index 5e65049a93..be6a7e9db0 100644 --- a/detections/outlook_writing_zip.json +++ b/detections/outlook_writing_zip.json @@ -53,7 +53,13 @@ ], "how_to_implement": "You must be ingesting data that records filesystem and process activity from your hosts to populate the Endpoint data model. This is typically populated via endpoint detection-and-response products, such as Carbon Black, or endpoint data sources, such as Sysmon.", "id": "a51bfe1a-94f0-4822-b1e4-16ae10145893", - "investigations": [], + "investigations": [ + { + "id": "fecf2918-670d-4f1c-872b-3d7317a41bf9", + "name": "Get Parent Process Info", + "product_type": "splunk" + } + ], "known_false_positives": "It is not uncommon for outlook to write legitimate zip files to the disk.", "maintainers": [ { diff --git a/src/default/analytic_stories.conf b/src/default/analytic_stories.conf index 93dee13a3f..3eee541f4c 100644 --- a/src/default/analytic_stories.conf +++ b/src/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2019-04-24T23:19:09 UTC +# On Date: 2019-04-25T01:09:04 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -19,7 +19,8 @@ mappings = {"mitre_attack": ["Credential Access"], "cis20": ["CIS 16"], "kill_ch investigative_searches = ["ESCU - AWS Investigate User Activities By AccessKeyId", "ESCU - AWS Investigate User Activities By Source User", "ESCU - Get Notable History"] support_searches = ["ESCU - Previously Seen AWS Cross Account Activity"] data_models = [] -providing_technologies = ["AWS"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ \ @@ -40,6 +41,7 @@ investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU support_searches = ["ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 AMIs", "ESCU - Previously Seen EC2 Instance Types", "ESCU - Previously Seen EC2 Launches By User"] data_models = [] providing_technologies = ["AWS"] +providing_technologies = ["AWS"] description = Monitor your AWS EC2 instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or EC2 instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ \ @@ -61,7 +63,8 @@ mappings = {"mitre_attack": ["Exfiltration", "Command and Control"], "cis20": [" investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - AWS Network ACL Details from ID", "ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table"] support_searches = ["ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS"] data_models = [] -providing_technologies = ["AWS"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -78,6 +81,7 @@ investigative_searches = ["ESCU - Get All AWS Activity From City", "ESCU - Get A support_searches = ["ESCU - Previously Seen AWS Provisioning Activity Sources"] data_models = [] providing_technologies = ["AWS"] +providing_technologies = ["AWS"] description = Monitor your AWS provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your network. narrative = Because most enterprise AWS activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to whitelist specific IPs (because they vary).\ \ @@ -95,7 +99,8 @@ mappings = {"mitre_attack": ["Credential Access", "Execution"], "kill_chain_phas investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Investigate AWS User Activities by user field"] support_searches = ["ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Previously seen API call per user roles in CloudTrail"] data_models = [] -providing_technologies = ["AWS"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ \ @@ -117,7 +122,8 @@ mappings = {"mitre_attack": ["Valid Accounts"], "cis20": ["CIS 16"], "nist": ["P investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Logon Rights Modifications For Endpoint", "ESCU - Get Logon Rights Modifications For User", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Change", "Change_Analysis", "Identity_Management"] -providing_technologies = ["Active Directory", "Microsoft Windows"] +providing_technologies = ["Active Directory", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "macOS"] +providing_technologies = ["Active Directory", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "macOS"] description = A common attack technique is to leverage user accounts to gain unauthorized access to the target's network. This Analytic Story minimizes opportunities for attack by helping you actively manage creation/use/dormancy/deletion--the lifecycle of system and application accounts. narrative = Monitoring user accounts within your enterprise is a critical analytic function that helps ensure that credential and access policies/procedures are properly implemented and are being enforced. Proactive ad-hoc hunting, as well as routine monitoring, can ensure user or system accounts are not being abused by unauthorized individuals or processes. In the event of a network event or breach, user-authentication logs are a key resource in determining if or how an account might have been compromised or co-opted, leading to suspicious or malicious activity. @@ -133,7 +139,8 @@ mappings = {"mitre_attack": ["Defense Evasion", "Exploitation of Vulnerability", investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Suspicious Strings in HTTP Header", "ESCU - Investigate Web POSTs From src"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Apache", "Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Splunk Stream", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Apache", "Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Apache", "Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ \ @@ -175,7 +182,8 @@ mappings = {"mitre_attack": ["Defense Evasion"], "cis20": ["CIS 1"], "kill_chain investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = ["ESCU - Count of assets by category"] data_models = ["Network_Sessions"] -providing_technologies = ["Bro", "Splunk Stream"] +providing_technologies = ["Bro", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "macOS"] +providing_technologies = ["Bro", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "macOS"] description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. narrative = This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets. @@ -191,7 +199,8 @@ mappings = {"mitre_attack": [], "cis20": ["CIS 7"], "kill_chain_phases": ["Deliv investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - DNSTwist Domain Names"] data_models = ["Email", "Network_Resolution", "Web"] -providing_technologies = ["Bluecoat", "Bro", "Microsoft Exchange", "Palo Alto Firewall", "Splunk Stream"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ \ @@ -211,7 +220,8 @@ mappings = {"mitre_attack": ["Collection"], "cis20": ["CIS 4", "CIS 8"], "kill_c investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Network Traffic From src_ip", "ESCU - Investigate Web Activity From src_ip"] support_searches = [] data_models = ["Alerts"] -providing_technologies = ["OSquery"] +providing_technologies = ["Bluecoat", "Bro", "Linux", "Microsoft Windows", "Nessus", "OSquery", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Linux", "Microsoft Windows", "Nessus", "OSquery", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "macOS"] description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more. narrative = Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before—a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\ \ @@ -231,7 +241,8 @@ mappings = {"mitre_attack": ["Collection", "Data Staged"], "cis20": ["CIS 8"], " investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Endpoint", "Network_Traffic"] -providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Splunk Stream", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ \ @@ -251,7 +262,8 @@ mappings = {"mitre_attack": ["Command and Control", "Commonly Used Port", "Exfil investigative_searches = ["ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS", "ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Network_Resolution", "Network_Traffic"] -providing_technologies = ["AWS", "Bro", "Palo Alto Firewall", "Splunk Stream"] +providing_technologies = ["AWS", "Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["AWS", "Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\ \ @@ -270,6 +282,7 @@ investigative_searches = ["ESCU - Get Certificate logs for a domain"] support_searches = [] data_models = ["Network_Resolution"] providing_technologies = ["Bro", "Splunk Stream"] +providing_technologies = ["Bro", "Splunk Stream"] description = Detect DNS and web requests to fake websites generated by the EvilGinx2 toolkit. These websites are designed to fool unwitting users who have clicked on a malicious link in a phishing email. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as 91% of all successful attacks are initiated via a phishing email (see https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing).\ \ @@ -289,7 +302,8 @@ mappings = {"mitre_attack": ["Credential Access", "Credential Dumping"], "cis20" investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Microsoft Windows", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attmpts to dump credentials. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ \ @@ -309,7 +323,8 @@ mappings = {"mitre_attack": ["Defense Evasion", "Modify Registry", "Disabling Se investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Endpoint", "Network_Traffic"] -providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Microsoft Windows", "Splunk Stream", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ \ @@ -331,7 +346,8 @@ mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Obj investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User"] support_searches = [] data_models = ["Network_Resolution"] -providing_technologies = ["Bro", "Splunk Stream"] +providing_technologies = ["Bro", "Splunk Enterprise Security", "Splunk Stream"] +providing_technologies = ["Bro", "Splunk Enterprise Security", "Splunk Stream"] description = DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims. narrative = The Domain Name System (DNS) is the protocol used to map domain names to IP addresses. It has been proven to work very well for its intended function. However if DNS is misconfigured, servers can be abused by attackers to levy amplification or redirection attacks against victims. Because DNS responses to `ANY` queries are so much larger than the queries themselves--and can be made with a UDP packet, which does not require a handshake--attackers can spoof the source address of the packet and cause much more data to be sent to the victim than if they sent the traffic themselves. The `ANY` requests are will be larger than normal DNS server requests, due to the fact that the server provides significant details, such as MX records and associated IP addresses. A large volume of this traffic can result in a DOS on the victim's machine. This misconfiguration leads to two possible victims, the first being the DNS servers participating in an attack and the other being the hosts that are the targets of the DOS attack.\ \ @@ -350,6 +366,7 @@ investigative_searches = ["ESCU - Get DNS Server History for a host"] support_searches = ["ESCU - Discover DNS records"] data_models = ["Network_Resolution"] providing_technologies = ["Bro", "Splunk Stream"] +providing_technologies = ["Bro", "Splunk Stream"] description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\ \ @@ -381,7 +398,8 @@ mappings = {"mitre_attack": ["Command and Control", "Exfiltration", "Commonly Us investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Change_Analysis", "Network_Resolution"] -providing_technologies = ["Bro", "Microsoft Windows", "Splunk Stream"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -397,7 +415,8 @@ mappings = {"mitre_attack": ["Defense Evasion", "Modify Registry", "Disabling Se investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Previously Seen Running Windows Services"] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a blacklist (which would prevent them from running). @@ -413,7 +432,8 @@ mappings = {"mitre_attack": ["Command and Control", "Web Service", "Exfiltration investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From src_ip"] support_searches = [] data_models = ["Network_Resolution", "Web"] -providing_technologies = ["Bluecoat", "Bro", "Palo Alto Firewall", "Splunk Stream"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and blacklists. narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and blacklists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified. @@ -429,7 +449,8 @@ mappings = {"mitre_attack": ["Execution", "Defense Evasion"], "cis20": ["CIS 3", investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Email", "Endpoint", "Network_Traffic"] -providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Microsoft Exchange", "Splunk Stream", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \ \ @@ -449,7 +470,8 @@ mappings = {"mitre_attack": [], "cis20": ["CIS 8"], "kill_chain_phases": ["Actio investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Previously seen command line arguments", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"] -providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Splunk Stream", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Exchange", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ \ @@ -471,7 +493,8 @@ mappings = {"mitre_attack": ["Command and Control", "Exfiltration"], "cis20": [" investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect evidence of tactics used to redirect traffic from a host to a destination other than the one intended--potentially one that is part of an adversary's attack infrastructure. An example is redirecting communications regarding patches and updates or misleading users into visiting a malicious website. narrative = Attackers will often attempt to manipulate client communications for nefarious purposes. In some cases, an attacker may endeavor to modify a local host file to redirect communications with resources (such as antivirus or system-update services) to prevent clients from receiving patches or updates. In other cases, an attacker might use this tactic to have the client connect to a site that looks like the intended site, but instead installs malware or collects information from the victim. Additionally, an attacker may redirect a victim in order to execute a MITM attack and observe communications. @@ -487,7 +510,8 @@ mappings = {"mitre_attack": ["Defense Evasion", "Exploitation of Vulnerability"] investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Web"] -providing_technologies = ["Apache", "Bro", "Palo Alto Firewall", "Splunk Stream"] +providing_technologies = ["Apache", "Bro", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "macOS"] +providing_technologies = ["Apache", "Bro", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "macOS"] description = In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others. narrative = This Analytic Story looks for probing and exploitation attempts targeting JBoss application servers. While the vulnerabilities associated with this story are rather dated, they were leveraged in a spring 2016 campaign in connection with the Samsam ransomware variant. Incidents involving this ransomware are unique, in that they begin with attacks against vulnerable services, rather than the phishing or drive-by attacks more common with ransomware. In this case, vulnerable JBoss applications appear to be the target of choice.\ \ @@ -531,7 +555,8 @@ mappings = {"mitre_attack": ["Persistence", "Lateral Movement", "Execution", "Sc investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Identify Systems Creating Remote Desktop Traffic", "ESCU - Identify Systems Receiving Remote Desktop Traffic", "ESCU - Identify Systems Using Remote Desktop", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Endpoint", "Network_Traffic"] -providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Microsoft Windows", "Splunk Stream", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ \ @@ -555,7 +580,8 @@ mappings = {"mitre_attack": ["Execution", "PowerShell", "Scripting"], "cis20": [ investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = ["ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope.\ \ @@ -589,7 +615,8 @@ mappings = {"cis20": ["CIS 10"], "nist": ["PR.IP"]} investigative_searches = ["ESCU - All backup logs for host", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User"] support_searches = ["ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups"] data_models = [] -providing_technologies = ["Netbackup"] +providing_technologies = ["Netbackup", "Splunk Enterprise Security"] +providing_technologies = ["Netbackup", "Splunk Enterprise Security"] description = Address common concerns when monitoring your backup processes. These searches can help you reduce risks from ransomware, device theft, or denial of physical access to a host by backing up data on endpoints. narrative = Having backups is a standard best practice that helps ensure continuity of business operations. Having mature backup processes can also help you reduce the risks of many security-related incidents and streamline your response processes. The detection searches in this Analytic Story will help you identify systems that have backup failures, as well as systems that have not been backed up for an extended period of time. The story will also return the notable event history and all of the backup logs for an endpoint. @@ -605,7 +632,8 @@ mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 2"], "kill_chain_phase investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Identify and investigate prohibited/unauthorized software or processes that may be concealing malicious behavior within your environment. narrative = It is critical to identify unauthorized software and processes running on enterprise endpoints and determine whether they are likely to be malicious. This Analytic Story requires the user to populate the Interesting Processes table within Enterprise Security with prohibited processes. An included support search will augment this data, adding information on processes thought to be malicious. This search requires data from endpoint detection-and-response solutions, endpoint data sources (such as Sysmon), or Windows Event Logs--assuming that the Active Directory administrator has enabled process tracking within the System Event Audit Logs.\ \ @@ -623,7 +651,8 @@ mappings = {"cis20": ["CIS 18"], "nist": ["PR.PT", "PR.MA"]} investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Updates"] -providing_technologies = ["Microsoft Windows"] +providing_technologies = ["Linux", "Microsoft Windows", "Splunk Enterprise Security", "macOS"] +providing_technologies = ["Linux", "Microsoft Windows", "Splunk Enterprise Security", "macOS"] description = Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches. narrative = It is a common best practice to ensure that endpoints are being patched and updated in a timely manner, in order to reduce the risk of compromise via a publicly disclosed vulnerability. Timely application of updates/patches is important to eliminate known vulnerabilities that may be exploited by various threat actors.\ \ @@ -643,7 +672,8 @@ mappings = {"mitre_attack": ["Execution", "Command-Line Interface", "Persistence investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\ \ @@ -661,7 +691,8 @@ mappings = {"mitre_attack": ["Persistence", "Privilege Escalation", "New Service investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Previously Seen Running Windows Services", "ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Microsoft Windows", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ \ @@ -682,10 +713,11 @@ version = 1.0 reference = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] detection_searches = ["ESCU - Detect Oulook.exe writing a .zip file - Rule", "ESCU - Suspicious LNK file launching a process - Rule"] mappings = {"mitre_attack": ["Spearphishing Attachment"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "nist": ["ID.AM", "PR.DS"]} -investigative_searches = [] +investigative_searches = ["ESCU - Get Parent Process Info"] support_searches = [] data_models = ["Endpoint"] providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as 91% of all successful attacks (see https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ \ @@ -715,7 +747,8 @@ mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phase investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ \ @@ -785,7 +818,8 @@ mappings = {"mitre_attack": ["Command and Control", "Commonly Used Port", "Exfil investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get Notable History", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Count of Unique IPs Connecting to Ports", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Network_Resolution", "Network_Traffic"] -providing_technologies = ["Bro", "Palo Alto Firewall", "Splunk Stream"] +providing_technologies = ["Bluecoat", "Bro", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "macOS"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -801,7 +835,8 @@ mappings = {"mitre_attack": ["Defense Evasion", "Indicator Removal on Host"], "c investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Endpoint", "Network_Traffic"] -providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Microsoft Windows", "Palo Alto Firewall", "Splunk Stream", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -817,7 +852,8 @@ mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Authentication"] -providing_technologies = ["Active Directory", "Palo Alto Firewall"] +providing_technologies = ["Active Directory", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "macOS"] +providing_technologies = ["Active Directory", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "macOS"] description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\ \ @@ -835,7 +871,8 @@ mappings = {"mitre_attack": ["Defense Evasion", "Exploitation of Vulnerability", investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Web"] -providing_technologies = ["Bro", "Splunk Stream"] +providing_technologies = ["Bro", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "macOS"] +providing_technologies = ["Bro", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "macOS"] description = Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters. narrative = It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\ \ @@ -853,7 +890,8 @@ mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phase investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Backup Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Update Logs For Endpoint", "ESCU - Get User Information from Identity Table", "ESCU - Get Vulnerability Logs For Endpoint", "ESCU - Investigate Successful Remote Desktop Authentications", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Monitor Successful Backups", "ESCU - Monitor Unsuccessful Backups", "ESCU - Windows Updates Install Failures", "ESCU - Windows Updates Install Successes"] data_models = ["Endpoint", "Network_Traffic", "Web"] -providing_technologies = ["Apache", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Palo Alto Firewall", "Splunk Stream", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Apache", "Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Apache", "Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Netbackup", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ \ @@ -879,7 +917,8 @@ mappings = {"cis20": ["CIS 4"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]} investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = ["ESCU - Systems Ready for Spectre-Meltdown Windows Patch"] data_models = ["Vulnerabilities"] -providing_technologies = ["Nessus", "Qualys"] +providing_technologies = ["Linux", "Microsoft Windows", "Nessus", "Qualys", "Splunk Enterprise Security", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Nessus", "Qualys", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Assess and mitigate your systems' vulnerability to Spectre and Meltdown exploitation with the searches in this Analytic Story. narrative = Meltdown and Spectre exploit critical vulnerabilities in modern CPUs that allow unintended access to data in memory. This Analytic Story will help you identify the systems can be patched for these vulnerabilities, as well as those that still need to be patched. @@ -895,7 +934,8 @@ mappings = {"mitre_attack": ["Defense Evasion", "Exploitation of Vulnerability"] investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = [] -providing_technologies = ["Splunk Enterprise"] +providing_technologies = ["Linux", "Microsoft Windows", "Splunk Enterprise", "Splunk Enterprise Security", "macOS"] +providing_technologies = ["Linux", "Microsoft Windows", "Splunk Enterprise", "Splunk Enterprise Security", "macOS"] description = Keeping your Splunk deployment up to date is critical and may help you reduce the risk of CVE-2016-4859, an open-redirection vulnerability within some older versions of Splunk Enterprise. The detection search will help ensure that users are being properly authenticated and not being redirected to malicious domains. narrative = This Analytic Story is associated with CVE-2016-4859, an open-redirect vulnerability in the following versions of Splunk Enterprise:\ \ @@ -929,7 +969,8 @@ mappings = {"mitre_attack": ["Defense Evasion", "Exploitation of Vulnerability"] investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Investigate Network Traffic From src_ip", "ESCU - Investigate Web Activity From src_ip"] support_searches = [] data_models = [] -providing_technologies = ["Splunk Enterprise"] +providing_technologies = ["Bluecoat", "Bro", "Palo Alto Firewall", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Stream"] +providing_technologies = ["Bluecoat", "Bro", "Palo Alto Firewall", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Stream"] description = Reduce the risk of CVE-2018-11409, an information disclosure vulnerability within some older versions of Splunk Enterprise, with searches designed to help ensure that your Splunk system does not leak information to authenticated users. narrative = Although there have been no reports of it being exploited, Splunk Enterprise versions through 7.0.1 reportedly have a vulnerability that may expose information through a REST endpoint (read more here: https://www.splunk.com/view/SP-CAAAP5E#VulnerabilityDescriptionsandRatings). NIST has included it in its vulnerability database (read more here: https://nvd.nist.gov/vuln/detail/CVE-2018-11409). The REST endpoint that exposes system information is also necessary for the proper operation of Splunk clustering and instrumentation. Customers should upgrade to the latest version to reduce the risk of this vulnerability.\ \ @@ -951,7 +992,8 @@ mappings = {"mitre_attack": ["Defense Evasion"], "cis20": ["CIS 1"], "kill_chain investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate AWS activities via region name"] support_searches = ["ESCU - Previously Seen AWS Regions", "ESCU - Previously Seen EC2 Launches By User"] data_models = [] -providing_technologies = ["AWS"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] description = Use the searches in this Analytic Story to monitor your AWS EC2 instances for evidence of anomalous activity and suspicious behaviors, such as EC2 instances that originate from unusual locations or those launched by previously unseen users (among others). Included investigative searches will help you probe more deeply, when the information warrants it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and risk auditing within your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Console, AWS command-line interface, and AWS SDKs and APIs to ensure that your EC2 instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your AWS EC2 instances and helps you respond and investigate those activities. @@ -967,7 +1009,8 @@ mappings = {"mitre_attack": ["Credential Access"], "cis20": ["CIS 16"], "kill_ch investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table"] support_searches = ["ESCU - Previously seen users in CloudTrail"] data_models = [] -providing_technologies = ["AWS"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -983,7 +1026,8 @@ mappings = {"mitre_attack": ["Credential Access", "Execution"], "cis20": ["CIS 1 investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - AWS S3 Bucket details via bucketName", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get User Information from Identity Table", "ESCU - Investigate AWS activities via region name"] support_searches = ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"] data_models = [] -providing_technologies = ["AWS"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ \ @@ -1003,7 +1047,8 @@ mappings = {"mitre_attack": ["Exfiltration", "Command and Control"], "cis20": [" investigative_searches = ["ESCU - AWS Network Interface details via resourceId", "ESCU - Get All AWS Activity From IP Address", "ESCU - Get Notable History", "ESCU - Get Notable Info"] support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"] data_models = [] -providing_technologies = ["AWS"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ \ @@ -1025,7 +1070,8 @@ mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phase investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"] support_searches = ["ESCU - Previously seen command line arguments"] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. @@ -1041,7 +1087,8 @@ mappings = {"mitre_attack": ["Exfiltration", "Exfiltration Over Alternative Prot investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get DNS Server History for a host", "ESCU - Get DNS traffic ratio", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process responsible for the DNS traffic", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Network_Resolution"] -providing_technologies = ["Bro", "Splunk Stream"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -1057,7 +1104,8 @@ mappings = {"mitre_attack": ["Execution", "Defense Evasion"], "cis20": ["CIS 3", investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Email Info", "ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"] support_searches = [] data_models = ["Email"] -providing_technologies = ["Microsoft Exchange"] +providing_technologies = ["Bluecoat", "Bro", "Linux", "Microsoft Exchange", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Linux", "Microsoft Exchange", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "macOS"] description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\ \ @@ -1081,7 +1129,8 @@ mappings = {"mitre_attack": ["Persistence", "Registry Run Keys / Start Folder", investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative = One common adversary tactic is to bypass application white-listing solutions via the mshta.exe process, which executes Microsoft HTML applications with the .hta suffix. In these cases, attackers use the trusted Windows utility to eproxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ \ @@ -1101,7 +1150,8 @@ mappings = {"mitre_attack": ["Execution", "Windows Management Instrumentation", investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get Sysmon WMI Activity for Host", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Microsoft Windows", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. \ \ @@ -1121,7 +1171,8 @@ mappings = {"mitre_attack": ["Persistence", "Change Default File Association"], investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Registry Activities", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Change_Analysis", "Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ \ @@ -1141,7 +1192,8 @@ mappings = {"cis20": ["CIS 1"], "nist": ["ID.AM"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN", "ESCU - Get EC2 Instance Details by instanceId", "ESCU - Get Notable History"] support_searches = ["ESCU - Previously Seen EC2 Modifications By User"] data_models = [] -providing_technologies = ["AWS"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] +providing_technologies = ["AWS", "Splunk Enterprise Security"] description = Identify unusual changes to your AWS EC2 instances that may indicate malicious activity. Modifications to your EC2 instances by previously unseen users is an example of an activity that may warrant further investigation. narrative = A common attack technique is to infiltrate a cloud instance and make modifications. The adversary can then secure access to your infrastructure or hide their activities. So it's important to stay alert to changes that may indicate that your environment has been compromised. \ \ @@ -1159,7 +1211,8 @@ mappings = {"mitre_attack": ["Execution"], "cis20": ["CIS 8"], "kill_chain_phase investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table", "ESCU - Investigate Web Activity From Host"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Bluecoat", "Bro", "Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream", "Sysmon", "Tanium", "Ziften", "macOS"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ \ @@ -1179,7 +1232,8 @@ mappings = {"mitre_attack": ["Credential Access", "Lateral Movement", "Collectio investigative_searches = ["ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Information For Port Activity", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Network_Traffic"] -providing_technologies = ["Bro", "Splunk Stream"] +providing_technologies = ["Bluecoat", "Bro", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream"] +providing_technologies = ["Bluecoat", "Bro", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream"] description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems. @@ -1195,7 +1249,8 @@ mappings = {"mitre_attack": ["Valid Accounts"], "cis20": ["CIS 16"], "kill_chain investigative_searches = ["ESCU - Get Emails From Specific Sender", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Web Session Information via session_id"] support_searches = [] data_models = [] -providing_technologies = ["Bro", "Palo Alto Firewall", "Splunk Stream"] +providing_technologies = ["Bro", "Microsoft Exchange", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream"] +providing_technologies = ["Bro", "Microsoft Exchange", "Palo Alto Firewall", "Splunk Enterprise Security", "Splunk Stream"] description = Monitor your environment for activity consistent with common attack techniques bad actors use when attempting to compromise web servers or other web-related assets. narrative = The Federal Bureau of Investigations (FBI) defines Internet fraud as the use of Internet services or software with Internet access to defraud victims or to otherwise take advantage of them. According to the Bureau, Internet crime schemes are used to steal millions of dollars each year from victims and continue to plague the Internet through various methods. The agency includes phishing scams, data breaches, Denial of Service (DOS) attacks, email account compromise, malware, spoofing, and ransomware in this category.\ \ @@ -1221,7 +1276,8 @@ mappings = {"mitre_attack": ["Defense Evasion", "Modify Registry", "Disabling Se investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1237,7 +1293,8 @@ mappings = {"mitre_attack": ["Persistence", "Change Default File Association"], investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \ \ @@ -1261,7 +1318,8 @@ mappings = {"mitre_attack": ["Defense Evasion", "Indicator Removal on Host"], "c investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Microsoft Windows", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\ \ @@ -1279,7 +1337,8 @@ mappings = {"mitre_attack": ["Persistence", "Application Shimming"], "cis20": [" investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = ["ESCU - Previously Seen Running Windows Services"] data_models = ["Change_Analysis", "Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1295,7 +1354,8 @@ mappings = {"mitre_attack": ["Execution", "Accessibility Features"], "cis20": [" investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = [] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1311,7 +1371,8 @@ mappings = {"mitre_attack": ["Persistence", "Privilege Escalation", "New Service investigative_searches = ["ESCU - Get Authentication Logs For Endpoint", "ESCU - Get Notable History", "ESCU - Get Notable Info", "ESCU - Get Parent Process Info", "ESCU - Get Process Info", "ESCU - Get Risk Modifiers For Endpoint", "ESCU - Get Risk Modifiers For User", "ESCU - Get User Information from Identity Table"] support_searches = ["ESCU - Previously Seen Running Windows Services"] data_models = ["Endpoint"] -providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Microsoft Windows", "Sysmon", "Tanium", "Ziften"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] +providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Linux", "Microsoft Windows", "Splunk Enterprise Security", "Sysmon", "Tanium", "Ziften", "macOS"] description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection. diff --git a/src/default/savedsearches.conf b/src/default/savedsearches.conf index 93c19b803a..861a60c983 100644 --- a/src/default/savedsearches.conf +++ b/src/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2019-04-24T23:19:09 UTC +# On Date: 2019-04-25T01:09:04 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -2033,7 +2033,7 @@ action.notable.param.rule_title = Oulook.exe is writing a zip file $file_name$ o action.notable.param.security_domain = network action.notable.param.severity = high action.notable.param.recommended_actions = escu_investigate -action.notable.param.next_steps = +action.notable.param.next_steps = {"version": 1, "data": "Recommended following steps:\n\n1. [[action|escu_investigate]]: Based on ESCU investigate recommendations:\nESCU - Get Parent Process Info\n"} action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system @@ -8967,7 +8967,7 @@ action.escu.full_search_name = ESCU - Get Parent Process Info description = This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. Enter the values of the process name in question and the dest action.escu.creation_date = 2017-08-22 action.escu.modification_date = 2019-02-28 -action.escu.analytic_story = ["Collection and Staging", "Command and Control", "Credential Dumping", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "JBoss Vulnerability", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"] +action.escu.analytic_story = ["Collection and Staging", "Command and Control", "Credential Dumping", "DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware (TA18-201A)", "Hidden Cobra Malware", "JBoss Vulnerability", "Lateral Movement", "Malicious PowerShell", "Monitor for Unauthorized Software", "Netsh Abuse", "Orangeworm Attack Group", "Phishing Payloads", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "SamSam Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Windows Registry Activities", "Unusual Processes", "Windows Defense Evasion Tactics", "Windows File Extension and Association Abuse", "Windows Persistence Techniques", "Windows Privilege Escalation", "Windows Service Abuse"] action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 action.escu.providing_technologies = ["Carbon Black Response", "CrowdStrike Falcon", "Sysmon", "Tanium", "Ziften"] diff --git a/src/default/use_case_library.conf b/src/default/use_case_library.conf index 3062c83bd8..5cf820cec7 100644 --- a/src/default/use_case_library.conf +++ b/src/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security-content -# On Date: 2019-04-24T23:19:09 UTC +# On Date: 2019-04-25T01:09:04 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -525,7 +525,7 @@ version = 1.0 reference = ["https://www.fireeye.com/blog/threat-research/2019/04/spear-phishing-campaign-targets-ukraine-government.html"] maintainers = [{"company": "Splunk", "email": "research@splunk.com", "name": "Splunk Research Team"}] spec_version = 2 -searches = ["ESCU - Detect Oulook.exe writing a .zip file - Rule", "ESCU - Suspicious LNK file launching a process - Rule"] +searches = ["ESCU - Detect Oulook.exe writing a .zip file - Rule", "ESCU - Suspicious LNK file launching a process - Rule", "ESCU - Get Parent Process Info"] description = Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative = Despite its simplicity, phishing remains the most pervasive and dangerous cyberthreat. In fact, research shows that as many as 91% of all successful attacks (see https://digitalguardian.com/blog/91-percent-cyber-attacks-start-phishing-email-heres-how-protect-against-phishing) are initiated via a phishing email. \ \