admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'The-Haag-of-The-Storm' of https://github.com/splunk/security_content into The-Haag-of-The-Storm

Browse Source
This commit is contained in:
Detection Testing Service
2021-09-16 17:07:21 +00:00
parent 6c467dbb80 c22058ceb4
commit 644e571292
3 changed files with 23 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml
+9 -4
View File
@@ -10,10 +10,15 @@ description: This search looks for the creation or deletion of hidden shares usi
net.exe.
search: '| tstats `security_content_summariesonly` count values(Processes.user) as
user values(Processes.parent_process) as parent_process min(_time) as firstTime
max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by Processes.process Processes.process_name Processes.original_file_name
Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`|
`security_content_ctime(lastTime)` | search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
max(_time) as lastTime from datamodel=Endpoint.Processes where `process_net` by
Processes.process Processes.process_name Processes.original_file_name Processes.dest
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
| search process=*share* | `create_or_delete_windows_shares_using_net_exe_filter` '
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrators often leverage net.exe to create or delete network
shares. You should verify that the activity was intentional and is legitimate.
references:
detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml
+8 -4
View File
@@ -9,11 +9,15 @@ datamodel:
description: This search detects the use of wmic and Powershell to create a shadow
copy.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where `process_wmic`
OR `process_powershell` Processes.process=*shadowcopy* Processes.process=*create*
by Processes.user Processes.process_name Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
as lastTime from datamodel=Endpoint.Processes where `process_wmic` OR `process_powershell`
Processes.process=*shadowcopy* Processes.process=*create* by Processes.user Processes.process_name
Processes.original_file_name Processes.process Processes.dest | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `creation_of_shadow_copy_with_wmic_and_powershell_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Legtimate administrator usage of wmic to create a shadow copy.
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml
+6 -9
View File
@@ -1,22 +1,19 @@
name: Credential Dumping via Symlink to Shadow Copy
id: c5eac648-fae0-4263-91a6-773df1f4c903
version: 1
date: '2019-12-10'
version: 2
date: '2021-09-16'
author: Patrick Bareiss, Splunk
type: TTP
datamodel:
- Endpoint
description: This search detects the creation of a symlink to a shadow copy.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe
as lastTime from datamodel=Endpoint.Processes where `process_cmd`
Processes.process=*mklink* Processes.process=*HarddiskVolumeShadowCopy* by Processes.dest
Processes.user Processes.process_name Processes.process Processes.parent_process
Processes.user Processes.process_name Processes.process Processes.parent_process Processes.original_file_name
Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter` '
how_to_implement: You must be ingesting endpoint data that tracks process activity,
including parent-child relationships from your endpoints to populate the Endpoint
data model in the Processes node. The command-line arguments are mapped to the "process"
field in the Endpoint data model.
| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `credential_dumping_via_symlink_to_shadow_copy_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: unknown
references:
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf