admin/splunk-security_content
1
0
Fork 0
mirror of https://github.com/splunk/security_content synced 2026-06-08 17:32:49 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge branch 'TR_2329_AWS_Credential_Access' of github.com:splunk/security_content into TR_2329_AWS_Credential_Access

Browse Source
This commit is contained in:
patel-bhavin
2022-08-12 12:41:19 -07:00
parent 24cd1afcb8 9379ece487
commit 6969671bf9
79 changed files with 1038 additions and 115 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bin/contentctl_project/contentctl_core/domain/entities/detection_tags.py
+1
View File
@@ -37,6 +37,7 @@ class DetectionTags(BaseModel):
risk_level: str = None
observable_str: str = None
kill_chain_phases_id: list = None
research_site_url: str = None
@validator('cis20')
bin/contentctl_project/contentctl_infrastructure/adapter/obj_to_yml_adapter.py
+8 -2
View File
@@ -14,6 +14,7 @@ class ObjToYmlAdapter(Adapter):
def writeObjectsInPlace(self, objects: list) -> None:
for object in objects:
file_path = object['file_path']
object.pop('file_path')
object.pop('deprecated')
@@ -28,6 +29,11 @@ class ObjToYmlAdapter(Adapter):
file_path = os.path.join(output_path, 'complex', file_name)
else:
file_path = os.path.join(output_path, 'srs', file_name)
# add research object
RESEARCH_SITE_BASE = 'https://research.splunk.com/'
research_site_url = RESEARCH_SITE_BASE + obj.source + "/" + obj.id + "/"
obj.tags.research_site_url = research_site_url
body = FindingReportObject.writeFindingReport(obj)
@@ -53,7 +59,8 @@ class ObjToYmlAdapter(Adapter):
"risk_severity": True,
"risk_score": True,
"security_domain": True,
"required_fields": True
"required_fields": True,
"research_site_url": True
},
"test":
{
@@ -86,7 +93,6 @@ class ObjToYmlAdapter(Adapter):
f.write(data)
f.close()
def writeObjectNewContent(self, object: dict, type: SecurityContentType) -> None:
if type == SecurityContentType.detections:
file_path = os.path.join(self.input_path, 'detections', object['source'], self.convertNameToFileName(object['name'],object['tags']['product']))
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data/srs/ssa___anomalous_usage_of_archive_tools.yml
+1
View File
@@ -53,6 +53,7 @@ tags:
risk_score: 42
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/
test:
name: Anomalous usage of Archive Tools Unit Test
tests:
bin/contentctl_project/contentctl_infrastructure/tests/adapter/obj_to_yml_data_ref/srs/ssa___anomalous_usage_of_archive_tools.yml
+1
View File
@@ -53,6 +53,7 @@ tags:
risk_score: 42
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/obj_to_yml_data/63614a58-10e2-4c6c-ae81-ea1113681439/
test:
name: Anomalous usage of Archive Tools Unit Test
tests:
detections/cloud/aws_credential_access_getpassworddata.yml
+2 -2
View File
@@ -6,7 +6,7 @@ author: Bhavin Patel, Splunk
type: Anomaly
datamodel: []
description: This detection analytic identifies more than 10 GetPasswordData API calls made to your AWS account with a time window of 5 minutes. Attackers can retrieve the encrypted administrator password for a running Windows instance.
search: '| `cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time
search: '`cloudtrail` eventName=GetPasswordData eventSource = ec2.amazonaws.com | bin _time span=5m | stats count values(errorCode) as errorCode dc(requestParameters.instanceId) as distinct_instance_ids values(requestParameters.instanceId) as instance_ids by aws_account_id src_ip user_arn userAgent eventName _time
| where distinct_instance_ids > 10 | `aws_credential_access_getpassworddata_filter`'
how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. We encourage the users to adjust the values of `distinct_instance_ids` and tweak the `span` value according to their environment.
known_false_positives: Administrator tooling or automated scripts may make these calls but it is highly unlikely to make several calls in a short period of time.
@@ -57,4 +57,4 @@ tags:
- sourceIPAddress
- awsRegion
risk_score: 49
security_domain: threat
security_domain: threat
detections/endpoint/linux_awk_privilege_escalation.yml
+68
View File
@@ -0,0 +1,68 @@
name: Linux AWK Privilege Escalation
id: 4510cae0-96a2-4840-9919-91d262db210a
version: 1
date: '2022-07-31'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: Awk is mostly used for processing and scanning patterns.
It checks one or more files to determine whether any lines fit the specified patterns,
and if so, it does the appropriate action. If sudo right is given to AWK binary for the user, then the user
can run system commands as root and possibly get a root shell.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*" AND Processes.process="*awk*" AND Processes.process="*BEGIN*system*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `linux_awk_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
- https://www.hacknos.com/awk-privilege-escalation/
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log
impact: 80
kill_chain_phases:
- Exploitation
message: A commandline $process$ with process $process_name$ on $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 72
security_domain: endpoint
detections/endpoint/linux_curl_upload_file.yml
+81
View File
@@ -0,0 +1,81 @@
name: Linux Curl Upload File
id: c1de2d9a-0c02-4bb4-a49a-510c6e9cf2bf
version: 1
date: '2022-07-29'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies curl being utilized with the -F or --form, --upload-file, -T, -d, --data, --data-raw, -I and --head switches to upload AWS credentials or config to a remote destination.
This enables uploading of binary files and so forth. To force the 'content' part to be a file, prefix the file name with an @ sign. To just get the content part from a file, prefix the file name with the symbol <. The difference between @ and < is then that @ makes a file get attached in the post as a file upload, while the < makes a text field and just get the contents for that text field from a file.
This technique was utlized by the TeamTNT group to exfiltrate AWS credentials.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
Processes.process IN ("*-F *", "*--form *","*--upload-file *","*-T *","*-d *","*--data *","*--data-raw *", "*-I *", "*--head *") AND Processes.process IN ("*.aws/credentials*". "*.aws/config*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_curl_upload_file_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: Filtering may be required. In addition to AWS credentials, add other important files and monitor. The inverse would be to look for _all_ -F behavior and tune from there.
references:
- https://curl.se/docs/manpage.html
- https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/
- https://gtfobins.github.io/gtfobins/curl/
tags:
analytic_story:
- Linux Living Off The Land
- Data Exfiltration
- Ingress Tool Transfer
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 80
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
impact: 80
kill_chain_phases:
- Actions on Objectives
message: An instance of $process_name$ was identified on endpoint $dest$ by user $user$ attempting to upload important files to a remote destination.
mitre_attack_id:
- T1105
nist:
- DE.CM
observable:
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 64
security_domain: endpoint
detections/endpoint/linux_docker_privilege_escalation.yml
+68
View File
@@ -0,0 +1,68 @@
name: Linux Docker Privilege Escalation
id: 2e7bfb78-85f6-47b5-bc2f-15813a4ef2b3
version: 1
date: '2022-07-31'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: Docker is an open source containerization platform. It helps programmers to bundle applications into containers,
which are standardized executable parts that include the application source code along with the OS libraries and dependencies needed to run
that code in any setting. The user can add mount the root directory into a container and edit the /etc/password file to add a super user.
This requires the user to be privileged enough to run docker, i.e. being in the docker group or being root.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process IN("*docker*-v*/*:*","*docker*--volume*/*:*") OR Processes.process IN("*docker*exec*sh*","*docker*exec*bash*") by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_docker_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
- https://gtfobins.github.io/gtfobins/docker/
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 30
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log
impact: 80
kill_chain_phases:
- Exploitation
message: A commandline $process$ with process $process_name$ on $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 24
security_domain: endpoint
detections/endpoint/linux_ingress_tool_transfer_hunting.yml
+80
View File
@@ -0,0 +1,80 @@
name: Linux Ingress Tool Transfer Hunting
id: 52fd468b-cb6d-48f5-b16a-92f1c9bb10cf
version: 1
date: '2022-07-29'
author: Michael Haag, Splunk
type: Hunting
datamodel:
- Endpoint
description: The following analytic hunts for curl and wget being utilized in the environment. This is meant to help with identifying normal usage and potentially malicious. Utilize this query to tune other curl and wget analytics.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=curl OR Processes.process_name=wget) by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `linux_ingress_tool_transfer_hunting_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives will be present. This query is meant to help tune other curl and wget analytics.
references:
- https://gtfobins.github.io/gtfobins/curl/
- https://curl.se/docs/manpage.html#-I
- https://gtfobins.github.io/gtfobins/curl/
- https://github.com/rapid7/metasploit-framework/search?q=curl
tags:
analytic_story:
- Linux Living Off The Land
- Ingress Tool Transfer
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 10
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
impact: 10
kill_chain_phases:
- Delivery
- Installation
- Actions on Objectives
message: An instance of $process_name$ was identified
on endpoint $dest$ by user $user$ utilizing curl or wget.
mitre_attack_id:
- T1105
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 1
security_domain: endpoint
detections/endpoint/linux_ingress_tool_transfer_with_curl.yml
+82
View File
@@ -0,0 +1,82 @@
name: Linux Ingress Tool Transfer with Curl
id: 8c1de57d-abc1-4b41-a727-a7a8fc5e0857
version: 1
date: '2022-07-29'
author: Michael Haag, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The following analytic identifies curl with the command-line switches that are commonly used to download, output, a remote script or binary.
MetaSploit Framework will combine the -sO switch with | chmod +x to enable a simple one liner to download and set the execute bit to run the file immediately.
During triage, review the remote domain and file being downloaded for legitimacy.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| where match(process, "(?i)(-O|-sO|-ksO|--output)")
| `linux_ingress_tool_transfer_with_curl_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives will be present. Tune and then change type to TTP.
references:
- https://gtfobins.github.io/gtfobins/curl/
- https://curl.se/docs/manpage.html#-I
- https://gtfobins.github.io/gtfobins/curl/
- https://github.com/rapid7/metasploit-framework/search?q=curl
tags:
analytic_story:
- Linux Living Off The Land
- Ingress Tool Transfer
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 30
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
impact: 40
kill_chain_phases:
- Delivery
message: An instance of $process_name$ was identified
on endpoint $dest$ by user $user$ to download a remote file. Review activity for further details.
mitre_attack_id:
- T1105
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 12
security_domain: endpoint
detections/endpoint/linux_node_privilege_escalation.yml
+68
View File
@@ -0,0 +1,68 @@
name: Linux Node Privilege Escalation
id: 2e58a4ff-398f-42f4-8fd0-e01ebfe2a8ce
version: 1
date: '2022-07-31'
author: Gowthamaraj Rajendran, Splunk
type: Anomaly
datamodel:
- Endpoint
description: Node.js is a back-end JavaScript runtime environment that is open-source, cross-platform, runs on the V8 engine,
and executes JavaScript code outside of a web browser. It was created to help create scalable network applications.
If the binary is allowed to run as superuser by sudo, it does not drop the elevated privileges and may be used to access the file system,
escalate or maintain privileged access.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process="*sudo*node*" AND Processes.process="*-e*" AND Processes.process="*child_process.spawn*" AND Processes.process="*stdio*" by Processes.dest Processes.user Processes.parent_process_name
Processes.process_name Processes.process Processes.process_id Processes.parent_process_id
Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_node_privilege_escalation_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you can use the Add-on for Linux Sysmon from
Splunkbase.
known_false_positives: False positives are present based on automated tooling or system administrative usage. Filter as needed.
references:
- https://gtfobins.github.io/gtfobins/docker/
tags:
analytic_story:
- Linux Privilege Escalation
- Linux Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 90
context:
- Source:Endpoint
- Stage:Privilege Escalation
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log
impact: 80
kill_chain_phases:
- Exploitation
message: A commandline $process$ with process $process_name$ on $dest$
mitre_attack_id:
- T1548.003
- T1548
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_id
risk_score: 72
security_domain: endpoint
detections/endpoint/linux_proxy_socks_curl.yml
+84
View File
@@ -0,0 +1,84 @@
name: Linux Proxy Socks Curl
id: bd596c22-ad1e-44fc-b242-817253ce8b08
version: 1
date: '2022-07-29'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies curl being utilized with a proxy based on command-line arguments - -x, socks, --preproxy and --proxy. This behavior is built into the MetaSploit Framework as a auxiliary module. What does socks buy an adversary?
SOCKS4a extends the SOCKS4 protocol to allow a client to specify a destination domain name rather than an IP address.
The SOCKS5 protocol is defined in RFC 1928. It is an incompatible extension of the SOCKS4 protocol; it offers more choices for authentication and adds support for IPv6 and UDP, the latter of which can be used for DNS lookups.
The protocols, and a proxy itself, allow an adversary to evade controls in place monitoring traffic, making it harder for the defender to identify and track activity.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.process_name=curl
Processes.process IN ("*-x *", "*socks4a://*", "*socks5h://*", "*socks4://*","*socks5://*", "*--preproxy *", "--proxy*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `linux_proxy_socks_curl_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives may be present based on proxy usage internally. Filter as needed.
references:
- https://www.offensive-security.com/metasploit-unleashed/proxytunnels/
- https://curl.se/docs/manpage.html
- https://en.wikipedia.org/wiki/SOCKS
- https://oxylabs.io/blog/curl-with-proxy
- https://reqbin.com/req/c-ddxflki5/curl-proxy-server#:~:text=To%20use%20a%20proxy%20with,be%20URL%20decoded%20by%20Curl.
- https://gtfobins.github.io/gtfobins/curl/
tags:
analytic_story:
- Linux Living Off The Land
- Ingress Tool Transfer
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 80
context:
- Source:Endpoint
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
impact: 70
kill_chain_phases:
- Delivery
message: An instance of $process_name$ was identified
on endpoint $dest$ by user $user$ utilizing a proxy. Review activity for further details.
mitre_attack_id:
- T1090
- T1095
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 56
security_domain: endpoint
detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml
+1
View File
@@ -32,6 +32,7 @@ tags:
- Windows Persistence Techniques
- Living Off The Land
- Azorult
- DarkCrystal RAT
asset_type: Endpoint
cis20:
- CIS 3
detections/endpoint/suspicious_scheduled_task_from_public_directory.yml
+1
View File
@@ -33,6 +33,7 @@ tags:
- Windows Persistence Techniques
- Living Off The Land
- Azorult
- DarkCrystal RAT
confidence: 50
context:
- Source:Endpoint
detections/endpoint/windows_command_shell_dcrat_forkbomb_payload.yml
+18 -21
View File
@@ -6,27 +6,24 @@ author: Teoderick Contreras, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies DCRat "forkbomb" payload feature. This
technique was seen in dark crystal RAT backdoor capabilities where it will execute
several cmd child process executing "notepad.exe & pause". This analytic detects
the multiple cmd.exe and child process notepad.exe execution using batch script
in the targeted host within 30s timeframe. this TTP can be a good pivot to check
DCRat infection.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
values(Processes.parent_process) as parent_process values(Processes.parent_process_id)
as parent_process_id values(Processes.process_id) as process_id dc(Processes.parent_process_id)
as parent_process_id_count dc(Processes.process_id) as process_id_count min(_time)
as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=
"cmd.exe" (Processes.process_name = "notepad.exe" OR Processes.original_file_name=
"notepad.exe") Processes.parent_process = "*.bat*" by Processes.parent_process_name
Processes.process_name Processes.original_file_name Processes.parent_process Processes.dest
Processes.user _time span=30s | where parent_process_id_count>= 10 AND process_id_count
>=10 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` |
`security_content_ctime(lastTime)` | `windows_command_shell_dcrat_forkbomb_payload_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
description: The following analytic identifies DCRat "forkbomb" payload feature.
This technique was seen in dark crystal RAT backdoor capabilities where it will execute several cmd child process
executing "notepad.exe & pause". This analytic detects the multiple cmd.exe and child process notepad.exe execution using batch script
in the targeted host within 30s timeframe. this TTP can be a good pivot to check DCRat infection.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.parent_process_id) as parent_process_id values(Processes.process_id) as process_id dc(Processes.parent_process_id) as parent_process_id_count dc(Processes.process_id) as process_id_count
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where Processes.parent_process_name= "cmd.exe" (Processes.process_name = "notepad.exe" OR Processes.original_file_name= "notepad.exe") Processes.parent_process = "*.bat*"
by Processes.parent_process_name Processes.process_name Processes.original_file_name Processes.parent_process Processes.dest Processes.user _time
span=30s | where parent_process_id_count>= 10 AND process_id_count >=10
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_command_shell_dcrat_forkbomb_payload_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: unknown
references:
- https://cert.gov.ua/article/405538
detections/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
+84
View File
@@ -0,0 +1,84 @@
name: Windows DLL Search Order Hijacking with iscsicpl
id: f39ee679-3b1e-4f47-841c-5c3c580acda2
version: 1
date: '2022-07-29'
author: Michael Haag, Splunk
type: TTP
datamodel:
- Endpoint
description: The following analytic identifies a recently disclosed search ordler DLL hijack in iscsicpl.exe. The malicious DLL must be in a new path and iscsicpl.exe, upon load, will execute the payload. The analytic is restricted to Windows shells.
Two proof of concepts were identified and utilized to determine the behavior. The command-line is an option to go after, but most likely identifying a child process off iscsicpl.exe will be more effective. Monitoring for suspicious DLL loads is also an option.
search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time)
as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=iscsicpl.exe
`windows_shells` by Processes.dest Processes.user Processes.parent_process_name Processes.process_name
Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`| `windows_dll_search_order_hijacking_with_iscsicpl_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition, confirm the latest CIM App 4.20 or higher is installed and the latest TA for the endpoint product.
known_false_positives: False positives may be present, filtering may be required. Remove the Windows Shells macro to determine if other utilities are using iscsicpl.exe.
references:
- https://github.com/hackerhouse-opensource/iscsicpl_bypassUAC
- https://github.com/422926799/csplugin/tree/master/bypassUAC
tags:
analytic_story:
- Windows Defense Evasion Tactics
- Living Off The Land
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 80
context:
- Source:Endpoint
- Stage:Persistence
- Stage:Privilege Escalation
- Stage:Defense Evasion
- Scope:Inbound
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log
impact: 80
kill_chain_phases:
- Exploitation
message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to elevate access.
mitre_attack_id:
- T1574.001
nist:
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: parent_process_name
type: Process
role:
- Parent Process
- name: process_name
type: Process
role:
- Child Process
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name #parent process name
- Processes.parent_process #parent cmdline
- Processes.original_file_name
- Processes.process_name #process name
- Processes.process #process cmdline
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 64
security_domain: endpoint
detections/endpoint/windows_gather_victim_host_information_camera.yml
+68
View File
@@ -0,0 +1,68 @@
name: Windows Gather Victim Host Information Camera
id: e4df4676-ea41-4397-b160-3ee0140dc332
version: 1
date: '2022-07-28'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The following analytic detects a powershell script that enumerate camera mounted to the targeted host.
This technique was seen in DCRat malware, where it runs a powershell command to look for camera information that will be pass on to its
C2 server. This anomaly detection can be a good pivot to check who and why this enumeration is needed and what parent process execute this powershell
script command.
search: '`powershell` EventCode=4104 ScriptBlockText= "* Win32_PnPEntity *" ScriptBlockText= "*SELECT*" ScriptBlockText= "*WHERE*" ScriptBlockText = "*PNPClass*" ScriptBlockText IN ("*Image*", "*Camera*")
| stats count min(_time) as firstTime max(_time) as lastTime by EventCode ScriptBlockText Computer UserID
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_gather_victim_host_information_camera_filter`'
how_to_implement: To successfully implement this analytic, you will need to enable
PowerShell Script Block Logging on some or all endpoints. Additional setup here
https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell.
known_false_positives: Administrators may execute this powershell command to get hardware information related to camera.
references:
- https://cert.gov.ua/article/405538
- https://malpedia.caad.fkie.fraunhofer.de/details/win.dcrat
- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
tags:
analytic_story:
- DarkCrystal RAT
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 70
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml.log
impact: 60
kill_chain_phases:
- Reconnaissance
message: powershell script $ScriptBlockText$ to enumerate camera in $Computer$
mitre_attack_id:
- T1592.001
- T1592
nist:
- DE.CM
observable:
- name: Computer
type: Hostname
role:
- Victim
- name: User
type: User
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- ScriptBlockText
- Computer
- EventCode
risk_score: 42
security_domain: endpoint
detections/endpoint/windows_hunting_system_account_targeting_lsass.yml
+3 -12
View File
@@ -17,9 +17,9 @@ search: '`sysmon` EventCode=10 TargetImage=*lsass.exe | stats count min(_time) a
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
Sysmon TA. Enabling EventCode 10 TargetProcess lsass.exe is required.
known_false_positives: False positives will occur based on GrantedAccess and SourceUser,
filter based on source image as needed.
filter based on source image as needed. Utilize this hunting analytic to tune out false positives in TTP or anomaly analytics.
references:
- https://en.wikipedia.org/wiki/Local_Security_Authority_Subsystem_Service
- https://docs.microsoft.com/en-us/windows/win32/api/minidumpapiset/nf-minidumpapiset-minidumpwritedump
@@ -39,8 +39,7 @@ tags:
impact: 80
kill_chain_phases:
- Actions on Objectives
message: A process, $SourceImage$, has loaded $ImageLoaded$ that are typically related
to credential dumping on $dest$. Review for further details.
message: A process, $SourceImage$, has requested access to LSASS on $dest$. Review for further details.
mitre_attack_id:
- T1003.001
- T1003
@@ -48,18 +47,10 @@ tags:
- DE.AE
- DE.CM
observable:
- name: user
type: User
role:
- Victim
- name: dest
type: Hostname
role:
- Victim
- name: ImageLoaded
type: Process
role:
- Other
- name: SourceImage
type: Process
role:
detections/endpoint/windows_ingress_tool_transfer_using_explorer.yml
+74
View File
@@ -0,0 +1,74 @@
name: Windows Ingress Tool Transfer Using Explorer
id: 76753bab-f116-4ea3-8fb9-89b638be58a9
version: 1
date: '2022-08-01'
author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The following analytic detects an explorer.exe with a possible url link process command line on it.
Explorer.exe is known windows process that handle start menu, taskbar ,desktop and file manager.
So many threat actor abuses this process like DCRat malware, where it tries to open the url link with the default process browser application
in the target host by putting the url link as a parameter on explorer.exe process. This anomaly detection might be a good pivot to check
which user and how this process was executed, what is the parent process and what is the url link. This technique is not so common way to open an url link.
search: '| tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name = explorer.exe OR Processes.original_file_name = explorer.exe) AND NOT (Processes.parent_process_name IN("userinit.exe", "svchost.exe")) Processes.process IN ("* http://*", "* https://*")
by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id Processes.dest Processes.user
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_ingress_tool_transfer_using_explorer_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: unknown
references:
- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
tags:
analytic_story:
- DarkCrystal RAT
asset_type: Endpoint
cis20:
- CIS 3
- CIS 5
- CIS 16
confidence: 50
context:
- Source:Endpoint
- Stage:Execution
dataset:
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log
impact: 50
kill_chain_phases:
- Exploitation
message: a explorer process with url link $process$ in $dest$
mitre_attack_id:
- T1105
nist:
- DE.CM
observable:
- name: dest
type: Hostname
role:
- Victim
product:
- Splunk Enterprise
- Splunk Enterprise Security
- Splunk Cloud
required_fields:
- _time
- Processes.dest
- Processes.user
- Processes.parent_process_name
- Processes.parent_process
- Processes.original_file_name
- Processes.process_name
- Processes.process
- Processes.process_id
- Processes.parent_process_path
- Processes.process_path
- Processes.parent_process_id
risk_score: 25
security_domain: endpoint
detections/endpoint/windows_non_system_account_targeting_lsass.yml
+3 -3
View File
@@ -1,7 +1,7 @@
name: Windows Non-System Account Targeting Lsass
id: b1ce9a72-73cf-11ec-981b-acde48001122
version: 1
date: '2022-01-12'
version: 2
date: '2022-07-30'
author: Michael Haag, Splunk
type: TTP
datamodel: []
@@ -10,7 +10,7 @@ description: The following analytic identifies non SYSTEM accounts requesting ac
requiring access to credentials. Triaging this event will require understanding
the GrantedAccess from the SourceImage. In addition, whether the account is privileged
or not. Review the process requesting permissions and review parallel processes.
search: '`sysmon` EventCode=10 TargetImage=*lsass.exe SourceUser!="NT AUTHORITY\\*"
search: '`sysmon` EventCode=10 TargetImage=*lsass.exe NOT (SourceUser="NT AUTHORITY\\*")
| stats count min(_time) as firstTime max(_time) as lastTime by Computer, TargetImage,
GrantedAccess, SourceImage, SourceProcessId, SourceUser, TargetUser | rename Computer
as dest | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`
detections/endpoint/windows_system_logoff_commandline.yml
+16 -19
View File
@@ -6,26 +6,23 @@ author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The following analytic identifies Windows commandlined to logoff a windows
host machine. This technique was seen in several APT, RAT like dcrat and other commodity
malware to shutdown the machine to add more impact, interrupt access, aid destruction
of the system like wiping disk or inhibit system recovery. This TTP is a good pivot
to check why application trigger this commandline which is not so common way to
logoff a machine.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe)
Processes.process="*shutdown*" Processes.process="* /l*" Processes.process="* /t*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
description: The following analytic identifies Windows commandline to logoff a windows host machine.
This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact,
interrupt access, aid destruction of the system like wiping disk or inhibit system recovery.
This TTP is a good pivot to check why application trigger this commandline which is not so common way to logoff a machine.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process="* /l*" Processes.process="* /t*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_system_logoff_commandline_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Administrator may execute this commandline to trigger shutdown,
logoff or restart the host machine.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrator may execute this commandline to trigger shutdown, logoff or restart the host machine.
references:
- https://attack.mitre.org/techniques/T1529/
- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
detections/endpoint/windows_system_reboot_commandline.yml
+17 -20
View File
@@ -6,27 +6,24 @@ author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The following analytic identifies Windows commandlined to reboot a windows
host machine. This technique was seen in several APT, RAT like dcrat and other commodity
malware to shutdown the machine to add more impact, interrupt access, aid destruction
of the system like wiping disk or inhibit system recovery. This TTP is a good pivot
to check why application trigger this commandline which is not so common way to
reboot a machine. Compare to shutdown and logoff shutdown.exe feature, reboot seen
in some automation script like ansible to reboot the machine.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe)
Processes.process="*shutdown*" Processes.process="* /r*" Processes.process="* /t*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
description: The following analytic identifies Windows commandline to reboot a windows host machine.
This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact,
interrupt access, aid destruction of the system like wiping disk or inhibit system recovery.
This TTP is a good pivot to check why application trigger this commandline which is not so common way to reboot a machine.
Compare to shutdown and logoff shutdown.exe feature, reboot seen in some automation script like ansible to reboot the machine.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process="* /r*" Processes.process="* /t*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_system_reboot_commandline_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Administrator may execute this commandline to trigger shutdown
or restart the host machine.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine.
references:
- https://attack.mitre.org/techniques/T1529/
- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
detections/endpoint/windows_system_shutdown_commandline.yml
+16 -19
View File
@@ -6,26 +6,23 @@ author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The following analytic identifies Windows commandlined to shutdown a
windows host machine. This technique was seen in several APT, RAT like dcrat and
other commodity malware to shutdown the machine to add more impact, interrupt access,
aid destruction of the system like wiping disk or inhibit system recovery. This
TTP is a good pivot to check why application trigger this commandline which is not
so common way to shutdown a machine.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe)
Processes.process="*shutdown*" Processes.process="* /s*" Processes.process="* /t*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`
description: The following analytic identifies Windows commandline to shutdown a windows host machine.
This technique was seen in several APT, RAT like dcrat and other commodity malware to shutdown the machine to add more impact,
interrupt access, aid destruction of the system like wiping disk or inhibit system recovery.
This TTP is a good pivot to check why application trigger this commandline which is not so common way to shutdown a machine.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where (Processes.process_name = shutdown.exe OR Processes.original_file_name = shutdown.exe) Processes.process="*shutdown*" Processes.process="* /s*" Processes.process="* /t*"
by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_system_shutdown_commandline_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA.
known_false_positives: Administrator may execute this commandline to trigger shutdown
or restart the host machine.
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: Administrator may execute this commandline to trigger shutdown or restart the host machine.
references:
- https://attack.mitre.org/techniques/T1529/
- https://www.mandiant.com/resources/analyzing-dark-crystal-rat-backdoor
detections/endpoint/windows_system_time_discovery_w32tm_delay.yml
+18 -17
View File
@@ -6,23 +6,24 @@ author: Teoderick Contreras, Splunk
type: Anomaly
datamodel:
- Endpoint
description: The following analytic identifies DCRat delay time tactics using w32tm.
This technique was seen in DCRAT malware where it uses stripchart function of w32tm.exe
application to delay the execution of its payload like c2 communication , beaconing
and execution. This anomaly detection may help the analyst to check other possible
event like the process who execute this command that may lead to DCRat attack.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process
min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where Processes.process_name = w32tm.exe Processes.process= "* /stripchart *" Processes.process=
"* /computer:localhost *" Processes.process= "* /period:*" Processes.process= "*
/dataonly *" Processes.process= "* /samples:*" by Processes.parent_process Processes.process_name
Processes.original_file_name Processes.process Processes.process_id Processes.parent_process_id
Processes.dest Processes.user | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)` | `windows_system_time_discovery_w32tm_delay_filter`'
how_to_implement: To successfully implement this search, you need to be ingesting
logs with the process name, parent process, and command-line executions from your
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
Sysmon TA. Tune and filter known instances of wermgr.exe may be used.
description: The following analytic identifies DCRat delay time tactics using w32tm.
This technique was seen in DCRAT malware where it uses stripchart function of w32tm.exe application to delay the execution of its payload like
c2 communication , beaconing and execution. This anomaly detection may help the analyst to check other possible event like the process who
execute this command that may lead to DCRat attack.
search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes
where Processes.process_name = w32tm.exe Processes.process= "* /stripchart *" Processes.process= "* /computer:localhost *"
Processes.process= "* /period:*" Processes.process= "* /dataonly *" Processes.process= "* /samples:*"
by Processes.parent_process Processes.process_name Processes.original_file_name Processes.process
Processes.process_id Processes.parent_process_id Processes.dest Processes.user
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_system_time_discovery_w32tm_delay_filter`'
how_to_implement: To successfully implement this search you need to be ingesting information
on process that include the name of the process responsible for the changes from
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
endpoint product.
known_false_positives: unknown
references:
- https://cert.gov.ua/article/405538
detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml
+1
View File
@@ -32,6 +32,7 @@ tags:
- IcedID
- Windows Persistence Techniques
- Industroyer2
- DarkCrystal RAT
confidence: 100
context:
- Source:Endpoint
dist/ssa/srs/ssa___anomalous_usage_of_archive_tools.yml
Vendored
+1
View File
@@ -46,6 +46,7 @@ tags:
risk_score: 42
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/63614a58-10e2-4c6c-ae81-ea1113681439/
test:
name: Anomalous usage of Archive Tools Unit Test
tests:
dist/ssa/srs/ssa___attempt_to_delete_services.yml
Vendored
+1
View File
@@ -55,6 +55,7 @@ tags:
risk_score: 36
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/a0c8c292-d01a-11eb-aa18-acde48001122/
test:
name: Attempt To Delete Services Unit Test
tests:
dist/ssa/srs/ssa___attempt_to_disable_services.yml
Vendored
+1
View File
@@ -54,6 +54,7 @@ tags:
risk_score: 36
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/afb31de4-d023-11eb-98d5-acde48001122/
test:
name: Attempt To Disable Services Unit Test
tests:
dist/ssa/srs/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
Vendored
+1
View File
@@ -50,6 +50,7 @@ tags:
risk_score: 63
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/
test:
name: Attempted Credential Dump From Registry via Reg exe Unit Test
tests:
dist/ssa/srs/ssa___bcdedit_failure_recovery_modification.yml
Vendored
+1
View File
@@ -47,6 +47,7 @@ tags:
risk_score: 80
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13/
test:
name: BCDEdit Failure Recovery Modification Unit Test
tests:
dist/ssa/srs/ssa___clear_unallocated_sector_using_cipher_app.yml
Vendored
+1
View File
@@ -54,6 +54,7 @@ tags:
risk_score: 90
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/8f907d90-6173-11ec-9c23-acde48001122/
test:
name: Clear Unallocated Sector Using Cipher - SSA Unit test
tests:
dist/ssa/srs/ssa___delete_a_net_user.yml
Vendored
+1
View File
@@ -53,6 +53,7 @@ tags:
risk_score: 49
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/8776d79c-d26e-11eb-9a56-acde48001122/
test:
name: Delete A Net User Unit Test
tests:
dist/ssa/srs/ssa___deny_permission_using_cacls_utility.yml
Vendored
+1
View File
@@ -50,6 +50,7 @@ tags:
risk_score: 35
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/b76eae28-cd25-11eb-9c92-acde48001122/
test:
name: Deny Permission using Cacls Utility Unit Test
tests:
dist/ssa/srs/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
Vendored
+1
View File
@@ -52,6 +52,7 @@ tags:
risk_score: 35
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/c10a18cb-fd80-4ffa-a844-25026e0a0c94/
test:
name: Detect Prohibited Applications Spawning cmd exe Unit Test
tests:
dist/ssa/srs/ssa___detect_rclone_command_line_usage.yml
Vendored
+1
View File
@@ -57,6 +57,7 @@ tags:
risk_score: 35
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/e8b74268-5454-11ec-a799-acde48001122/
test:
name: Detect RClone Command-Line Usage Unit Test
tests:
dist/ssa/srs/ssa___disable_net_user_account.yml
Vendored
+1
View File
@@ -54,6 +54,7 @@ tags:
risk_score: 49
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/ba858b08-d26c-11eb-af9b-acde48001122/
test:
name: Disable Net User Account Unit Test
tests:
dist/ssa/srs/ssa___dns_exfiltration_using_nslookup_app.yml
Vendored
+1
View File
@@ -54,6 +54,7 @@ tags:
risk_score: 72
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/2452e632-9e0d-11eb-34ba-acde48001122/
test:
name: DNS Exfiltration Using Nslookup App Unit Test
tests:
dist/ssa/srs/ssa___fsutil_zeroing_file.yml
Vendored
+1
View File
@@ -46,6 +46,7 @@ tags:
risk_score: 54
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/f792cdc9-43ee-4429-a3c0-ffce4fed1a85/
test:
name: Fsutil Zeroing File Unit Test
tests:
dist/ssa/srs/ssa___grant_permission_using_cacls_utility.yml
Vendored
+1
View File
@@ -50,6 +50,7 @@ tags:
risk_score: 35
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/c6da561a-cd29-11eb-ae65-acde48001122/
test:
name: Grant Permission Using Cacls Utility Unit Test
tests:
dist/ssa/srs/ssa___hiding_files_and_directories_with_attrib_exe.yml
Vendored
+1
View File
@@ -47,6 +47,7 @@ tags:
risk_score: 72
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/028e4406-6176-11ec-aec2-acde48001122/
test:
name: Hiding Files And Directories With Attrib exe - SSA Unit test
tests:
dist/ssa/srs/ssa___modify_acls_permission_of_files_or_folders.yml
Vendored
+1
View File
@@ -54,6 +54,7 @@ tags:
risk_score: 35
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/9ae9a48a-cdbe-11eb-875a-acde48001122/
test:
name: Modify ACLs Permission Of Files Or Folders Unit Test
tests:
dist/ssa/srs/ssa___resize_shadowstorage_volume.yml
Vendored
+1
View File
@@ -53,6 +53,7 @@ tags:
risk_score: 64
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/dbc30554-d27e-11eb-9e5e-acde48001122/
test:
name: Resize Shadowstorage Volume Unit Test
tests:
dist/ssa/srs/ssa___sdelete_application_execution.yml
Vendored
+1
View File
@@ -63,6 +63,7 @@ tags:
risk_score: 42
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/fcc52b9a-4616-11ec-8454-acde48001122/
test:
name: Sdelete Application Execution Unit Test
tests:
dist/ssa/srs/ssa___system_process_running_from_unexpected_location.yml
Vendored
+1
View File
@@ -249,6 +249,7 @@ tags:
risk_score: 56
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/28179107-099a-464a-94d3-08301e6c055f/
test:
name: System Process Running from Unexpected Location Unit Test
tests:
dist/ssa/srs/ssa___wbadmin_delete_system_backups.yml
Vendored
+1
View File
@@ -51,6 +51,7 @@ tags:
risk_score: 15
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/71efbf52-4dbb-4c00-a520-306aa546cbb7/
test:
name: WBAdmin Delete System Backups Unit Test
tests:
dist/ssa/srs/ssa___wevtutil_usage_to_clear_logs.yml
Vendored
+1
View File
@@ -55,6 +55,7 @@ tags:
risk_score: 63
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/5438113c-cdd9-11eb-93b8-acde48001122/
test:
name: WevtUtil Usage To Clear Logs Unit Test
tests:
dist/ssa/srs/ssa___wevtutil_usage_to_disable_logs.yml
Vendored
+1
View File
@@ -51,6 +51,7 @@ tags:
risk_score: 63
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/a4bdc944-cdd9-11eb-ac97-acde48001122/
test:
name: Wevtutil Usage To Disable Logs Unit Test
tests:
dist/ssa/srs/ssa___windows_bits_job_persistence.yml
Vendored
+1
View File
@@ -58,6 +58,7 @@ tags:
risk_score: 56
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/1e25e97a-8ea4-11ec-9767-acde48001122/
test:
name: Windows Bits Job Persistence Unit Test
tests:
dist/ssa/srs/ssa___windows_bitsadmin_download_file.yml
Vendored
+1
View File
@@ -65,6 +65,7 @@ tags:
risk_score: 49
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/d76e8188-8f5a-11ec-ace4-acde48001122/
test:
name: Windows Bitsadmin Download File Unit Test
tests:
dist/ssa/srs/ssa___windows_certutil_decode_file.yml
Vendored
+1
View File
@@ -59,6 +59,7 @@ tags:
risk_score: 40
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/b06983f4-8f72-11ec-ab50-acde48001122/
test:
name: Windows CertUtil Decode File Unit Test
tests:
dist/ssa/srs/ssa___windows_certutil_urlcache_download.yml
Vendored
+1
View File
@@ -56,6 +56,7 @@ tags:
risk_score: 90
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/8cb1ad38-8f6d-11ec-87a3-acde48001122/
test:
name: Windows CertUtil URLCache Download Unit Test
tests:
dist/ssa/srs/ssa___windows_certutil_verifyctl_download.yml
Vendored
+1
View File
@@ -57,6 +57,7 @@ tags:
risk_score: 90
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/9ac29c40-8f6b-11ec-b19a-acde48001122/
test:
name: Windows CertUtil VerifyCtl Download Unit Test
tests:
dist/ssa/srs/ssa___windows_curl_upload_to_remote_destination.yml
Vendored
+1
View File
@@ -65,6 +65,7 @@ tags:
risk_score: 80
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/cc8d046a-543b-11ec-b864-acde48001122/
test:
name: Windows Curl Upload to Remote Destination Unit Test
tests:
dist/ssa/srs/ssa___windows_defender_tools_in_non_standard_path.yml
Vendored
+1
View File
@@ -45,6 +45,7 @@ tags:
risk_score: 56
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/c205bd2e-cd5b-4224-8510-578a2a1f83d7/
test:
name: Windows Defender Tools in Non Standard Path Unit Test
tests:
dist/ssa/srs/ssa___windows_diskshadow_proxy_execution.yml
Vendored
+1
View File
@@ -50,6 +50,7 @@ tags:
risk_score: 49
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/aa502688-9037-11ec-842d-acde48001122/
test:
name: BA Windows Diskshadow Proxy Execution Unit Test
tests:
dist/ssa/srs/ssa___windows_dotnet_binary_in_non_standard_path.yml
Vendored
+1
View File
@@ -77,6 +77,7 @@ tags:
risk_score: 49
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/21179107-099a-324a-94d3-08301e6c065f/
test:
name: Windows DotNet Binary in Non Standard Path Unit Test
tests:
dist/ssa/srs/ssa___windows_eventvwr_uac_bypass.yml
Vendored
+1
View File
@@ -59,6 +59,7 @@ tags:
risk_score: 80
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/66adff66-90d9-11ec-aba7-acde48001122/
test:
name: Windows Eventvwr UAC Bypass Unit Test
tests:
dist/ssa/srs/ssa___windows_lolbin_binary_in_non_standard_path.yml
Vendored
+1
View File
@@ -88,6 +88,7 @@ tags:
risk_score: 49
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/25689101-012a-324a-94d3-08301e6c065a/
test:
name: Windows LOLBin Binary in Non Standard Path Unit Test
tests:
dist/ssa/srs/ssa___windows_mshta_child_process.yml
Vendored
+1
View File
@@ -56,6 +56,7 @@ tags:
risk_score: 80
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/f63f7e9c-9526-11ec-9fc7-acde48001122/
test:
name: Windows MSHTA Child Process Unit Test
tests:
dist/ssa/srs/ssa___windows_mshta_command_line_url.yml
Vendored
+1
View File
@@ -58,6 +58,7 @@ tags:
risk_score: 80
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/9b35c538-94ef-11ec-9439-acde48001122/
test:
name: Windows MSHTA Command-Line URL Unit Test
tests:
dist/ssa/srs/ssa___windows_mshta_inline_hta_execution.yml
Vendored
+1
View File
@@ -56,6 +56,7 @@ tags:
risk_score: 80
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/24962154-9524-11ec-9333-acde48001122/
test:
name: Windows MSHTA Inline HTA Execution Unit Test
tests:
dist/ssa/srs/ssa___windows_powershell_connect_to_internet_with_hidden_window.yml
Vendored
+1
View File
@@ -64,6 +64,7 @@ tags:
risk_score: 35
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/477e068e-8b6d-11ec-b6c1-81af21670352/
test:
name: Windows Powershell Connect to Internet With Hidden Window Unit Test
tests:
dist/ssa/srs/ssa___windows_powershell_downloadfile.yml
Vendored
+1
View File
@@ -58,6 +58,7 @@ tags:
risk_score: 35
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/46440222-81d5-44b1-a376-19dcd70d1b08/
test:
name: Windows Powershell DownloadFile Unit Test
tests:
dist/ssa/srs/ssa___windows_powershell_start_bitstransfer.yml
Vendored
+1
View File
@@ -57,6 +57,7 @@ tags:
risk_score: 49
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/0bafd086-8f61-11ec-996e-acde48001122/
test:
name: Windows PowerShell Start-BitsTransfer Unit Test
tests:
dist/ssa/srs/ssa___windows_rasautou_dll_execution.yml
Vendored
+1
View File
@@ -57,6 +57,7 @@ tags:
risk_score: 80
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/6f42b8ce-1e15-11ec-ad5a-acde48001122/
test:
name: Windows Rasautou DLL Execution Unit Test
tests:
dist/ssa/srs/ssa___windows_rundll32_comsvcs_memory_dump.yml
Vendored
+1
View File
@@ -45,6 +45,7 @@ tags:
risk_score: 40
security_domain: endpoint
risk_severity: low
research_site_url: https://research.splunk.com/endpoint/76bb9e35-f314-4c3d-a385-83c72a13ce4e/
test:
name: Windows Rundll32 Comsvcs Memory Dump Unit Test
tests:
dist/ssa/srs/ssa___windows_rundll32_inline_hta_execution.yml
Vendored
+1
View File
@@ -59,6 +59,7 @@ tags:
risk_score: 56
security_domain: endpoint
risk_severity: medium
research_site_url: https://research.splunk.com/endpoint/0caa1dd6-94f5-11ec-9786-acde48001122/
test:
name: Windows Rundll32 Inline HTA Execution Unit Test
tests:
dist/ssa/srs/ssa___windows_script_host_spawn_msbuild.yml
Vendored
+1
View File
@@ -56,6 +56,7 @@ tags:
risk_score: 80
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/92886f1c-9b11-11ec-848a-acde48001122/
test:
name: Windows Script Host Spawn MSBuild Unit Test
tests:
dist/ssa/srs/ssa___windows_wmiprvse_spawn_msbuild.yml
Vendored
+1
View File
@@ -57,6 +57,7 @@ tags:
risk_score: 80
security_domain: endpoint
risk_severity: high
research_site_url: https://research.splunk.com/endpoint/76b3b290-9b31-11ec-a934-acde48001122/
test:
name: Windows WMIPrvse Spawn MSBuild Unit Test
tests:
tests/endpoint/linux_awk_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux AWK Privilege Escalation Unit Test
tests:
- name: Linux AWK Privilege Escalation
file: endpoint/linux_awk_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/awk/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_curl_upload_file.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Curl Upload File Unit Test
tests:
- name: Linux Curl Upload File
file: endpoint/linux_curl_upload_file.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: curl-linux-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_docker_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Docker Privilege Escalation Unit Test
tests:
- name: Linux Docker Privilege Escalation
file: endpoint/linux_docker_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/docker/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_ingress_tool_transfer_hunting.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Ingress Tool Transfer Hunting Unit Test
tests:
- name: Linux Ingress Tool Transfer Hunting
file: endpoint/linux_ingress_tool_transfer_hunting.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: curl-linux-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_ingress_tool_transfer_with_curl.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Ingress Tool Transfer With Curl Unit Test
tests:
- name: Linux Ingress Tool Transfer With Curl
file: endpoint/linux_ingress_tool_transfer_with_curl.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: curl-linux-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_node_privilege_escalation.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Node Privilege Escalation Unit Test
tests:
- name: Linux Node Privilege Escalation
file: endpoint/linux_node_privilege_escalation.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon_linux.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/node/sysmon_linux.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/linux_proxy_socks_curl.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Linux Proxy Socks Curl Unit Test
tests:
- name: Linux Proxy Socks Curl
file: endpoint/linux_proxy_socks_curl.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: curl-linux-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/curl-linux-sysmon.log
source: Syslog:Linux-Sysmon/Operational
sourcetype: sysmon_linux
update_timestamp: true
tests/endpoint/windows_dll_search_order_hijacking_with_iscsicpl.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Windows DLL Search Order Hijacking with iscsicpl Unit Test
tests:
- name: Windows DLL Search Order Hijacking with iscsicpl
file: endpoint/windows_dll_search_order_hijacking_with_iscsicpl.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: iscsicpl-windows-sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1574.001/iscsicpl/iscsicpl-windows-sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
update_timestamp: true
tests/endpoint/windows_gather_victim_host_information_camera.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Windows Gather Victim Host Information Camera Unit Test
tests:
- name: Windows Gather Victim Host Information Camera
file: endpoint/windows_gather_victim_host_information_camera.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: windows-powershell-xml.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_enum_camera/windows-powershell-xml.log
source: XmlWinEventLog:Microsoft-Windows-PowerShell/Operational
sourcetype: xmlwineventlog
update_timestamp: true
tests/endpoint/windows_ingress_tool_transfer_using_explorer.test.yml
+13
View File
@@ -0,0 +1,13 @@
name: Windows Ingress Tool Transfer Using Explorer Unit Test
tests:
- name: Windows Ingress Tool Transfer Using Explorer
file: endpoint/windows_ingress_tool_transfer_using_explorer.yml
pass_condition: '| stats count | where count > 0'
earliest_time: -24h
latest_time: now
attack_data:
- file_name: sysmon.log
data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/dcrat/dcrat_explorer_url/sysmon.log
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
sourcetype: xmlwineventlog
update_timestamp: true