From 65a92a64e10a9fc433bc0bf02dfe4a16b48e6da0 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 19 Jul 2021 16:49:33 +0200 Subject: [PATCH 01/21] add analytic types to detections --- bin/validate.py | 5 ++++- ...y_high_number_of_cloud_infrastructure_api_calls.yml | 2 +- ...y_high_number_of_cloud_security_group_api_calls.yml | 2 +- ...ws_create_policy_version_to_allow_all_resources.yml | 2 +- detections/cloud/aws_createaccesskey.yml | 2 +- detections/cloud/aws_createloginprofile.yml | 2 +- ...account_activity_from_previously_unseen_account.yml | 2 +- ...s_creating_keys_with_encrypt_policy_without_mfa.yml | 2 +- ...ct_users_with_kms_keys_performing_encryption_s3.yml | 2 +- detections/cloud/aws_excessive_security_scanning.yml | 2 +- .../cloud/aws_iam_accessdenied_discovery_events.yml | 2 +- .../cloud/aws_iam_assume_role_policy_brute_force.yml | 2 +- detections/cloud/aws_iam_delete_policy.yml | 2 +- detections/cloud/aws_iam_failure_group_deletion.yml | 2 +- detections/cloud/aws_iam_successful_group_deletion.yml | 2 +- ...access_control_list_created_with_all_open_ports.yml | 2 +- .../cloud/aws_network_access_control_list_deleted.yml | 2 +- .../aws_saml_access_by_provider_user_and_principal.yml | 2 +- detections/cloud/aws_saml_update_identity_provider.yml | 2 +- detections/cloud/aws_setdefaultpolicyversion.yml | 2 +- detections/cloud/aws_updateloginprofile.yml | 2 +- ...oud_api_calls_from_previously_unseen_user_roles.yml | 2 +- ...pute_instance_created_by_previously_unseen_user.yml | 2 +- ...te_instance_created_in_previously_unused_region.yml | 2 +- ...e_instance_created_with_previously_unseen_image.yml | 2 +- ...ce_created_with_previously_unseen_instance_type.yml | 2 +- ...d_instance_modified_with_previously_unseen_user.yml | 2 +- .../cloud_provisioning_from_previously_unseen_city.yml | 2 +- ...oud_provisioning_from_previously_unseen_country.yml | 2 +- ..._provisioning_from_previously_unseen_ip_address.yml | 2 +- ...loud_provisioning_from_previously_unseen_region.yml | 2 +- .../cloud/detect_aws_console_login_by_new_user.yml | 2 +- .../detect_aws_console_login_by_user_from_new_city.yml | 2 +- ...tect_aws_console_login_by_user_from_new_country.yml | 2 +- ...etect_aws_console_login_by_user_from_new_region.yml | 2 +- detections/cloud/detect_new_open_s3_buckets.yml | 2 +- .../cloud/detect_new_open_s3_buckets_over_aws_cli.yml | 2 +- ...ike_in_aws_security_hub_alerts_for_ec2_instance.yml | 2 +- .../cloud/o365_add_app_role_assignment_grant_user.yml | 2 +- detections/cloud/o365_added_service_principal.yml | 2 +- detections/cloud/o365_bypass_mfa_via_trusted_ip.yml | 2 +- detections/cloud/o365_disable_mfa.yml | 2 +- .../o365_excessive_authentication_failures_alert.yml | 2 +- detections/cloud/o365_excessive_sso_logon_errors.yml | 2 +- detections/cloud/o365_new_federated_domain_added.yml | 2 +- detections/cloud/o365_pst_export_alert.yml | 2 +- .../cloud/o365_suspicious_admin_email_forwarding.yml | 2 +- detections/cloud/o365_suspicious_rights_delegation.yml | 2 +- .../cloud/o365_suspicious_user_email_forwarding.yml | 2 +- .../abnormally_high_aws_instances_launched_by_user.yml | 2 +- ...ally_high_aws_instances_launched_by_user___mltk.yml | 2 +- ...bnormally_high_aws_instances_terminated_by_user.yml | 2 +- ...ly_high_aws_instances_terminated_by_user___mltk.yml | 2 +- ..._cloud_provisioning_from_previously_unseen_city.yml | 2 +- ...oud_provisioning_from_previously_unseen_country.yml | 2 +- ..._provisioning_from_previously_unseen_ip_address.yml | 2 +- ...loud_provisioning_from_previously_unseen_region.yml | 2 +- .../clients_connecting_to_multiple_dns_servers.yml | 2 +- .../cloud_network_access_control_list_deleted.yml | 2 +- .../detect_api_activity_from_users_without_mfa.yml | 2 +- ...ect_aws_api_activities_from_unapproved_accounts.yml | 2 +- ...requests_to_phishing_sites_leveraging_evilginx2.yml | 2 +- .../deprecated/detect_long_dns_txt_record_response.yml | 2 +- ...tect_mimikatz_via_powershell_and_eventcode_4703.yml | 2 +- .../detect_new_api_calls_from_user_roles.yml | 2 +- .../deprecated/detect_new_user_aws_console_login.yml | 2 +- .../deprecated/detect_spike_in_aws_api_activity.yml | 2 +- .../detect_spike_in_network_acl_activity.yml | 2 +- .../detect_spike_in_security_group_activity.yml | 2 +- detections/deprecated/detect_usb_device_insertion.yml | 2 +- .../detect_web_traffic_to_dynamic_domain_providers.yml | 2 +- detections/deprecated/detection_of_dns_tunnels.yml | 2 +- ...y_requests_resolved_by_unauthorized_dns_servers.yml | 2 +- detections/deprecated/dns_record_changed.yml | 2 +- ...2_instance_modified_with_previously_unseen_user.yml | 2 +- ...c2_instance_started_in_previously_unseen_region.yml | 2 +- ...ec2_instance_started_with_previously_unseen_ami.yml | 2 +- ...ce_started_with_previously_unseen_instance_type.yml | 2 +- ...c2_instance_started_with_previously_unseen_user.yml | 2 +- .../execution_of_file_with_spaces_before_extension.yml | 2 +- ...ded_period_without_successful_netbackup_backups.yml | 2 +- .../first_time_seen_command_line_argument.yml | 2 +- ...detect_accounts_with_high_risk_roles_by_project.yml | 2 +- ...t_high_risk_permissions_by_resource_and_account.yml | 2 +- detections/deprecated/gcp_detect_oauth_token_abuse.yml | 2 +- detections/deprecated/gcp_gcr_container_uploaded.yml | 2 +- .../gcp_kubernetes_cluster_scan_detection.yml | 2 +- detections/deprecated/identify_new_user_accounts.yml | 2 +- ..._aws_detect_most_active_service_accounts_by_pod.yml | 2 +- ...netes_aws_detect_rbac_authorizations_by_account.yml | 2 +- .../kubernetes_aws_detect_sensitive_object_access.yml | 2 +- .../kubernetes_aws_detect_sensitive_role_access.yml | 2 +- ...etect_service_accounts_forbidden_failure_access.yml | 2 +- ...t_most_active_service_accounts_by_pod_namespace.yml | 2 +- ...etes_azure_detect_rbac_authorization_by_account.yml | 2 +- ...kubernetes_azure_detect_sensitive_object_access.yml | 2 +- .../kubernetes_azure_detect_sensitive_role_access.yml | 2 +- ...etect_service_accounts_forbidden_failure_access.yml | 2 +- ...ubernetes_azure_detect_suspicious_kubectl_calls.yml | 2 +- .../kubernetes_azure_pod_scan_fingerprint.yml | 2 +- .../deprecated/kubernetes_azure_scan_fingerprint.yml | 2 +- ...netes_gcp_detect_RBAC_authorizations_by_account.yml | 2 +- ..._gcp_detect_most_active_service_accounts_by_pod.yml | 2 +- .../kubernetes_gcp_detect_sensitive_object_access.yml | 2 +- .../kubernetes_gcp_detect_sensitive_role_access.yml | 2 +- ...etect_service_accounts_forbidden_failure_access.yml | 2 +- .../kubernetes_gcp_detect_suspicious_kubectl_calls.yml | 2 +- ...ss___multiple_suspicious_command_line_arguments.yml | 2 +- detections/deprecated/monitor_dns_for_brand_abuse.yml | 2 +- detections/deprecated/open_redirect_in_splunk_web.yml | 2 +- .../deprecated/osquery_pack___coldroot_detection.yml | 2 +- detections/deprecated/processes_created_by_netsh.yml | 2 +- .../deprecated/prohibited_software_on_endpoint.yml | 2 +- ...sed_to_hide_files_directories_via_registry_keys.yml | 2 +- .../deprecated/remote_registry_key_modifications.yml | 2 +- .../scheduled_tasks_used_in_badrabbit_ransomware.yml | 2 +- .../spectre_and_meltdown_vulnerable_systems.yml | 2 +- .../splunk_enterprise_information_disclosure.yml | 2 +- .../suspicious_changes_to_file_associations.yml | 2 +- .../deprecated/suspicious_email___uba_anomaly.yml | 2 +- detections/deprecated/suspicious_file_write.yml | 2 +- .../suspicious_writes_to_system_volume_information.yml | 2 +- .../deprecated/uncommon_processes_on_endpoint.yml | 2 +- .../deprecated/unsigned_image_loaded_by_lsass.yml | 2 +- .../deprecated/unsuccessful_netbackup_backups.yml | 2 +- .../deprecated/web_fraud___account_harvesting.yml | 2 +- .../web_fraud___anomalous_user_clickspeed.yml | 2 +- .../web_fraud___password_sharing_across_accounts.yml | 2 +- .../deprecated/windows_connhost_exe_force_flag.yml | 2 +- .../deprecated/windows_hosts_file_modification.yml | 2 +- .../endpoint/access_lsass_memory_for_dump_creation.yml | 2 +- detections/endpoint/account_discovery_with_net_app.yml | 2 +- .../allow_file_and_printing_sharing_in_firewall.yml | 2 +- ...allow_inbound_traffic_by_firewall_rule_registry.yml | 2 +- .../allow_inbound_traffic_in_firewall_rule.yml | 2 +- .../endpoint/allow_network_discovery_in_firewall.yml | 2 +- .../endpoint/allow_operation_with_consent_admin.yml | 2 +- detections/endpoint/anomalous_usage_of_7zip.yml | 2 +- detections/endpoint/any_powershell_downloadfile.yml | 2 +- detections/endpoint/any_powershell_downloadstring.yml | 2 +- detections/endpoint/attacker_tools_on_endpoint.yml | 2 +- .../attempt_to_add_certificate_to_untrusted_store.yml | 2 +- .../endpoint/attempt_to_stop_security_service.yml | 2 +- ...mpted_credential_dump_from_registry_via_reg_exe.yml | 2 +- detections/endpoint/batch_file_write_to_system32.yml | 2 +- .../endpoint/bcdedit_failure_recovery_modification.yml | 2 +- detections/endpoint/bits_job_persistence.yml | 2 +- detections/endpoint/bitsadmin_download_file.yml | 2 +- ...util_download_with_urlcache_and_split_arguments.yml | 2 +- ...til_download_with_verifyctl_and_split_arguments.yml | 2 +- .../endpoint/certutil_exe_certificate_extraction.yml | 2 +- detections/endpoint/certutil_with_decode_argument.yml | 2 +- .../clear_unallocated_sector_using_cipher_app.yml | 2 +- detections/endpoint/clop_common_exec_parameter.yml | 2 +- .../endpoint/clop_ransomware_known_service_name.yml | 2 +- detections/endpoint/cmd_echo_pipe___escalation.yml | 2 +- detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml | 2 +- detections/endpoint/cobalt_strike_named_pipes.yml | 2 +- detections/endpoint/common_ransomware_extensions.yml | 2 +- detections/endpoint/common_ransomware_notes.yml | 2 +- detections/endpoint/conti_common_exec_parameter.yml | 2 +- .../create_local_admin_accounts_using_net_exe.yml | 2 +- .../create_or_delete_windows_shares_using_net_exe.yml | 2 +- .../endpoint/create_remote_thread_into_lsass.yml | 2 +- .../create_service_in_suspicious_file_path.yml | 2 +- .../endpoint/creation_of_lsass_dump_with_taskmgr.yml | 2 +- detections/endpoint/creation_of_shadow_copy.yml | 2 +- ...reation_of_shadow_copy_with_wmic_and_powershell.yml | 2 +- ...ntial_dumping_via_copy_command_from_shadow_copy.yml | 2 +- .../credential_dumping_via_symlink_to_shadow_copy.yml | 2 +- .../endpoint/delete_shadowcopy_with_powershell.yml | 2 +- detections/endpoint/deleting_of_net_users.yml | 2 +- detections/endpoint/deleting_shadow_copies.yml | 2 +- ...etect_activity_related_to_pass_the_hash_attacks.yml | 2 +- .../detect_azurehound_command_line_arguments.yml | 2 +- .../endpoint/detect_azurehound_file_modifications.yml | 2 +- .../detect_computer_changed_with_anonymous_account.yml | 2 +- .../detect_credential_dumping_through_lsass_access.yml | 2 +- ...ect_empire_with_powershell_script_block_logging.yml | 2 +- ...detect_excessive_account_lockouts_from_endpoint.yml | 2 +- .../detect_excessive_user_account_lockouts.yml | 2 +- detections/endpoint/detect_exchange_web_shell.yml | 2 +- detections/endpoint/detect_html_help_renamed.yml | 2 +- .../endpoint/detect_html_help_spawn_child_process.yml | 2 +- .../endpoint/detect_html_help_url_in_command_line.yml | 2 +- ...etect_html_help_using_infotech_storage_handlers.yml | 2 +- .../endpoint/detect_mimikatz_using_loaded_images.yml | 2 +- ...t_mimikatz_with_powershell_script_block_logging.yml | 2 +- .../endpoint/detect_mshta_inline_hta_execution.yml | 2 +- detections/endpoint/detect_mshta_renamed.yml | 2 +- .../endpoint/detect_mshta_url_in_command_line.yml | 2 +- detections/endpoint/detect_new_local_admin_account.yml | 2 +- ...ct_path_interception_by_creation_of_program_exe.yml | 2 +- ...used_for_system_network_configuration_discovery.yml | 2 +- ...detect_prohibited_applications_spawning_cmd_exe.yml | 2 +- .../endpoint/detect_psexec_with_accepteula_flag.yml | 2 +- .../endpoint/detect_rclone_command_line_usage.yml | 2 +- .../endpoint/detect_regasm_spawning_a_process.yml | 2 +- .../endpoint/detect_regasm_with_network_connection.yml | 2 +- .../detect_regasm_with_no_command_line_arguments.yml | 2 +- .../endpoint/detect_regsvcs_spawning_a_process.yml | 2 +- .../detect_regsvcs_with_network_connection.yml | 2 +- .../detect_regsvcs_with_no_command_line_arguments.yml | 2 +- .../detect_regsvr32_application_control_bypass.yml | 2 +- detections/endpoint/detect_renamed_7_zip.yml | 2 +- detections/endpoint/detect_renamed_psexec.yml | 2 +- detections/endpoint/detect_renamed_rclone.yml | 2 +- detections/endpoint/detect_renamed_winrar.yml | 2 +- ...t_rundll32_application_control_bypass___advpack.yml | 2 +- ..._rundll32_application_control_bypass___setupapi.yml | 2 +- ..._rundll32_application_control_bypass___syssetup.yml | 2 +- .../endpoint/detect_rundll32_inline_hta_execution.yml | 2 +- .../detect_sharphound_command_line_arguments.yml | 2 +- .../endpoint/detect_sharphound_file_modifications.yml | 2 +- detections/endpoint/detect_sharphound_usage.yml | 2 +- ...ct_use_of_cmd_exe_to_launch_script_interpreters.yml | 2 +- .../detect_wmi_event_subscription_persistence.yml | 2 +- detections/endpoint/disable_amsi_through_registry.yml | 2 +- detections/endpoint/disable_etw_through_registry.yml | 2 +- detections/endpoint/disable_logs_using_wevtutil.yml | 2 +- detections/endpoint/disable_registry_tool.yml | 2 +- detections/endpoint/disable_show_hidden_files.yml | 2 +- detections/endpoint/disable_windows_app_hotkeys.yml | 2 +- .../endpoint/disable_windows_behavior_monitoring.yml | 2 +- .../disable_windows_smartscreen_protection.yml | 2 +- detections/endpoint/disabling_cmd_application.yml | 2 +- detections/endpoint/disabling_controlpanel.yml | 2 +- detections/endpoint/disabling_firewall_with_netsh.yml | 2 +- .../disabling_folderoptions_windows_feature.yml | 2 +- detections/endpoint/disabling_net_user_account.yml | 2 +- detections/endpoint/disabling_norun_windows_app.yml | 2 +- .../endpoint/disabling_remote_user_account_control.yml | 2 +- .../endpoint/disabling_systemrestore_in_registry.yml | 2 +- detections/endpoint/disabling_task_manager.yml | 2 +- ...ost_with_no_command_line_arguments_with_network.yml | 2 +- .../endpoint/dns_exfiltration_using_nslookup_app.yml | 2 +- detections/endpoint/download_files_using_telegram.yml | 2 +- detections/endpoint/dsquery_domain_discovery.yml | 2 +- detections/endpoint/dump_lsass_via_comsvcs_dll.yml | 2 +- detections/endpoint/dump_lsass_via_procdump.yml | 2 +- detections/endpoint/dump_lsass_via_procdump_rename.yml | 2 +- .../endpoint/enable_rdp_in_other_port_number.yml | 2 +- .../enumerate_users_local_group_using_telegram.yml | 2 +- detections/endpoint/eventvwr_uac_bypass.yml | 2 +- detections/endpoint/excel_spawning_powershell.yml | 2 +- .../endpoint/excel_spawning_windows_script_host.yml | 2 +- .../endpoint/excessive_attempt_to_disable_services.yml | 2 +- ...stinct_processes_created_in_windows_temp_folder.yml | 2 +- ...ive_number_of_service_control_start_as_disabled.yml | 2 +- .../excessive_number_of_taskhost_processes.yml | 2 +- detections/endpoint/excessive_service_stop_attempt.yml | 2 +- detections/endpoint/excessive_usage_of_cacls_app.yml | 2 +- detections/endpoint/excessive_usage_of_net_app.yml | 2 +- .../endpoint/excessive_usage_of_nslookup_app.yml | 2 +- .../endpoint/excessive_usage_of_sc_service_utility.yml | 2 +- detections/endpoint/excessive_usage_of_taskkill.yml | 2 +- spec/detections.spec.json | 10 +++++++--- 257 files changed, 266 insertions(+), 259 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index eac324e8a8..e65deb8610 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -79,7 +79,7 @@ def validate_objects(REPO_PATH, objects, verbose): errors = errors + validation_errors for object in objects['detections']: - if object['type'] == 'batch': + if not 'Splunk Behavioral Analytics' in object['tags']['product']: errors = errors + validate_detection_search(object, objects['macros']) errors = errors + validate_fields(object) @@ -95,6 +95,9 @@ def validate_objects(REPO_PATH, objects, verbose): def validate_fields(object): errors = [] + # if object['type'] not in ['TTP', 'Anomaly', 'Hunting', 'Baseline', 'Investigation', 'Correlation']: + # errors.append('ERROR: invalid type [TTP, Anomaly, Hunting, Baseline, Investigation, Correlation] for object: %s' % object['name']) + if 'tags' in object: # check if required_fields is present diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 262fe73f3d..0d15635152 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -3,7 +3,7 @@ id: 0840ddf1-8c89-46ff-b730-c8d6722478c0 version: 1 date: '2020-09-07' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search will detect a spike in the number of API calls made to your diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index 4aa1e3f506..eede493315 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -3,7 +3,7 @@ id: d4dfb7f3-7a37-498a-b5df-f19334e871af version: 1 date: '2020-09-07' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search will detect a spike in the number of API calls made to your diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index 2855f4e2c6..cf42508e52 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-212bf3d0dac4 version: 2 date: '2021-02-22' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for AWS CloudTrail events where a user created a policy version that allows them to access any resource in their account diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index b1cc9534a6..902b8659f2 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-11ad-212bf3d0d111 version: 1 date: '2021-03-02' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: [] description: This search looks for AWS CloudTrail events where a user A who has already permission to create access keys, makes an API call to create access keys for another diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index 5da226a8fe..e9298d426a 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-11ad-212bf444d111 version: 1 date: '2021-03-02' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for AWS CloudTrail events where a user A(victim A) creates a login profile for user B, followed by a AWS Console login event from user diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index c665a5fac0..a8bb12738f 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -3,7 +3,7 @@ id: 21193641-cb96-4a2c-a707-d9b9a7f7792b version: 1 date: '2020-05-28' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: - Authentication description: This search looks for AssumeRole events where an IAM role in a different diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml index 15bbbe1780..49dbed307b 100644 --- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml +++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml @@ -3,7 +3,7 @@ id: c79c164f-4b21-4847-98f9-cf6a9f49179e version: 1 date: '2021-01-11' author: Rod Soto, Patrick Bareiss Splunk -type: batch +type: TTP datamodel: [] description: This search provides detection of KMS keys which action kms:Encrypt is accessible for everyone (also outside of your organization). This is an identicator diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml index 64a6ca1645..c84436eef3 100644 --- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml +++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml @@ -3,7 +3,7 @@ id: 884a5f59-eec7-4f4a-948b-dbde18225fdc version: 1 date: '2021-01-11' author: Rod Soto, Patrick Bareiss Splunk -type: batch +type: Anomaly datamodel: [] description: This search provides detection of users with KMS keys performing encryption specifically against S3 buckets. diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index d4b5d20fbf..953f2b40e9 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -3,7 +3,7 @@ id: 1fdd164a-def8-4762-83a9-9ffe24e74d5a version: 1 date: '2021-04-13' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for AWS CloudTrail events and analyse the amount of eventNames which starts with Describe by a single user. This indicates that this diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index ef96015f78..ff1ccdb24e 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -3,7 +3,7 @@ id: 3e1f1568-9633-11eb-a69c-acde48001122 version: 1 date: '2021-04-05' author: Michael Haag, Splunk -type: batch +type: Anomaly datamodel: [] description: The following detection identifies excessive AccessDenied events within an hour timeframe. It is possible that an access key to AWS may have been stolen diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 8dbe65bb13..380d60d8e7 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -3,7 +3,7 @@ id: f19e09b0-9308-11eb-b7ec-acde48001122 version: 1 date: '2021-04-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following detection identifies any malformed policy document exceptions with a status of `failure`. A malformed policy document exception occurs in instances diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index b049e0f898..c13e2d66e2 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -3,7 +3,7 @@ id: ec3a9362-92fe-11eb-99d0-acde48001122 version: 1 date: '2021-04-01' author: Michael Haag, Splunk -type: batch +type: Hunting datamodel: [] description: The following detection identifes when a policy is deleted on AWS. This does not identify whether successful or failed, but the error messages tell a story diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index 0315b7eb6b..7d7b3f0673 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -3,7 +3,7 @@ id: 723b861a-92eb-11eb-93b8-acde48001122 version: 1 date: '2021-04-01' author: Michael Haag, Splunk -type: batch +type: Anomaly datamodel: [] description: This detection identifies failure attempts to delete groups. We want to identify when a group is attempting to be deleted, but either access is denied, diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index 997d2d01d5..910b75c37a 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -3,7 +3,7 @@ id: e776d06c-9267-11eb-819b-acde48001122 version: 1 date: '2021-03-31' author: Michael Haag, Splunk -type: batch +type: Hunting datamodel: [] description: The following query uses IAM events to track the success of a group being deleted on AWS. This is typically not indicative of malicious behavior, but a precurser diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index fac75be690..b76d380c23 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d82362d6bd75 version: 2 date: '2021-01-11' author: Bhavin Patel, Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: The search looks for AWS CloudTrail events to detect if any network ACLs were created with all the ports open to a specified CIDR. diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index e501a12a81..2aa8ee1c04 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d82362d6fd75 version: 2 date: '2021-01-12' author: Bhavin Patel, Patrick Bareiss, Splunk -type: batch +type: Anomaly datamodel: [] description: Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index d36e80c230..5d7ef4e1a4 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -3,7 +3,7 @@ id: bbe23980-6019-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' author: Rod Soto, Splunk -type: batch +type: Anomaly datamodel: [] description: This search provides specific SAML access from specific Service Provider, user and targeted principal at AWS. This search provides specific information to diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index c0b1029495..e11cca45f7 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -3,7 +3,7 @@ id: 2f0604c6-6030-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' author: Rod Soto, Splunk -type: batch +type: TTP datamodel: [] description: This search provides detection of updates to SAML provider in AWS. Updates to SAML provider need to be monitored closely as they may indicate possible perimeter diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index cdc3934bcd..b8c4c7e537 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-11ad-212bf3d0dac4 version: 1 date: '2021-03-02' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for AWS CloudTrail events where a user has set a default policy versions. Attackers have been know to use this technique for Privilege Escalation diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index a5094ff24c..c6398ae518 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6a40-4115-11ad-212bf3d0d111 version: 1 date: '2021-03-02' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for AWS CloudTrail events where a user A who has already permission to update login profile, makes an API call to update login profile for diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index 6e4aee9e77..bf223e083f 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -3,7 +3,7 @@ id: 2181ad1f-1e73-4d0c-9780-e8880482a08f version: 1 date: '2020-09-04' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search looks for new commands from each user role. diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index 6d8f20e18d..d58a8fcb61 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -3,7 +3,7 @@ id: 37a0ec8d-827e-4d6d-8025-cedf31f3a149 version: 1 date: '2020-08-21' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search looks for cloud compute instances created by users who have diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index 5181900d57..c7bfe1e4ac 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -3,7 +3,7 @@ id: fa4089e2-50e3-40f7-8469-d2cc1564ca59 version: 1 date: '2020-09-02' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search looks at cloud-infrastructure events where an instance is diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 068b7651d9..641fccaf01 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -3,7 +3,7 @@ id: bc24922d-987c-4645-b288-f8c73ec194c4 version: 1 date: '2018-10-12' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search looks for cloud compute instances being created with previously diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 30e8096950..a43797ca55 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -3,7 +3,7 @@ id: c6ddbf53-9715-49f3-bb4c-fb2e8a309cda version: 1 date: '2020-09-12' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Change description: Find EC2 instances being created with previously unseen instance types. diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 810320d61c..d1d8b4f670 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -3,7 +3,7 @@ id: 7fb15084-b14e-405a-bd61-a6de15a40722 version: 1 date: '2020-07-29' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search looks for cloud instances being modified by users who have diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index aa1b0b25d6..969eb13caf 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -3,7 +3,7 @@ id: e7ecc5e0-88df-48b9-91af-51104c68f02f version: 1 date: '2020-10-09' author: Rico Valdez, Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search looks for cloud provisioning activities from previously unseen diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index daa8caf0d3..ac7a0f59e1 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -3,7 +3,7 @@ id: 94994255-3acf-4213-9b3f-0494df03bb31 version: 1 date: '2020-10-09' author: Rico Valdez, Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search looks for cloud provisioning activities from previously unseen diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index b96889ae17..6c224c3d93 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -3,7 +3,7 @@ id: f86a8ec9-b042-45eb-92f4-e9ed1d781078 version: 1 date: '2020-08-16' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search looks for cloud provisioning activities from previously unseen diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index 41446e109c..cbd47e8e67 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -3,7 +3,7 @@ id: 5aba1860-9617-4af9-b19d-aecac16fe4f2 version: 1 date: '2020-08-16' author: Rico Valdez, Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search looks for cloud provisioning activities from previously unseen diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index f983c9e690..e28d0526e9 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -3,7 +3,7 @@ id: bc91a8cd-35e7-4bb2-6140-e756cc46fd71 version: 1 date: '2020-05-28' author: Rico Valdez, Splunk -type: batch +type: Hunting datamodel: - Authentication description: This search looks for AWS CloudTrail events wherein a console login event diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index 4d97c2485f..1a38761790 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -3,7 +3,7 @@ id: 121b0b11-f8ac-4ed6-a132-3800ca4fc07a version: 1 date: '2020-10-07' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: - Authentication description: This search looks for AWS CloudTrail events wherein a console login event diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index 8aa8cc5f65..bcf2bbd2d1 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -3,7 +3,7 @@ id: 67bd3def-c41c-4bf6-837b-ae196b4257c6 version: 1 date: '2020-10-07' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: - Authentication description: This search looks for AWS CloudTrail events wherein a console login event diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index e638c488d5..e7b0b86084 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -3,7 +3,7 @@ id: 9f31aa8e-e37c-46bc-bce1-8b3be646d026 version: 1 date: '2020-10-07' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: - Authentication description: This search looks for AWS CloudTrail events wherein a console login event diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index c27a34643c..440d62b1cc 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-290bf3d0dac4 version: 2 date: '2021-01-12' author: Bhavin Patel, Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index d84e766b66..60a516f443 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -3,7 +3,7 @@ id: 39c61d09-8b30-4154-922b-2d0a694ecc22 version: 1 date: '2021-01-12' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index 7af9fabe30..7529b3f6cf 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-290bf5d0d222 version: 3 date: '2021-01-26' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for a spike in number of of AWS security Hub alerts for an EC2 instance in 4 hours intervals diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index efc41e965e..1af5069fa9 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -3,7 +3,7 @@ id: b2c81cc6-6040-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' author: Rod Soto, Splunk -type: batch +type: TTP datamodel: [] description: This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 0fe3f211bc..be78ccbe9c 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -3,7 +3,7 @@ id: 1668812a-6047-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' author: Rod Soto, Splunk -type: batch +type: TTP datamodel: [] description: This search detects the creation of a new Federation setting by alerting about an specific event related to its creation. diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index bb5677d7e1..a0af492030 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -3,7 +3,7 @@ id: c783dd98-c703-4252-9e8a-f19d9f66949e version: 1 date: '2021-01-12' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: [] description: This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index a219fe3e1f..6c1572b2d0 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -3,7 +3,7 @@ id: c783dd98-c703-4252-9e8a-f19d9f5c949e version: 1 date: '2020-12-16' author: Rod Soto, Splunk -type: batch +type: TTP datamodel: [] description: This search detects when multi factor authentication has been disabled, what entitiy performed the action and against what user diff --git a/detections/cloud/o365_excessive_authentication_failures_alert.yml b/detections/cloud/o365_excessive_authentication_failures_alert.yml index 8733d5e50f..dfa7293ede 100644 --- a/detections/cloud/o365_excessive_authentication_failures_alert.yml +++ b/detections/cloud/o365_excessive_authentication_failures_alert.yml @@ -3,7 +3,7 @@ id: d441364c-349c-453b-b55f-12eccab67cf9 version: 1 date: '2020-12-16' author: Rod Soto, Splunk -type: batch +type: Anomaly datamodel: [] description: This search detects when an excessive number of authentication failures occur this search also includes attempts against MFA prompt codes diff --git a/detections/cloud/o365_excessive_sso_logon_errors.yml b/detections/cloud/o365_excessive_sso_logon_errors.yml index 5dba881c26..a92ebd0800 100644 --- a/detections/cloud/o365_excessive_sso_logon_errors.yml +++ b/detections/cloud/o365_excessive_sso_logon_errors.yml @@ -3,7 +3,7 @@ id: 8158ccc4-6038-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' author: Rod Soto, Splunk -type: batch +type: Anomaly datamodel: [] description: This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 6a6b4e0d8b..7619ad5194 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -3,7 +3,7 @@ id: e155876a-6048-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' author: Rod Soto, Splunk -type: batch +type: TTP datamodel: [] description: This search detects the addition of a new Federated domain. search: '`o365_management_activity` Workload=Exchange Operation="Add-FederatedDomain" diff --git a/detections/cloud/o365_pst_export_alert.yml b/detections/cloud/o365_pst_export_alert.yml index 1f260b8963..5531331a41 100644 --- a/detections/cloud/o365_pst_export_alert.yml +++ b/detections/cloud/o365_pst_export_alert.yml @@ -3,7 +3,7 @@ id: 5f694cc4-a678-4a60-9410-bffca1b647dc version: 1 date: '2020-12-16' author: Rod Soto, Splunk -type: batch +type: TTP datamodel: [] description: This search detects when a user has performed an Ediscovery search or exported a PST file from the search. This PST file usually has sensitive information diff --git a/detections/cloud/o365_suspicious_admin_email_forwarding.yml b/detections/cloud/o365_suspicious_admin_email_forwarding.yml index 9a5d5b3ea6..af2dd1ad6c 100644 --- a/detections/cloud/o365_suspicious_admin_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_admin_email_forwarding.yml @@ -3,7 +3,7 @@ id: 7f398cfb-918d-41f4-8db8-2e2474e02c28 version: 1 date: '2020-12-16' author: Patrick Bareiss, Splunk -type: batch +type: Anomaly datamodel: [] description: This search detects when an admin configured a forwarding rule for multiple mailboxes to the same destination. diff --git a/detections/cloud/o365_suspicious_rights_delegation.yml b/detections/cloud/o365_suspicious_rights_delegation.yml index 78cd3628d2..782e3f22b7 100644 --- a/detections/cloud/o365_suspicious_rights_delegation.yml +++ b/detections/cloud/o365_suspicious_rights_delegation.yml @@ -3,7 +3,7 @@ id: b25d2973-303e-47c8-bacd-52b61604c6a7 version: 1 date: '2020-12-15' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: This search detects the assignment of rights to accesss content from another mailbox. This is usually only assigned to a service account. diff --git a/detections/cloud/o365_suspicious_user_email_forwarding.yml b/detections/cloud/o365_suspicious_user_email_forwarding.yml index 698a76fd93..db36bbf902 100644 --- a/detections/cloud/o365_suspicious_user_email_forwarding.yml +++ b/detections/cloud/o365_suspicious_user_email_forwarding.yml @@ -3,7 +3,7 @@ id: f8dfe015-dbb3-4569-ba75-b13787e06aa4 version: 1 date: '2020-12-16' author: Patrick Bareiss, Splunk -type: batch +type: Anomaly datamodel: [] description: This search detects when multiple user configured a forwarding rule to the same destination. diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml index 0c34644c48..0e9731b17b 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_launched_by_user.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-290bf5d0dac4 version: 2 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have diff --git a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml index 78340ddb30..3ce4ca2ab5 100644 --- a/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_launched_by_user___mltk.yml @@ -3,7 +3,7 @@ id: dec41ad5-d579-42cb-b4c6-f5dbb778bbe5 version: 2 date: '2020-07-21' author: Jason Brewer, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for AWS CloudTrail events where a user successfully launches an abnormally high number of instances. This search is deprecated and have diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml index e219f028d5..4a173ad2dd 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-s3f3-d82362dffd75 version: 2 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for AWS CloudTrail events where an abnormally high number of instances were successfully terminated by a user in a 10-minute window. diff --git a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml index 8f57b5c17c..028441fd35 100644 --- a/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml +++ b/detections/deprecated/abnormally_high_aws_instances_terminated_by_user___mltk.yml @@ -3,7 +3,7 @@ id: 1c02b86a-cd85-473e-a50b-014a9ac8fe3e version: 2 date: '2020-07-21' author: Jason Brewer, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for AWS CloudTrail events where a user successfully terminates an abnormally high number of instances. This search is deprecated and diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml index da60e7a8f9..c49f68ddc2 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_city.yml @@ -3,7 +3,7 @@ id: 344a1778-0b25-490c-adb1-de8beddf59cd version: 1 date: '2018-03-16' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: 'This search looks for AWS provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that begins with diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml index 91cd741631..d1e5076373 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_country.yml @@ -3,7 +3,7 @@ id: ceb8d3d8-06cb-49eb-beaf-829526e33ff0 version: 1 date: '2018-03-16' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: 'This search looks for AWS provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that begins diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml index 6b29901b6a..6aa0991bce 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_ip_address.yml @@ -3,7 +3,7 @@ id: 42e15012-ac14-4801-94f4-f1acbe64880b version: 1 date: '2018-03-16' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: 'This search looks for AWS provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that begins diff --git a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml index ddcf57b400..daee7a7884 100644 --- a/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/deprecated/aws_cloud_provisioning_from_previously_unseen_region.yml @@ -3,7 +3,7 @@ id: 7971d3df-da82-4648-a6e5-b5637bea5253 version: 1 date: '2018-03-16' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for AWS provisioning activities from previously unseen regions. Region in this context is similar to a state in the United States. Provisioning diff --git a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml b/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml index e41a79e878..274096c19a 100644 --- a/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml +++ b/detections/deprecated/clients_connecting_to_multiple_dns_servers.yml @@ -3,7 +3,7 @@ id: 74ec6f18-604b-4202-a567-86b2066be3ce version: 3 date: '2020-07-21' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Network_Resolution description: This search allows you to identify the endpoints that have connected diff --git a/detections/deprecated/cloud_network_access_control_list_deleted.yml b/detections/deprecated/cloud_network_access_control_list_deleted.yml index 84f2ff7b20..69321e19c1 100644 --- a/detections/deprecated/cloud_network_access_control_list_deleted.yml +++ b/detections/deprecated/cloud_network_access_control_list_deleted.yml @@ -3,7 +3,7 @@ id: 021abc51-1862-41dd-ad43-43c739c0a983 version: 1 date: '2020-09-08' author: Peter Gael, Splunk -type: batch +type: Anomaly datamodel: [] description: Enforcing network-access controls is one of the defensive mechanisms used by cloud administrators to restrict access to a cloud instance. After the attacker diff --git a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml b/detections/deprecated/detect_api_activity_from_users_without_mfa.yml index fb341b9184..5c747c0ec8 100644 --- a/detections/deprecated/detect_api_activity_from_users_without_mfa.yml +++ b/detections/deprecated/detect_api_activity_from_users_without_mfa.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-w5ad-212bf5d1dac4 version: 1 date: '2018-05-17' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: [] description: This search looks for AWS CloudTrail events where a user logged into the AWS account, is making API calls and has not enabled Multi Factor authentication. diff --git a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml index 50bfde6320..457d51c4a0 100644 --- a/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml +++ b/detections/deprecated/detect_aws_api_activities_from_unapproved_accounts.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d82362d4bd55 version: 2 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: [] description: This search looks for successful AWS CloudTrail activity by user accounts that are not listed in the identity table or `aws_service_accounts.csv`. It returns diff --git a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml b/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml index 722b63aa43..21b21b7071 100644 --- a/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml +++ b/detections/deprecated/detect_dns_requests_to_phishing_sites_leveraging_evilginx2.yml @@ -3,7 +3,7 @@ id: 24dd17b1-e2fb-4c31-878c-d4f226595bfa version: 2 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Network_Resolution description: This search looks for DNS requests for phishing domains that are leveraging diff --git a/detections/deprecated/detect_long_dns_txt_record_response.yml b/detections/deprecated/detect_long_dns_txt_record_response.yml index 026ad019d8..6a97557abe 100644 --- a/detections/deprecated/detect_long_dns_txt_record_response.yml +++ b/detections/deprecated/detect_long_dns_txt_record_response.yml @@ -3,7 +3,7 @@ id: 05437c07-62f5-452e-afdc-04dd44815bb9 version: 2 date: '2020-07-21' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Network_Resolution description: This search is used to detect attempts to use DNS tunneling, by calculating diff --git a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml index 1d34c5a20d..0f1d4dcf2e 100644 --- a/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml +++ b/detections/deprecated/detect_mimikatz_via_powershell_and_eventcode_4703.yml @@ -3,7 +3,7 @@ id: 98917be2-bfc8-475a-8618-a9bb06575188 version: 2 date: '2019-02-27' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective. diff --git a/detections/deprecated/detect_new_api_calls_from_user_roles.yml b/detections/deprecated/detect_new_api_calls_from_user_roles.yml index 51a9183400..41a92ee364 100644 --- a/detections/deprecated/detect_new_api_calls_from_user_roles.yml +++ b/detections/deprecated/detect_new_api_calls_from_user_roles.yml @@ -3,7 +3,7 @@ id: 22773e84-bac0-4595-b086-20d3f335b4f1 version: 1 date: '2018-04-16' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search detects new API calls that have either never been seen before or that have not been seen in the previous hour, where the identity type is `AssumedRole`. diff --git a/detections/deprecated/detect_new_user_aws_console_login.yml b/detections/deprecated/detect_new_user_aws_console_login.yml index 8e136b6837..6d6a19548f 100644 --- a/detections/deprecated/detect_new_user_aws_console_login.yml +++ b/detections/deprecated/detect_new_user_aws_console_login.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f3-d82362dffd75 version: 2 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: [] description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup diff --git a/detections/deprecated/detect_spike_in_aws_api_activity.yml b/detections/deprecated/detect_spike_in_aws_api_activity.yml index a6c5e31f83..bc8279ef41 100644 --- a/detections/deprecated/detect_spike_in_aws_api_activity.yml +++ b/detections/deprecated/detect_spike_in_aws_api_activity.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d32362d4bd55 version: 2 date: '2020-07-21' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: This search will detect users creating spikes of API activity in your AWS environment. It will also update the cache file that factors in the latest diff --git a/detections/deprecated/detect_spike_in_network_acl_activity.yml b/detections/deprecated/detect_spike_in_network_acl_activity.yml index d7ab4fb083..0419681135 100644 --- a/detections/deprecated/detect_spike_in_network_acl_activity.yml +++ b/detections/deprecated/detect_spike_in_network_acl_activity.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a1f1-e32372d4bd53 version: 1 date: '2018-05-21' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search will detect users creating spikes in API activity related to network access-control lists (ACLs)in your AWS environment. This search is deprecated diff --git a/detections/deprecated/detect_spike_in_security_group_activity.yml b/detections/deprecated/detect_spike_in_security_group_activity.yml index 4efcbf25a3..3b4f02e791 100644 --- a/detections/deprecated/detect_spike_in_security_group_activity.yml +++ b/detections/deprecated/detect_spike_in_security_group_activity.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-e32372d4bd53 version: 1 date: '2018-04-18' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search will detect users creating spikes in API activity related to security groups in your AWS environment. It will also update the cache file diff --git a/detections/deprecated/detect_usb_device_insertion.yml b/detections/deprecated/detect_usb_device_insertion.yml index fddee07dca..23844bf3b1 100644 --- a/detections/deprecated/detect_usb_device_insertion.yml +++ b/detections/deprecated/detect_usb_device_insertion.yml @@ -3,7 +3,7 @@ id: 104658f4-afdc-499f-9719-17a43f9826f5 version: 1 date: '2017-11-27' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Change_Analysis description: The search is used to detect hosts that generate Windows Event ID 4663 diff --git a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml index 46dcb034f5..73ee17edb5 100644 --- a/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml +++ b/detections/deprecated/detect_web_traffic_to_dynamic_domain_providers.yml @@ -3,7 +3,7 @@ id: 134da869-e264-4a8f-8d7e-fcd01c18f301 version: 2 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Web description: This search looks for web connections to dynamic DNS providers. diff --git a/detections/deprecated/detection_of_dns_tunnels.yml b/detections/deprecated/detection_of_dns_tunnels.yml index 3c1cfcd137..5ca1917571 100644 --- a/detections/deprecated/detection_of_dns_tunnels.yml +++ b/detections/deprecated/detection_of_dns_tunnels.yml @@ -3,7 +3,7 @@ id: 104658f4-afdc-499f-9719-17a43f9826f4 version: 2 date: '2017-09-18' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Network_Resolution description: This search is used to detect DNS tunneling, by calculating the sum of diff --git a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml index 413985b621..e9fc8f1ff0 100644 --- a/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml +++ b/detections/deprecated/dns_query_requests_resolved_by_unauthorized_dns_servers.yml @@ -3,7 +3,7 @@ id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f6 version: 3 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Network_Resolution description: This search will detect DNS requests resolved by unauthorized DNS servers. diff --git a/detections/deprecated/dns_record_changed.yml b/detections/deprecated/dns_record_changed.yml index 1ae1bb5436..188f28fcd5 100644 --- a/detections/deprecated/dns_record_changed.yml +++ b/detections/deprecated/dns_record_changed.yml @@ -3,7 +3,7 @@ id: 44d3a43e-dcd5-49f7-8356-5209bb369065 version: 3 date: '2020-07-21' author: Jose Hernandez, Splunk -type: batch +type: TTP datamodel: - Network_Resolution description: The search takes the DNS records and their answers results of the discovered_dns_records diff --git a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml b/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml index 3bb966ac49..b458b00790 100644 --- a/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml +++ b/detections/deprecated/ec2_instance_modified_with_previously_unseen_user.yml @@ -3,7 +3,7 @@ id: 56f91724-cf3f-4666-84e1-e3712fb41e76 version: 3 date: '2020-07-21' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for EC2 instances being modified by users who have not previously modified them. This search is deprecated and have been translated diff --git a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml b/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml index 7b924d861b..fa7afb7351 100644 --- a/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml +++ b/detections/deprecated/ec2_instance_started_in_previously_unseen_region.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f3-d82362d6fd75 version: 1 date: '2018-02-23' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml index 31a281497d..ff8e917929 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_ami.yml @@ -3,7 +3,7 @@ id: 347ec301-601b-48b9-81aa-9ddf9c829dd3 version: 1 date: '2018-03-12' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml index 68cb14a398..b0a54b89ac 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_instance_type.yml @@ -3,7 +3,7 @@ id: 65541c80-03c7-4e05-83c8-1dcd57a2e1ad version: 2 date: '2020-02-07' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for EC2 instances being created with previously unseen instance types. This search is deprecated and have been translated to use the latest diff --git a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml b/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml index 782a7f3b7a..41b85bde0d 100644 --- a/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml +++ b/detections/deprecated/ec2_instance_started_with_previously_unseen_user.yml @@ -3,7 +3,7 @@ id: 22773e84-bac0-4595-b086-20d3f735b4f1 version: 2 date: '2020-07-21' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for EC2 instances being created by users who have not created them before. This search is deprecated and have been translated to use the diff --git a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml index b63f7b828f..8c5606604f 100644 --- a/detections/deprecated/execution_of_file_with_spaces_before_extension.yml +++ b/detections/deprecated/execution_of_file_with_spaces_before_extension.yml @@ -3,7 +3,7 @@ id: ab0353e6-a956-420b-b724-a8b4846d5d5a version: 3 date: '2020-11-19' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for processes launched from files with at least five diff --git a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml b/detections/deprecated/extended_period_without_successful_netbackup_backups.yml index caf098e553..043809e7ef 100644 --- a/detections/deprecated/extended_period_without_successful_netbackup_backups.yml +++ b/detections/deprecated/extended_period_without_successful_netbackup_backups.yml @@ -3,7 +3,7 @@ id: a34aae96-ccf8-4aef-952c-3ea214444440 version: 1 date: '2017-09-12' author: David Dorsey, Splunk -type: batch +type: Hunting datamodel: [] description: This search returns a list of hosts that have not successfully completed a backup in over a week. Deprecated because it's a infrastructure monitoring. diff --git a/detections/deprecated/first_time_seen_command_line_argument.yml b/detections/deprecated/first_time_seen_command_line_argument.yml index 9fdae531d6..ba682b8bdf 100644 --- a/detections/deprecated/first_time_seen_command_line_argument.yml +++ b/detections/deprecated/first_time_seen_command_line_argument.yml @@ -3,7 +3,7 @@ id: 9be56c82-b1cc-4318-87eb-q138afaaqa39 version: 5 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: This search looks for command-line arguments that use a `/c` parameter diff --git a/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml b/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml index 1caf56a2a5..7d16778165 100644 --- a/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml +++ b/detections/deprecated/gcp_detect_accounts_with_high_risk_roles_by_project.yml @@ -3,7 +3,7 @@ id: 27af8c15-38b0-4408-b339-920170724adb version: 1 date: '2020-10-09' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides detection of accounts with high risk roles by projects. Compromised accounts with high risk roles can move laterally or even scalate privileges diff --git a/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml b/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml index 5192b24b8a..c9c519b4f2 100644 --- a/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml +++ b/detections/deprecated/gcp_detect_high_risk_permissions_by_resource_and_account.yml @@ -3,7 +3,7 @@ id: 2e70ef35-2187-431f-aedc-4503dc9b06ba version: 1 date: '2020-10-09' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides detection of high risk permissions by resource and accounts. These are permissions that can allow attackers with compromised accounts diff --git a/detections/deprecated/gcp_detect_oauth_token_abuse.yml b/detections/deprecated/gcp_detect_oauth_token_abuse.yml index b00d94adbe..6e423dc556 100644 --- a/detections/deprecated/gcp_detect_oauth_token_abuse.yml +++ b/detections/deprecated/gcp_detect_oauth_token_abuse.yml @@ -3,7 +3,7 @@ id: a7e9f7bb-8901-4ad0-8d88-0a4ab07b1972 version: 1 date: '2020-09-01' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides detection of possible GCP Oauth token abuse. GCP Oauth token without time limit can be exfiltrated and reused for keeping access diff --git a/detections/deprecated/gcp_gcr_container_uploaded.yml b/detections/deprecated/gcp_gcr_container_uploaded.yml index 711e60e6d8..fefe3844a1 100644 --- a/detections/deprecated/gcp_gcr_container_uploaded.yml +++ b/detections/deprecated/gcp_gcr_container_uploaded.yml @@ -3,7 +3,7 @@ id: 4f00ca88-e766-4605-ac65-ae51c9fd185b version: 1 date: '2020-02-20' author: Rod Soto, Rico Valdez, Splunk -type: batch +type: Hunting datamodel: [] description: This search show information on uploaded containers including source user, account, action, bucket name event name, http user agent, message and destination diff --git a/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml b/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml index 427070b055..e631e6d7a2 100644 --- a/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml +++ b/detections/deprecated/gcp_kubernetes_cluster_scan_detection.yml @@ -3,7 +3,7 @@ id: db5957ec-0144-4c56-b512-9dccbe7a2d26 version: 1 date: '2020-04-15' author: Rod Soto, Splunk -type: batch +type: TTP datamodel: [] description: This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster diff --git a/detections/deprecated/identify_new_user_accounts.yml b/detections/deprecated/identify_new_user_accounts.yml index 33b9a0d89d..64cc40d6c6 100644 --- a/detections/deprecated/identify_new_user_accounts.yml +++ b/detections/deprecated/identify_new_user_accounts.yml @@ -3,7 +3,7 @@ id: 475b9e27-17e4-46e2-b7e2-648221be3b89 version: 1 date: '2017-09-12' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: [] description: This detection search will help profile user accounts in your environment by identifying newly created accounts that have been added to your network in the diff --git a/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml b/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml index 55e8a31a82..16dd69ab07 100644 --- a/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml +++ b/detections/deprecated/kubernetes_aws_detect_most_active_service_accounts_by_pod.yml @@ -3,7 +3,7 @@ id: 5b30b25d-7d32-42d8-95ca-64dfcd9076e6 version: 1 date: '2020-06-23' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision diff --git a/detections/deprecated/kubernetes_aws_detect_rbac_authorizations_by_account.yml b/detections/deprecated/kubernetes_aws_detect_rbac_authorizations_by_account.yml index 5e85bb0cfe..3d11d83b31 100644 --- a/detections/deprecated/kubernetes_aws_detect_rbac_authorizations_by_account.yml +++ b/detections/deprecated/kubernetes_aws_detect_rbac_authorizations_by_account.yml @@ -3,7 +3,7 @@ id: de7264ed-3ed9-4fef-bb01-6eefc87cefe8 version: 1 date: '2020-06-23' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC diff --git a/detections/deprecated/kubernetes_aws_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_aws_detect_sensitive_object_access.yml index 21d05cd904..f8328b7e9e 100644 --- a/detections/deprecated/kubernetes_aws_detect_sensitive_object_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_sensitive_object_access.yml @@ -3,7 +3,7 @@ id: 7f227943-2196-4d4d-8d6a-ac8cb308e61c version: 1 date: '2020-06-23' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets diff --git a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml index 8bb7952bbb..ba55420b8f 100644 --- a/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_sensitive_role_access.yml @@ -3,7 +3,7 @@ id: b6013a7b-85e0-4a45-b051-10b252d69569 version: 1 date: '2020-06-23' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml index 488e619708..d1e057ffff 100644 --- a/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_aws_detect_service_accounts_forbidden_failure_access.yml @@ -3,7 +3,7 @@ id: a6959c57-fa8f-4277-bb86-7c32fba579d5 version: 1 date: '2020-06-23' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or diff --git a/detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml b/detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml index 8b4707c633..780d1cf698 100644 --- a/detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml +++ b/detections/deprecated/kubernetes_azure_detect_most_active_service_accounts_by_pod_namespace.yml @@ -3,7 +3,7 @@ id: 55a2264a-b7f0-45e5-addd-1e5ab3415c72 version: 1 date: '2020-05-26' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb diff --git a/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml b/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml index db726194d5..4c9561b264 100644 --- a/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml +++ b/detections/deprecated/kubernetes_azure_detect_rbac_authorization_by_account.yml @@ -3,7 +3,7 @@ id: 47af7d20-0607-4079-97d7-7a29af58b54e version: 1 date: '2020-05-26' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml index 168e7ec286..12c753aebc 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_sensitive_object_access.yml @@ -3,7 +3,7 @@ id: 1bba382b-07fd-4ffa-b390-8002739b76e8 version: 1 date: '2020-05-20' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml index a450da0f61..e32f8dd601 100644 --- a/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_sensitive_role_access.yml @@ -3,7 +3,7 @@ id: f27349e5-1641-4f6a-9e68-30402be0ad4c version: 1 date: '2020-05-20' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml index a962c9e318..a14ee3ccee 100644 --- a/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_azure_detect_service_accounts_forbidden_failure_access.yml @@ -3,7 +3,7 @@ id: 019690d7-420f-4da0-b320-f27b09961514 version: 1 date: '2020-05-20' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes service accounts with failure or forbidden access status diff --git a/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml b/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml index b21d8953f7..70160d42c1 100644 --- a/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml +++ b/detections/deprecated/kubernetes_azure_detect_suspicious_kubectl_calls.yml @@ -3,7 +3,7 @@ id: 4b6d1ba8-0000-4cec-87e6-6cbbd71651b5 version: 1 date: '2020-05-26' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on rare Kubectl calls with IP, verb namespace and object access context diff --git a/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml b/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml index 1a1776bef7..e156dd5fea 100644 --- a/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml +++ b/detections/deprecated/kubernetes_azure_pod_scan_fingerprint.yml @@ -3,7 +3,7 @@ id: 86aad3e0-732f-4f66-bbbc-70df448e461d version: 1 date: '2020-05-20' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster pod diff --git a/detections/deprecated/kubernetes_azure_scan_fingerprint.yml b/detections/deprecated/kubernetes_azure_scan_fingerprint.yml index 3ef3d1e31b..c9de50342d 100644 --- a/detections/deprecated/kubernetes_azure_scan_fingerprint.yml +++ b/detections/deprecated/kubernetes_azure_scan_fingerprint.yml @@ -3,7 +3,7 @@ id: c5e5bd5c-1013-4841-8b23-e7b3253c840a version: 1 date: '2020-05-19' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information of unauthenticated requests via source IP user agent, request URI and response status data against Kubernetes cluster in diff --git a/detections/deprecated/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml b/detections/deprecated/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml index 98d69d6283..750b41c93a 100644 --- a/detections/deprecated/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml +++ b/detections/deprecated/kubernetes_gcp_detect_RBAC_authorizations_by_account.yml @@ -3,7 +3,7 @@ id: 99487de3-7192-4b41-939d-fbe9acfb1340 version: 1 date: '2020-07-11' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC diff --git a/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml b/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml index 1a86f1d5af..a0f8e1f483 100644 --- a/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml +++ b/detections/deprecated/kubernetes_gcp_detect_most_active_service_accounts_by_pod.yml @@ -3,7 +3,7 @@ id: 7f5c2779-88a0-4824-9caa-0f606c8f260f version: 1 date: '2020-07-10' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision diff --git a/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml b/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml index 5059a9a42c..0c76f52509 100644 --- a/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_sensitive_object_access.yml @@ -3,7 +3,7 @@ id: bdb6d596-86a0-4aba-8369-418ae8b9963a version: 1 date: '2020-07-11' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmaps or secrets diff --git a/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml b/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml index fb918d9303..ba1132a38e 100644 --- a/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_sensitive_role_access.yml @@ -3,7 +3,7 @@ id: a46923f6-36b9-4806-a681-31f314907c30 version: 1 date: '2020-07-11' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets diff --git a/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml b/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml index e848982a7b..caa5b31d4f 100644 --- a/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml +++ b/detections/deprecated/kubernetes_gcp_detect_service_accounts_forbidden_failure_access.yml @@ -3,7 +3,7 @@ id: 7094808d-432a-48e7-bb3c-77e96c894f3b version: 1 date: '2020-06-23' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on Kubernetes service accounts with failure or forbidden access status, this search can be extended by using top or diff --git a/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml b/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml index 77ff7ccb53..53102e415b 100644 --- a/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml +++ b/detections/deprecated/kubernetes_gcp_detect_suspicious_kubectl_calls.yml @@ -3,7 +3,7 @@ id: a5bed417-070a-41f2-a1e4-82b6aa281557 version: 1 date: '2020-07-11' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context diff --git a/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml b/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml index d3bdd8e440..71126f8dd4 100644 --- a/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml +++ b/detections/deprecated/malicious_powershell_process___multiple_suspicious_command_line_arguments.yml @@ -3,7 +3,7 @@ id: 2cdb91d2-542c-497f-b252-be495e71f38c version: 6 date: '2021-01-19' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for PowerShell processes started with a base64 encoded diff --git a/detections/deprecated/monitor_dns_for_brand_abuse.yml b/detections/deprecated/monitor_dns_for_brand_abuse.yml index f3b89c7900..cb09af312d 100644 --- a/detections/deprecated/monitor_dns_for_brand_abuse.yml +++ b/detections/deprecated/monitor_dns_for_brand_abuse.yml @@ -3,7 +3,7 @@ id: 24dd17b1-e2fb-4c31-878c-d4f746595bfa version: 1 date: '2017-09-23' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Network_Resolution description: This search looks for DNS requests for faux domains similar to the domains diff --git a/detections/deprecated/open_redirect_in_splunk_web.yml b/detections/deprecated/open_redirect_in_splunk_web.yml index 1cf9106cdf..5a2bb550d4 100644 --- a/detections/deprecated/open_redirect_in_splunk_web.yml +++ b/detections/deprecated/open_redirect_in_splunk_web.yml @@ -3,7 +3,7 @@ id: d199fb99-2312-451a-9daa-e5efa6ed76a7 version: 1 date: '2017-09-19' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: [] description: This search allows you to look for evidence of exploitation for CVE-2016-4859, the Splunk Open Redirect Vulnerability. diff --git a/detections/deprecated/osquery_pack___coldroot_detection.yml b/detections/deprecated/osquery_pack___coldroot_detection.yml index d7b3bb164b..265acb0d8d 100644 --- a/detections/deprecated/osquery_pack___coldroot_detection.yml +++ b/detections/deprecated/osquery_pack___coldroot_detection.yml @@ -3,7 +3,7 @@ id: a6fffe5e-05c3-4c04-badc-887607fbb8dc version: 1 date: '2019-01-29' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for ColdRoot events from the osx-attacks osquery pack. search: '| from datamodel Alerts.Alerts | search app=osquery:results (name=pack_osx-attacks_OSX_ColdRoot_RAT_Launchd diff --git a/detections/deprecated/processes_created_by_netsh.yml b/detections/deprecated/processes_created_by_netsh.yml index af8ee13d4b..4635640981 100644 --- a/detections/deprecated/processes_created_by_netsh.yml +++ b/detections/deprecated/processes_created_by_netsh.yml @@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-95dbb162041e version: 5 date: '2020-11-23' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for processes launching netsh.exe to execute various diff --git a/detections/deprecated/prohibited_software_on_endpoint.yml b/detections/deprecated/prohibited_software_on_endpoint.yml index 04449d9dd2..30f50486b0 100644 --- a/detections/deprecated/prohibited_software_on_endpoint.yml +++ b/detections/deprecated/prohibited_software_on_endpoint.yml @@ -3,7 +3,7 @@ id: a51bfe1a-94f0-48cc-b4e4-b6ae50145893 version: 2 date: '2019-10-11' author: David Dorsey, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: This search looks for applications on the endpoint that you have marked diff --git a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml b/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml index c3634ec5be..8182e7cd1e 100644 --- a/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml +++ b/detections/deprecated/reg_exe_used_to_hide_files_directories_via_registry_keys.yml @@ -3,7 +3,7 @@ id: c77162d3-f93c-45cc-80c8-22f6b5264x9f version: 2 date: '2019-02-27' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The search looks for command-line arguments used to hide a file or directory diff --git a/detections/deprecated/remote_registry_key_modifications.yml b/detections/deprecated/remote_registry_key_modifications.yml index 90a7aed987..b19b14edba 100644 --- a/detections/deprecated/remote_registry_key_modifications.yml +++ b/detections/deprecated/remote_registry_key_modifications.yml @@ -3,7 +3,7 @@ id: c9f4b923-f8af-4155-b697-1354f5dcbc5e version: 3 date: '2020-03-02' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: [] description: This search monitors for remote modifications to registry keys. search: '| tstats `security_content_summariesonly` count values(Registry.registry_key_name) diff --git a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml b/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml index 5ba28b1a4b..1a167953a6 100644 --- a/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml +++ b/detections/deprecated/scheduled_tasks_used_in_badrabbit_ransomware.yml @@ -3,7 +3,7 @@ id: 1297fb80-f42a-4b4a-9c8b-78c066437cf6 version: 3 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for flags passed to schtasks.exe on the command-line diff --git a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml index 3ff5a0f3f4..f74d178fc5 100644 --- a/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml +++ b/detections/deprecated/spectre_and_meltdown_vulnerable_systems.yml @@ -3,7 +3,7 @@ id: 354be8e0-32cd-4da0-8c47-796de13b60ea version: 1 date: '2017-01-07' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Vulnerabilities description: The search is used to detect systems that are still vulnerable to the diff --git a/detections/deprecated/splunk_enterprise_information_disclosure.yml b/detections/deprecated/splunk_enterprise_information_disclosure.yml index 0545af8fbe..224b287aac 100644 --- a/detections/deprecated/splunk_enterprise_information_disclosure.yml +++ b/detections/deprecated/splunk_enterprise_information_disclosure.yml @@ -3,7 +3,7 @@ id: f6a26b7b-7e80-4963-a9a8-d836e7534ebd version: 1 date: '2018-06-14' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: [] description: This search allows you to look for evidence of exploitation for CVE-2018-11409, a Splunk Enterprise Information Disclosure Bug. diff --git a/detections/deprecated/suspicious_changes_to_file_associations.yml b/detections/deprecated/suspicious_changes_to_file_associations.yml index 4abd03ab4c..598e960be9 100644 --- a/detections/deprecated/suspicious_changes_to_file_associations.yml +++ b/detections/deprecated/suspicious_changes_to_file_associations.yml @@ -3,7 +3,7 @@ id: 1b989a0e-0129-4446-a695-f193a5b746fc version: 4 date: '2020-07-22' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for changes to registry values that control Windows file associations, executed by a process that is not typical for legitimate, routine diff --git a/detections/deprecated/suspicious_email___uba_anomaly.yml b/detections/deprecated/suspicious_email___uba_anomaly.yml index 8bf169bd00..d5c210d701 100644 --- a/detections/deprecated/suspicious_email___uba_anomaly.yml +++ b/detections/deprecated/suspicious_email___uba_anomaly.yml @@ -3,7 +3,7 @@ id: 56e877a6-1455-4479-ad16-0550dc1e33f8 version: 3 date: '2020-07-22' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: - UEBA description: This detection looks for emails that are suspicious because of their diff --git a/detections/deprecated/suspicious_file_write.yml b/detections/deprecated/suspicious_file_write.yml index b32734e8ec..ac13326196 100644 --- a/detections/deprecated/suspicious_file_write.yml +++ b/detections/deprecated/suspicious_file_write.yml @@ -3,7 +3,7 @@ id: 57f76b8a-32f0-42ed-b358-d9fa3ca7bac8 version: 3 date: '2019-04-25' author: Rico Valdez, Splunk -type: batch +type: Hunting datamodel: [] description: The search looks for files created with names that have been linked to malicious activity. diff --git a/detections/deprecated/suspicious_writes_to_system_volume_information.yml b/detections/deprecated/suspicious_writes_to_system_volume_information.yml index 6f23bee208..914cadf924 100644 --- a/detections/deprecated/suspicious_writes_to_system_volume_information.yml +++ b/detections/deprecated/suspicious_writes_to_system_volume_information.yml @@ -3,7 +3,7 @@ id: cd6297cd-2bdd-4aa1-84aa-5d2f84228fac version: 2 date: '2020-07-22' author: Rico Valdez, Splunk -type: batch +type: Hunting datamodel: [] description: This search detects writes to the 'System Volume Information' folder by something other than the System process. diff --git a/detections/deprecated/uncommon_processes_on_endpoint.yml b/detections/deprecated/uncommon_processes_on_endpoint.yml index 4d67853005..0147cb6fe1 100644 --- a/detections/deprecated/uncommon_processes_on_endpoint.yml +++ b/detections/deprecated/uncommon_processes_on_endpoint.yml @@ -3,7 +3,7 @@ id: 29ccce64-a10c-4389-a45f-337cb29ba1f7 version: 4 date: '2020-07-22' author: David Dorsey, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: This search looks for applications on the endpoint that you have marked diff --git a/detections/deprecated/unsigned_image_loaded_by_lsass.yml b/detections/deprecated/unsigned_image_loaded_by_lsass.yml index 72dfffd0d3..700945ab1b 100644 --- a/detections/deprecated/unsigned_image_loaded_by_lsass.yml +++ b/detections/deprecated/unsigned_image_loaded_by_lsass.yml @@ -3,7 +3,7 @@ id: 56ef054c-76ef-45f9-af4a-a634695dcd65 version: 1 date: '2019-12-06' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: This search detects loading of unsigned images by LSASS. Deprecated because too noisy. diff --git a/detections/deprecated/unsuccessful_netbackup_backups.yml b/detections/deprecated/unsuccessful_netbackup_backups.yml index e4df48fe26..3024be8a23 100644 --- a/detections/deprecated/unsuccessful_netbackup_backups.yml +++ b/detections/deprecated/unsuccessful_netbackup_backups.yml @@ -3,7 +3,7 @@ id: a34aae96-ccf8-4aaa-952c-3ea21444444f version: 1 date: '2017-09-12' author: David Dorsey, Splunk -type: batch +type: Hunting datamodel: [] description: This search gives you the hosts where a backup was attempted and then failed. diff --git a/detections/deprecated/web_fraud___account_harvesting.yml b/detections/deprecated/web_fraud___account_harvesting.yml index 15bc5d8ab6..69fa932710 100644 --- a/detections/deprecated/web_fraud___account_harvesting.yml +++ b/detections/deprecated/web_fraud___account_harvesting.yml @@ -3,7 +3,7 @@ id: 31337aaa-941d-4ada-81ac-q2a17be5bf0d version: 1 date: '2018-10-08' author: Jim Apger, Splunk -type: batch +type: TTP datamodel: [] description: This search is used to identify the creation of multiple user accounts using the same email domain name. diff --git a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml b/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml index 976958cd73..24d70128bf 100644 --- a/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml +++ b/detections/deprecated/web_fraud___anomalous_user_clickspeed.yml @@ -3,7 +3,7 @@ id: 31337bbb-bc22-4752-b599-ef192df2dc7a version: 1 date: '2018-10-08' author: Jim Apger, Splunk -type: batch +type: Anomaly datamodel: [] description: This search is used to examine web sessions to identify those where the clicks are occurring too quickly for a human or are occurring with a near-perfect diff --git a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml b/detections/deprecated/web_fraud___password_sharing_across_accounts.yml index f2a5f59b56..96810fe0a7 100644 --- a/detections/deprecated/web_fraud___password_sharing_across_accounts.yml +++ b/detections/deprecated/web_fraud___password_sharing_across_accounts.yml @@ -3,7 +3,7 @@ id: 31337a1a-53b9-4e05-96e9-55c934cb71d3 version: 1 date: '2018-10-08' author: Jim Apger, Splunk -type: batch +type: Anomaly datamodel: [] description: This search is used to identify user accounts that share a common password. search: '`stream_http` http_content_type=text* uri=/magento2/customer/account/loginPost* | diff --git a/detections/deprecated/windows_connhost_exe_force_flag.yml b/detections/deprecated/windows_connhost_exe_force_flag.yml index 28cf5d9213..64eaca9ff0 100644 --- a/detections/deprecated/windows_connhost_exe_force_flag.yml +++ b/detections/deprecated/windows_connhost_exe_force_flag.yml @@ -3,7 +3,7 @@ id: c114aaca-68ee-41c2-ad8c-32bf21db8769 version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk -type: batch +type: TTP datamodel: [] description: 'The search looks for the Console Window Host process (connhost.exe) executed using the force flag -ForceV1. This is not regular behavior in the Windows diff --git a/detections/deprecated/windows_hosts_file_modification.yml b/detections/deprecated/windows_hosts_file_modification.yml index d33d175546..14541930ec 100644 --- a/detections/deprecated/windows_hosts_file_modification.yml +++ b/detections/deprecated/windows_hosts_file_modification.yml @@ -3,7 +3,7 @@ id: 06a6fc63-a72d-41dc-8736-7e3dd9612116 version: 1 date: '2018-11-02' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: [] description: The search looks for modifications to the hosts file on all Windows endpoints across your environment. diff --git a/detections/endpoint/access_lsass_memory_for_dump_creation.yml b/detections/endpoint/access_lsass_memory_for_dump_creation.yml index a05bc04179..e696dc1e22 100644 --- a/detections/endpoint/access_lsass_memory_for_dump_creation.yml +++ b/detections/endpoint/access_lsass_memory_for_dump_creation.yml @@ -3,7 +3,7 @@ id: fb4c31b0-13e8-4155-8aa5-24de4b8d6717 version: 2 date: '2019-12-06' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: Detect memory dumping of the LSASS process. search: '`sysmon` EventCode=10 TargetImage=*lsass.exe CallTrace=*dbgcore.dll* OR CallTrace=*dbghelp.dll* diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index d6b9650a94..8a98e5c6ef 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -3,7 +3,7 @@ id: 339805ce-ac30-11eb-b87d-acde48001122 version: 1 date: '2021-05-03' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to detect a potential account discovery series of command diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 1e645ecf3a..2612ea28d4 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -3,7 +3,7 @@ id: ce27646e-d411-11eb-8a00-acde48001122 version: 1 date: '2021-06-23' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious modification of firewall to allow diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 7ed08711ab..180f452eba 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -3,7 +3,7 @@ id: 0a46537c-be02-11eb-92ca-acde48001122 version: 1 date: '2021-05-26' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic detects a potential suspicious modification of firewall diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index 73acfefa3d..18f14a25f8 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -3,7 +3,7 @@ id: a5d85486-b89c-11eb-8267-acde48001122 version: 1 date: '2021-05-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect suspicious powershell command to allow inbound diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index e6be861c52..df071968db 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -3,7 +3,7 @@ id: ccd6a38c-d40b-11eb-85a5-acde48001122 version: 1 date: '2021-06-23' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious modification to the firewall to diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 9cb0f6339a..9402d8ed42 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -3,7 +3,7 @@ id: 7de17d7a-c9d8-11eb-a812-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to detect a potential privilege escalation attempt to diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 38a56f4a0c..843064ae88 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -3,7 +3,7 @@ id: 9364ee8e-a39a-11eb-8f1d-acde48001122 version: 1 date: '2021-04-22' author: Michael Haag, Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: The following detection identifies a 7z.exe spawned from `Rundll32.exe` diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index afe2f0cf0b..d8d90933e9 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -3,7 +3,7 @@ id: 1a93b7ea-7af7-11eb-adb5-acde48001122 version: 1 date: '2021-03-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies the use of PowerShell downloading a diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 018246a866..8c6dbf5989 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -3,7 +3,7 @@ id: 4d015ef2-7adf-11eb-95da-acde48001122 version: 1 date: '2021-03-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies the use of PowerShell downloading a diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index acce9785f0..2399026e96 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -3,7 +3,7 @@ id: a51bfe1a-94f0-48cc-b4e4-16a110145893 version: 1 date: '2021-06-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for execution of commonly used attacker tools on an diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index 67dd384c0f..978ab958d3 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -3,7 +3,7 @@ id: 6bc5243e-ef36-45dc-9b12-f4a6be131159 version: 6 date: '2020-11-03' author: Patrick Bareiss, Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Attempt To Add Certificate To Untrusted Store diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 6c0655b9d5..e1fc4c86e5 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -3,7 +3,7 @@ id: c8e349c6-b97c-486e-8949-bd7bcd1f3910 version: 3 date: '2020-07-21' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for attempts to stop security-related services on the diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 02e8ec9d35..702ff98e5c 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -3,7 +3,7 @@ id: e9fb4a59-c5fb-440a-9f24-191fbc6b2911 version: 4 date: '2019-12-02' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Monitor for execution of reg.exe with parameters specifying an export diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index c5ce575bf0..c79aeab75a 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -3,7 +3,7 @@ id: 503d17cb-9eab-4cf8-a20e-01d5c6987ae3 version: 1 date: '2018-12-14' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The search looks for a batch file (.bat) written to the Windows system diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 505506d6dd..6cdc35809b 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -3,7 +3,7 @@ id: 809b31d2-5462-11eb-ae93-0242ac130002 version: 1 date: '2020-12-21' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for flags passed to bcdedit.exe modifications to the diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index e455aba1d1..7d2bbd4860 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -3,7 +3,7 @@ id: e97a5ffe-90bf-11eb-928a-acde48001122 version: 1 date: '2021-03-29' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following query identifies Microsoft Background Intelligent Transfer diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index e63975b329..110aaa1231 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -3,7 +3,7 @@ id: 80630ff4-8e4c-11eb-aab5-acde48001122 version: 1 date: '2021-03-26' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following query identifies Microsoft Background Intelligent Transfer diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 2ec1788a60..03f1b47305 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -3,7 +3,7 @@ id: 415b4306-8bfb-11eb-85c4-acde48001122 version: 1 date: '2021-03-23' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Certutil.exe may download a file from a remote destination using `-urlcache`. diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index 90045fc832..e0d5ff4965 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -3,7 +3,7 @@ id: 801ad9e4-8bfb-11eb-8b31-acde48001122 version: 1 date: '2021-03-23' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index f26bdc96b6..347b60c9fb 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -3,7 +3,7 @@ id: 337a46be-600f-11eb-ae93-0242ac130002 version: 1 date: '2021-01-26' author: Rod Soto, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for arguments to certutil.exe indicating the manipulation diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 4daa11119d..4f4724f415 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -3,7 +3,7 @@ id: bfe94226-8c10-11eb-a4b3-acde48001122 version: 1 date: '2021-03-23' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: CertUtil.exe may be used to `encode` and `decode` a file, including PE diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index d174940b40..3edb4c6bb0 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -3,7 +3,7 @@ id: cd80a6ac-c9d9-11eb-8839-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to detect execution of cipher.exe to clear the unallocated diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index 9e3a9f6e63..ae6891bb98 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -3,7 +3,7 @@ id: 5a8a2a72-8322-11eb-9ee9-acde48001122 version: 1 date: '2021-03-17' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytics are designed to identifies some CLOP ransomware diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml index 7dcf383e02..38d8995cfb 100644 --- a/detections/endpoint/clop_ransomware_known_service_name.yml +++ b/detections/endpoint/clop_ransomware_known_service_name.yml @@ -3,7 +3,7 @@ id: 07e08a12-870c-11eb-b5f9-acde48001122 version: 1 date: '2021-03-17' author: Teoderick Contreras -type: batch +type: TTP datamodel: - Endpoint description: This detection is to identify the common service name created by the diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index c1106006cd..2fa61f897a 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -3,7 +3,7 @@ id: eb277ba0-b96b-11eb-b00e-acde48001122 version: 1 date: '2021-05-20' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies a common behavior by Cobalt Strike and other diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index e6c7b05114..9a983d4980 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -3,7 +3,7 @@ id: f87b5062-b405-11eb-a889-acde48001122 version: 1 date: '2021-05-13' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic detects a potential process using COM Object like CMLUA diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 4ca9db964b..93bf3cdda8 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -3,7 +3,7 @@ id: 5876d429-0240-4709-8b93-ea8330b411b5 version: 1 date: '2021-02-22' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic identifies the use of default or publicly known named pipes used with Cobalt Strike. A named pipe is a named, one-way or duplex diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 2e0b65de31..4eeb714a47 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -3,7 +3,7 @@ id: a9e5c5db-db11-43ca-86a8-c852d1b2c0ec version: 4 date: '2020-11-09' author: David Dorsey, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: The search looks for file modifications with extensions commonly used diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index f0fd2e002a..de263bbb2a 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -3,7 +3,7 @@ id: ada0f478-84a8-4641-a3f1-d82362d6bd71 version: 4 date: '2020-11-09' author: David Dorsey, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: The search looks for files created with names matching those typically diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index fcbca28a76..2370cb45e8 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -3,7 +3,7 @@ id: 624919bc-c382-11eb-adcc-acde48001122 version: 1 date: '2021-06-02' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search detects the suspicious commandline argument of revil ransomware diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 84f445454c..a11b1741d1 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-151bb162040e version: 4 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for the creation of local administrator accounts using diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index e397763cf0..c9508bfe80 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -3,7 +3,7 @@ id: qw9919ed-fe5f-492c-b139-151bb162140e version: 5 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for the creation or deletion of hidden shares using diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index d2e325f42f..081f5b8645 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -3,7 +3,7 @@ id: 67d4dbef-9564-4699-8da8-03a151529edc version: 1 date: '2019-12-06' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: Detect remote thread creation into LSASS consistent with credential dumping. search: '`sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as firstTime diff --git a/detections/endpoint/create_service_in_suspicious_file_path.yml b/detections/endpoint/create_service_in_suspicious_file_path.yml index 8da97e16a6..c1914b22f0 100644 --- a/detections/endpoint/create_service_in_suspicious_file_path.yml +++ b/detections/endpoint/create_service_in_suspicious_file_path.yml @@ -3,7 +3,7 @@ id: 429141be-8311-11eb-adb6-acde48001122 version: 1 date: '2021-03-12' author: Teoderick Contreras -type: batch +type: TTP datamodel: - Endpoint description: This detection is to identify a creation of "user mode service" where diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 97bc078628..41c98dcfe0 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -3,7 +3,7 @@ id: b2fbe95a-9c62-4c12-8a29-24b97e84c0cd version: 1 date: '2020-02-03' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 7b2fdfb622..0c1a7e4f7a 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -3,7 +3,7 @@ id: eb120f5f-b879-4a63-97c1-93352b5df844 version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index a61e3fdb17..2c11becb83 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -3,7 +3,7 @@ id: 2ed8b538-d284-449a-be1d-82ad1dbd186b version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search detects the use of wmic and Powershell to create a shadow diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 7653ea932e..df71a58d27 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -3,7 +3,7 @@ id: d8c406fe-23d2-45f3-a983-1abe7b83ff3b version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search detects credential dumping using copy command from a shadow diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 3a7d2528de..29dd1e2c65 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -3,7 +3,7 @@ id: c5eac648-fae0-4263-91a6-773df1f4c903 version: 1 date: '2019-12-10' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search detects the creation of a symlink to a shadow copy. diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 45654fa208..2a8e372a5d 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -3,7 +3,7 @@ id: 5ee2bcd0-b2ff-11eb-bb34-acde48001122 version: 1 date: '2021-05-12' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This following analytic detects PowerShell command to delete shadow copy diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index 1518f92ff7..265b63dc95 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -3,7 +3,7 @@ id: 1c8c6f66-acce-11eb-aafb-acde48001122 version: 1 date: '2021-05-04' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic will detect a suspicious net.exe/net1.exe command-line diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 4209216b6d..d59f78e007 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -3,7 +3,7 @@ id: b89919ed-ee5f-492c-b139-95dbb162039e version: 4 date: '2020-11-09' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml index 27c04e1afd..7a76b3179c 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml @@ -3,7 +3,7 @@ id: f5939373-8054-40ad-8c64-cec478a22a4b version: 5 date: '2020-10-15' author: Bhavin Patel, Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts at using the Pass-the-Hash technique. diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index f3112ae042..8fea90d3af 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -3,7 +3,7 @@ id: 26f02e96-c300-11eb-b611-acde48001122 version: 1 date: '2021-06-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies the common command-line argument used diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index 053214f054..a9a8e82dfa 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -3,7 +3,7 @@ id: 1c34549e-c31b-11eb-996b-acde48001122 version: 1 date: '2021-06-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic is similar to SharpHound file modifications, but diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml index 2cd5d2de88..da01d70c0d 100644 --- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml +++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml @@ -3,7 +3,7 @@ id: 1400624a-d42d-484d-8843-e6753e6e3645 version: 1 date: '2020-09-18' author: Rod Soto, Jose Hernandez, Splunk -type: batch +type: Hunting datamodel: [] description: This search looks for Event Code 4742 (Computer Change) or EventCode 4624 (An account was successfully logged on) with an anonymous account. diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 2c29b0c714..4702d0394f 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -3,7 +3,7 @@ id: 2c365e57-4414-4540-8dc0-73ab10729996 version: 3 date: '2019-12-03' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for reading lsass memory consistent with credential dumping. diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml index ed1a8281fd..215eb05629 100644 --- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml @@ -3,7 +3,7 @@ id: bc1dc6b8-c954-11eb-bade-acde48001122 version: 1 date: '2021-06-09' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index 1c1581db8c..5b6a326689 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -3,7 +3,7 @@ id: c026e3dd-7e18-4abb-8f41-929e836efe74 version: 5 date: '2020-11-09' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search identifies endpoints that have caused a relatively high number diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index 087893be3e..59ee48c2cd 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -3,7 +3,7 @@ id: 95a7f9a5-6096-437e-a19e-86f42ac609bd version: 3 date: '2020-07-21' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search detects user accounts that have been locked out a relatively diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 65c47b13d3..90e31dc234 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -3,7 +3,7 @@ id: 8c14eeee-2af1-4a4b-bda8-228da0f4862a version: 2 date: '2021-03-09' author: Michael Haag, Shannon Davis, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'The following query identifies suspicious .aspx created in 3 paths identified diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 80bb170475..d7a55cc7d2 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -3,7 +3,7 @@ id: 62fed254-513b-460e-953d-79771493a9f3 version: 1 date: '2021-02-11' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 979134d257..af1fd1854e 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -3,7 +3,7 @@ id: 723716de-ee55-4cd4-9759-c44e7e55ba4b version: 1 date: '2021-02-11' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index f7cf29ee5f..99d390b0f0 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -3,7 +3,7 @@ id: 8c5835b9-39d9-438b-817c-95f14c69a31e version: 1 date: '2021-02-11' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 484268fc4a..4d3fb82576 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -3,7 +3,7 @@ id: 0b2eefa5-5508-450d-b970-3dd2fb761aec version: 1 date: '2021-02-11' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index 567c7f6913..de6cda4358 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -3,7 +3,7 @@ id: 29e307ba-40af-4ab2-91b2-3c6b392bbba0 version: 1 date: '2019-12-03' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for reading loaded Images unique to credential dumping with Mimikatz. Deprecated because mimikatz libraries changed and very noisy sysmon diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 029c7e1def..442c9c2a21 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -3,7 +3,7 @@ id: 8148c29c-c952-11eb-9255-acde48001122 version: 1 date: '2021-06-09' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index cf0143c90f..c37a743cfe 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -3,7 +3,7 @@ id: a0873b32-5b68-11eb-ae93-0242ac130002 version: 5 date: '2021-01-20' author: Bhavin Patel, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies "mshta.exe" execution with inline protocol diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 34972cca41..9746c48b7b 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -3,7 +3,7 @@ id: 8f45fcf0-5b68-11eb-ae93-0242ac130002 version: 1 date: '2021-01-20' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 26183d67d0..2e411bb9d0 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -3,7 +3,7 @@ id: 9b3af1e6-5b68-11eb-ae93-0242ac130002 version: 1 date: '2021-01-20' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 3475b05b9f..630b72f57f 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -3,7 +3,7 @@ id: b25f6f62-0712-43c1-b203-083231ffd97d version: 2 date: '2020-07-08' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for newly created accounts that have been elevated to local administrators. diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index b330ccef74..14b24f8fb5 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -3,7 +3,7 @@ id: c77162d3-f93c-45cc-80c8-22f6v5264g9f version: 3 date: '2020-07-03' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'The detection Detect Path Interception By Creation Of program exe is diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index cf874d103c..3c308b1269 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -3,7 +3,7 @@ id: a51bfe1a-94f0-48cc-b1e4-16ae10145893 version: 2 date: '2020-11-10' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for fast execution of processes used for system network diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index c75e68cbec..3e9239f8dc 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -3,7 +3,7 @@ id: dcfd6b40-42f9-469d-a433-2e53f7486664 version: 5 date: '2020-11-10' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: This search looks for executions of cmd.exe spawned by a process that diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 4853444bb1..64a61b06eb 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-151xb162040e version: 3 date: '2020-11-10' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for events where `PsExec.exe` is run with the `accepteula` diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index af35807b1c..f8f33cd5a5 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -3,7 +3,7 @@ id: 32e0baea-b3f1-11eb-a2ce-acde48001122 version: 1 date: '2021-05-13' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies commonly used command-line arguments used by diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index b98d0fe9f8..cddf0fb83a 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -3,7 +3,7 @@ id: 72170ec5-f7d2-42f5-aefb-2b8be6aad15f version: 1 date: '2021-02-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies regasm.exe spawning a process. This diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index cb935b0f85..1416a1829b 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -3,7 +3,7 @@ id: 07921114-6db4-4e2e-ae58-3ea8a52ae93f version: 1 date: '2021-02-16' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies regasm.exe with a network connection to a public IP address, exluding private IP space. This particular technique has diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 37cce4746c..0805963a28 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -3,7 +3,7 @@ id: c3bc1430-04e7-4178-835f-047d8e6e97df version: 1 date: '2021-02-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index 852c8379c1..089f71fae4 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -3,7 +3,7 @@ id: bc477b57-5c21-4ab6-9c33-668772e7f114 version: 1 date: '2021-02-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies regsvcs.exe spawning a process. This diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index f58d167364..bb97538e59 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -3,7 +3,7 @@ id: e3e7a1c0-f2b9-445c-8493-f30a63522d1a version: 1 date: '2021-02-16' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies Regsvcs.exe with a network connection to a public IP address, exluding private IP space. This particular technique has diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 47bbffd0a1..597bb68bd3 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -3,7 +3,7 @@ id: 6b74d578-a02e-4e94-a0d1-39440d0bf254 version: 1 date: '2021-02-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index 038b0495f4..bcdaf55858 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -3,7 +3,7 @@ id: 070e9b80-6252-11eb-ae93-0242ac130002 version: 1 date: '2021-01-28' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 2e22aba088..c6c4025085 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -3,7 +3,7 @@ id: 4057291a-b8cf-11eb-95fe-acde48001122 version: 1 date: '2021-05-19' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies renamed 7-Zip usage using Sysmon. At diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index d66e0892fd..69ed7eb5db 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -3,7 +3,7 @@ id: 683e6196-b8e8-11eb-9a79-acde48001122 version: 1 date: '2021-05-19' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies renamed instances of `PsExec.exe` being diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 564bf81adb..96fdc051b5 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -3,7 +3,7 @@ id: 6dca1124-b3ec-11eb-9328-acde48001122 version: 1 date: '2021-05-13' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index c769a95800..ccb117ef13 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -3,7 +3,7 @@ id: 1b7bfb2c-b8e6-11eb-99ac-acde48001122 version: 1 date: '2021-05-19' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analtyic identifies renamed instances of `WinRAR.exe`. diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index ededc6777c..59e28173a1 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -3,7 +3,7 @@ id: 4aefadfe-9abd-4bf8-b3fd-867e9ef95bf8 version: 1 date: '2021-02-04' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies rundll32.exe loading advpack.dll and diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index ef478ee546..f902e282bd 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -3,7 +3,7 @@ id: 61e7b44a-6088-4f26-b788-9a96ba13b37a version: 1 date: '2021-02-04' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies rundll32.exe loading setupapi.dll and diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 03925c4d56..cd5e4eef81 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -3,7 +3,7 @@ id: 71b9bf37-cde1-45fb-b899-1b0aa6fa1183 version: 1 date: '2021-02-04' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies rundll32.exe loading syssetup.dll by diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 56418cd2fc..6c3f60a35f 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -3,7 +3,7 @@ id: 91c79f14-5b41-11eb-ae93-0242ac130002 version: 1 date: '2021-01-20' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies "rundll32.exe" execution with inline diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index 55a66bff9d..e81771756e 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -3,7 +3,7 @@ id: a0bdd2f6-c2ff-11eb-b918-acde48001122 version: 1 date: '2021-06-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies common command-line arguments used diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index cf4a258200..daef8e869a 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -3,7 +3,7 @@ id: 42b4b438-beed-11eb-ba1d-acde48001122 version: 1 date: '2021-05-27' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index 1271ab6adf..63c7cd6de3 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -3,7 +3,7 @@ id: dd04b29a-beed-11eb-87bc-acde48001122 version: 1 date: '2021-05-27' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies SharpHound binary usage by using the diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index a437f2bc42..6e08f0f99e 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-95dbb162039e version: 4 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for the execution of the cscript.exe or wscript.exe diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index 4ae958509f..afd9498df4 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -3,7 +3,7 @@ id: 01d9a0c2-cece-11eb-ab46-acde48001122 version: 1 date: '2021-06-16' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index eb39ed482f..893026ae11 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -3,7 +3,7 @@ id: 9c27ec42-d338-11eb-9044-acde48001122 version: 1 date: '2021-06-22' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to identify modification in registry to disable AMSI windows diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index 21578dd058..8e62da2998 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -3,7 +3,7 @@ id: f0eacfa4-d33f-11eb-8f9d-acde48001122 version: 1 date: '2021-06-22' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to identify modification in registry to disable ETW windows diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index c5dad1d238..4d7966cb1b 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -3,7 +3,7 @@ id: 236e7c8e-c9d9-11eb-a824-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect execution of wevtutil.exe to disable logs. This diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 692aff2d33..d8e5d1f958 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -3,7 +3,7 @@ id: cd2cf33c-9201-11eb-a10a-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to identifies modification of registry to disable the diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index 19047251b2..2786c372a0 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -3,7 +3,7 @@ id: 6f3ccfa2-91fe-11eb-8f9b-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following search is to idetifies a modification in registry to prevent diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index 704bdc192d..ba15205198 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -3,7 +3,7 @@ id: 1490f224-ad8b-11eb-8c4f-acde48001122 version: 1 date: '2021-05-05' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic detects a suspicious registry modification to disable Windows diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 72f6bb866a..15feb41f54 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -3,7 +3,7 @@ id: 79439cae-9200-11eb-a4d3-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to identifies a modification in registry to disable the diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index c86d9eff68..3716da0910 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -3,7 +3,7 @@ id: 664f0fd0-91ff-11eb-a56f-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following search identifies a modification of registry to disable diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 2fbb659e41..f6d39ff03d 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -3,7 +3,7 @@ id: ff86077c-9212-11eb-a1e6-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to identify modification in registry to disable cmd prompt diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index d25066e65d..a7e4db0749 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -3,7 +3,7 @@ id: 6ae0148e-9215-11eb-a94a-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to identify registry modification to disable control panel diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index 572993638b..cd5ab9d7d5 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -3,7 +3,7 @@ id: 6860a62c-9203-11eb-9e05-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to identifies suspicious firewall disabling using netsh diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index 25071310bb..7866928e80 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -3,7 +3,7 @@ id: 83776de4-921a-11eb-868a-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to identify registry modification to disable folder options diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index ef36c58a14..7420b735e6 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -3,7 +3,7 @@ id: c0325326-acd6-11eb-98c2-acde48001122 version: 1 date: '2021-05-04' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic will identify a suspicious command-line that disables a diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index a6d5beef11..65568eb051 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -3,7 +3,7 @@ id: de81bc46-9213-11eb-adc9-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to identify modification of registry to disable run application diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index 7983188c01..f75d99dabc 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -3,7 +3,7 @@ id: bbc644bc-37df-4e1a-9c88-ec9a53e2038c version: 4 date: '2020-11-18' author: David Dorsey, Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 0de4f02151..74090610ee 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -3,7 +3,7 @@ id: f4f837e2-91fb-11eb-8bf6-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following search identifies the modification of registry related diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index 35d551fed1..d4297e6a78 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -3,7 +3,7 @@ id: dac279bc-9202-11eb-b7fb-acde48001122 version: 1 date: '2021-03-31' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to identifies modification of registry to disable the diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 1aa342dae6..750c394ee8 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -3,7 +3,7 @@ id: f1c07594-a141-11eb-8407-acde48001122 version: 1 date: '2021-04-19' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies DLLHost.exe with no command line arguments diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 0e2e70d158..848d16a67a 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -3,7 +3,7 @@ id: 2452e632-9e0d-11eb-bacd-acde48001122 version: 1 date: '2021-04-15' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to detect potential DNS exfiltration using nslookup application. diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index da85779daf..dec3fd55c2 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -3,7 +3,7 @@ id: 58194e28-ae5e-11eb-8912-acde48001122 version: 1 date: '2021-05-06' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic will identify a suspicious download by the Telegram diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index 349876a1bc..37eb21e928 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -3,7 +3,7 @@ id: cc316032-924a-11eb-91a2-acde48001122 version: 1 date: '2021-03-31' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'The following analytic identifies "dsquery.exe" execution with arguments diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index 94140f45e3..052b757a01 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -3,7 +3,7 @@ id: 8943b567-f14d-4ee8-a0bb-2121d4ce3184 version: 1 date: '2020-02-21' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Detect the usage of comsvcs.dll for dumping the lsass process. diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index 8a49c832ac..c7cc78a606 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -3,7 +3,7 @@ id: 3742ebfe-64c2-11eb-ae93-0242ac130002 version: 1 date: '2021-02-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'Detect procdump.exe dumping the lsass process. This query looks for diff --git a/detections/endpoint/dump_lsass_via_procdump_rename.yml b/detections/endpoint/dump_lsass_via_procdump_rename.yml index cf666556d2..0f06bd3758 100644 --- a/detections/endpoint/dump_lsass_via_procdump_rename.yml +++ b/detections/endpoint/dump_lsass_via_procdump_rename.yml @@ -3,7 +3,7 @@ id: 21276daa-663d-11eb-ae93-0242ac130002 version: 1 date: '2021-02-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'Detect a renamed instance of procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index a205a09ecf..19aee841e8 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -3,7 +3,7 @@ id: 99495452-b899-11eb-96dc-acde48001122 version: 1 date: '2021-05-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a modification to registry to enable rdp to diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index 112b7e82c4..5fba9e2c9b 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -3,7 +3,7 @@ id: fcd74532-ae54-11eb-a5ab-acde48001122 version: 1 date: '2021-05-06' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic will detect a suspicious Telegram process enumerating all diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 254a89981b..fb1cbc6074 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -3,7 +3,7 @@ id: 9cf8fe08-7ad8-11eb-9819-acde48001122 version: 1 date: '2021-03-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following search identifies Eventvwr bypass by identifying the registry diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index f6ad6b0b6f..d9dd756f23 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -3,7 +3,7 @@ id: 42d40a22-9be3-11eb-8f08-acde48001122 version: 1 date: '2021-04-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following detection identifies Microsoft Excel spawning PowerShell. diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index ae6783ebf5..02b930fed4 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -3,7 +3,7 @@ id: 57fe880a-9be3-11eb-9bf3-acde48001122 version: 1 date: '2021-04-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following detection identifies Microsoft Excel spawning Windows Script diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 824acc3be4..d99a17f0d4 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -3,7 +3,7 @@ id: 8fa2a0f0-acd9-11eb-8994-acde48001122 version: 1 date: '2021-05-04' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This analytic will identify suspicious series of command-line to disable diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml index 321c5b6a45..af9948fcac 100644 --- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml +++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml @@ -3,7 +3,7 @@ id: 23587b6a-c479-11eb-b671-acde48001122 version: 1 date: '2021-06-03' author: Michael Hart, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This analytic will identify suspicious series of process executions. We diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index 932e6ea2d0..bd155c6482 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -3,7 +3,7 @@ id: 77592bec-d5cc-11eb-9e60-acde48001122 version: 1 date: '2021-06-25' author: Michael Hart, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This detection targets behaviors observed when threat actors have used diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 52a5537505..e16a91c755 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -3,7 +3,7 @@ id: f443dac2-c7cf-11eb-ab51-acde48001122 version: 1 date: '2021-06-07' author: Michael Hart -type: batch +type: Anomaly datamodel: - Endpoint description: This detection targets behaviors observed in post exploit kits like Meterpreter diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 6517547594..eb62ede8cf 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -3,7 +3,7 @@ id: ae8d3f4a-acd7-11eb-8846-acde48001122 version: 1 date: '2021-05-04' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This analytic identifies suspicious series of attempt to kill multiple diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 4810bb92c0..67ce63175c 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -3,7 +3,7 @@ id: 0bdf6092-af17-11eb-939a-acde48001122 version: 1 date: '2021-05-07' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 5a42e4f653..ec3b8151cf 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -3,7 +3,7 @@ id: 45e52536-ae42-11eb-b5c6-acde48001122 version: 1 date: '2021-05-06' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This analytic identifies excessive usage of `net.exe` or `net1.exe` within diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index ad992c7157..9ffd9a1c6b 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -3,7 +3,7 @@ id: 0a69fdaa-a2b8-11eb-b16d-acde48001122 version: 1 date: '2021-04-21' author: Teoderick Contreras, Stanislav Miskovic, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: this search is to detect potential DNS exfiltration using nslookup application. diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 7310ea2517..b744ba7619 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -3,7 +3,7 @@ id: cb6b339e-d4c6-11eb-a026-acde48001122 version: 1 date: '2021-06-24' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This search is to detect a suspicious excessive usage of sc.exe in a diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 7af5a861e7..2cce1cf838 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -3,7 +3,7 @@ id: fe5bca48-accb-11eb-a67c-acde48001122 version: 1 date: '2021-05-04' author: Teoderick Contreras, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This analytic identifies excessive usage of `taskkill.exe` application. diff --git a/spec/detections.spec.json b/spec/detections.spec.json index 14b619fcf2..f3450d5fc4 100644 --- a/spec/detections.spec.json +++ b/spec/detections.spec.json @@ -127,12 +127,16 @@ "default": "", "description": "type of detection", "examples": [ - "streaming" + "Anomaly" ], "items": { "enum": [ - "batch", - "streaming" + "TTP", + "Anomaly", + "Hunting", + "Baseline", + "Investigation", + "Correlation" ], "type": "string" }, From 4ddd09fd871092ae0f80f6546fce388eef06999b Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 19 Jul 2021 17:12:54 +0200 Subject: [PATCH 02/21] add analytic types to detections --- .../executables_or_script_creation_in_suspicious_path.yml | 2 +- .../endpoint/execute_javascript_with_jscript_com_clsid.yml | 2 +- .../endpoint/execution_of_file_with_multiple_extensions.yml | 2 +- detections/endpoint/file_with_samsam_extension.yml | 2 +- detections/endpoint/first_time_seen_child_process_of_zoom.yml | 2 +- detections/endpoint/fodhelper_uac_bypass.yml | 2 +- .../gpupdate_with_no_command_line_arguments_with_network.yml | 2 +- detections/endpoint/hide_user_account_from_sign_in_screen.yml | 2 +- .../endpoint/hiding_files_and_directories_with_attrib_exe.yml | 2 +- detections/endpoint/high_file_deletion_frequency.yml | 2 +- detections/endpoint/high_process_termination_frequency.yml | 2 +- detections/endpoint/icacls_deny_command.yml | 2 +- detections/endpoint/icacls_grant_command.yml | 2 +- .../endpoint/kerberoasting_spn_request_with_rc4_encryption.yml | 2 +- detections/endpoint/known_services_killed_by_ransomware.yml | 2 +- detections/endpoint/mailsniper_invoke_functions.yml | 2 +- .../endpoint/malicious_powershell_executed_as_a_service.yml | 2 +- ...ershell_process___connect_to_internet_with_hidden_window.yml | 2 +- .../endpoint/malicious_powershell_process___encoded_command.yml | 2 +- .../malicious_powershell_process___execution_policy_bypass.yml | 2 +- ...malicious_powershell_process_with_obfuscation_techniques.yml | 2 +- detections/endpoint/modification_of_wallpaper.yml | 2 +- .../endpoint/modify_acl_permission_to_files_or_folder.yml | 2 +- .../endpoint/monitor_registry_keys_for_print_monitors.yml | 2 +- detections/endpoint/msmpeng_application_dll_side_loading.yml | 2 +- ...d_users_failing_to_authenticate_from_host_using_kerberos.yml | 2 +- ...d_users_failing_to_authenticate_from_host_using_kerberos.yml | 2 +- ...valid_users_failing_to_authenticate_from_host_using_ntlm.yml | 2 +- ...rs_attempting_to_authenticate_using_explicit_credentials.yml | 2 +- ...e_users_failing_to_authenticate_from_host_using_kerberos.yml | 2 +- ...tiple_users_failing_to_authenticate_from_host_using_ntlm.yml | 2 +- .../multiple_users_failing_to_authenticate_from_process.yml | 2 +- ...ultiple_users_remotely_failing_to_authenticate_from_host.yml | 2 +- detections/endpoint/nishang_powershelltcponeline.yml | 2 +- detections/endpoint/nltest_domain_trust_discovery.yml | 2 +- detections/endpoint/ntdsutil_export_ntds.yml | 2 +- .../endpoint/office_application_spawn_rundll32_process.yml | 2 +- detections/endpoint/office_document_creating_schedule_task.yml | 2 +- detections/endpoint/office_document_executing_macro_code.yml | 2 +- .../office_document_spawned_child_process_to_download.yml | 2 +- detections/endpoint/office_product_spawning_bitsadmin.yml | 2 +- detections/endpoint/office_product_spawning_certutil.yml | 2 +- detections/endpoint/office_product_spawning_mshta.yml | 2 +- .../endpoint/office_product_spawning_rundll32_with_no_dll.yml | 2 +- detections/endpoint/office_product_spawning_wmic.yml | 2 +- detections/endpoint/overwriting_accessibility_binaries.yml | 2 +- .../endpoint/permission_modification_using_takeown_app.yml | 2 +- detections/endpoint/powershell_creating_thread_mutex.yml | 2 +- detections/endpoint/powershell_disable_security_monitoring.yml | 2 +- detections/endpoint/powershell_domain_enumeration.yml | 2 +- detections/endpoint/powershell_enable_smb1protocol_feature.yml | 2 +- ...powershell_fileless_process_injection_via_getprocaddress.yml | 2 +- ...wershell_fileless_script_contains_base64_encoded_content.yml | 2 +- ...oading_dotnet_into_memory_via_system_reflection_assembly.yml | 2 +- detections/endpoint/powershell_processing_stream_of_data.yml | 2 +- .../powershell_remote_thread_to_known_windows_process.yml | 2 +- detections/endpoint/powershell_start_bitstransfer.yml | 2 +- .../endpoint/powershell_using_memory_as_backing_store.yml | 2 +- .../endpoint/prevent_automatic_repair_mode_using_bcdedit.yml | 2 +- detections/endpoint/print_spooler_adding_a_printer_driver.yml | 2 +- detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml | 2 +- .../process_creating_lnk_file_in_suspicious_location.yml | 2 +- detections/endpoint/process_deleting_its_process_file_path.yml | 2 +- detections/endpoint/process_execution_via_wmi.yml | 2 +- detections/endpoint/process_kill_base_on_file_path.yml | 2 +- detections/endpoint/processes_launching_netsh.yml | 2 +- detections/endpoint/ransomware_notes_bulk_creation.yml | 2 +- detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml | 2 +- detections/endpoint/recon_using_wmi_class.yml | 2 +- .../endpoint/recursive_delete_of_directory_in_batch_cmd.yml | 2 +- .../reg_exe_manipulating_windows_services_registry_keys.yml | 2 +- .../endpoint/registry_keys_for_creating_shim_databases.yml | 2 +- detections/endpoint/registry_keys_used_for_persistence.yml | 2 +- .../endpoint/registry_keys_used_for_privilege_escalation.yml | 2 +- detections/endpoint/remote_process_instantiation_via_wmi.yml | 2 +- detections/endpoint/remote_wmi_command_attempt.yml | 2 +- detections/endpoint/resize_shadowstorage_volume.yml | 2 +- detections/endpoint/revil_common_exec_parameter.yml | 2 +- detections/endpoint/revil_registry_entry.yml | 2 +- .../rundll32_with_no_command_line_arguments_with_network.yml | 2 +- detections/endpoint/rundll_loading_dll_by_ordinal.yml | 2 +- detections/endpoint/ryuk_test_files_detected.yml | 2 +- detections/endpoint/ryuk_wake_on_lan_command.yml | 2 +- detections/endpoint/samsam_test_file_write.yml | 2 +- detections/endpoint/sc_exe_manipulating_windows_services.yml | 2 +- .../endpoint/schedule_task_with_http_command_arguments.yml | 2 +- .../endpoint/schedule_task_with_rundll32_command_trigger.yml | 2 +- .../endpoint/scheduled_task_deleted_or_created_via_cmd.yml | 2 +- detections/endpoint/schtasks_run_task_on_demand.yml | 2 +- .../endpoint/schtasks_scheduling_job_on_remote_system.yml | 2 +- detections/endpoint/schtasks_used_for_forcing_a_reboot.yml | 2 +- detections/endpoint/script_execution_via_wmi.yml | 2 +- .../searchprotocolhost_with_no_command_line_with_network.yml | 2 +- detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml | 2 +- detections/endpoint/services_escalate_exe.yml | 2 +- ...lt_powershell_execution_policy_to_unrestricted_or_bypass.yml | 2 +- detections/endpoint/shim_database_file_creation.yml | 2 +- .../shim_database_installation_with_suspicious_parameters.yml | 2 +- detections/endpoint/short_lived_windows_accounts.yml | 2 +- detections/endpoint/single_letter_process_on_endpoint.yml | 2 +- detections/endpoint/slui_runas_elevated.yml | 2 +- detections/endpoint/slui_spawning_a_process.yml | 2 +- detections/endpoint/spoolsv_spawning_rundll32.yml | 2 +- detections/endpoint/spoolsv_suspicious_loaded_modules.yml | 2 +- detections/endpoint/spoolsv_suspicious_process_access.yml | 2 +- detections/endpoint/spoolsv_writing_a_dll.yml | 2 +- detections/endpoint/spoolsv_writing_a_dll___sysmon.yml | 2 +- .../ssa___applying_stolen_credentials_via_mimikatz_modules.yml | 2 +- ...sa___applying_stolen_credentials_via_powersploit_modules.yml | 2 +- ...ssa___assess_credential_strength_via_dsinternals_modules.yml | 2 +- detections/endpoint/ssa___attempt_to_delete_services.yml | 2 +- detections/endpoint/ssa___attempt_to_disable_services.yml | 2 +- ...sa___attempted_credential_dump_from_registry_via_reg_exe.yml | 2 +- ...a___credential_extraction_dsinternals_conversion_modules.yml | 2 +- .../ssa___credential_extraction_dsinternals_modules.yml | 2 +- .../ssa___credential_extraction_fgdump_cachedump_s_option.yml | 2 +- .../ssa___credential_extraction_fgdump_cachedump_v_option.yml | 2 +- .../ssa___credential_extraction_getaddbaccount_from_dump.yml | 2 +- .../ssa___credential_extraction_lazagne_command_options.yml | 2 +- .../endpoint/ssa___credential_extraction_mimikatz_modules.yml | 2 +- .../ssa___credential_extraction_ms_debuggers_kernel_peek.yml | 2 +- .../ssa___credential_extraction_ms_debuggers_z_option.yml | 2 +- .../ssa___credential_extraction_powersploit_modules.yml | 2 +- detections/endpoint/ssa___delete_a_net_user.yml | 2 +- .../endpoint/ssa___deny_permission_using_cacls_utility.yml | 2 +- .../endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml | 2 +- detections/endpoint/ssa___detect_kerberoasting.yml | 2 +- detections/endpoint/ssa___detect_pass_hash.yml | 2 +- detections/endpoint/ssa___disable_net_user_account.yml | 2 +- detections/endpoint/ssa___first_time_seen_cmd_line.yml | 2 +- .../endpoint/ssa___grant_permission_using_cacls_utility.yml | 2 +- ...sa___illegal_access_user_content_via_powersploit_modules.yml | 2 +- .../ssa___illegal_account_creation_via_powersploit_modules.yml | 2 +- ...__illegal_account_enable_disable_via_dsinternals_modules.yml | 2 +- .../ssa___illegal_log_deletion_via_mimikatz_modules.yml | 2 +- ...agement_AD_elements_and_policies_via_dsinternals_modules.yml | 2 +- ...gement_computers_and_AD_elements_via_powersploit_modules.yml | 2 +- ...vilege_elevation_and_persistence_via_powersploit_modules.yml | 2 +- .../ssa___illegal_privilege_elevation_via_mimikatz_modules.yml | 2 +- ...illegal_service_and_process_control_via_mimikatz_modules.yml | 2 +- ...egal_service_and_process_control_via_powersploit_modules.yml | 2 +- .../ssa___modify_acls_permission_of_files_or_folders.yml | 2 +- ...g_access_with_stolen_credentials_via_powersploit_modules.yml | 2 +- .../endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml | 2 +- .../endpoint/ssa___rare_parent_process_relationship_lolbas.yml | 2 +- ...ss_and_persistence_opportunities_via_powersploit_modules.yml | 2 +- ...and_use_accounts_groups_policies_via_powersploit_modules.yml | 2 +- ...ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml | 2 +- ..._active_directory_infrastructure_via_powersploit_modules.yml | 2 +- ..._recon_and_use_computers_domains_via_powersploit_modules.yml | 2 +- .../ssa___recon_and_use_computers_via_mimikatz_modules.yml | 2 +- ...nd_use_operating_system_elements_via_powersploit_modules.yml | 2 +- .../ssa___recon_and_use_shares_via_mimikatz_modules.yml | 2 +- .../ssa___recon_and_use_shares_via_powersploit_modules.yml | 2 +- .../ssa___recon_connectivity_via_powersploit_modules.yml | 2 +- ...econ_credential_stores_and_services_via_mimikatz_modules.yml | 2 +- .../ssa___recon_defensive_tools_via_powersploit_modules.yml | 2 +- ...ivilege_escalation_opportunities_via_powersploit_modules.yml | 2 +- ...a___recon_process_service_hijacking_via_mimikatz_modules.yml | 2 +- .../ssa___recon_processes_and_services_via_mimikatz_modules.yml | 2 +- detections/endpoint/ssa___resize_shadowstorage_volume.yml | 2 +- .../ssa___setting_credentials_via_dsinternals_modules.yml | 2 +- .../endpoint/ssa___setting_credentials_via_mimikatz_modules.yml | 2 +- .../ssa___setting_credentials_via_powersploit_modules.yml | 2 +- .../ssa___system_process_running_unexpected_location.yml | 2 +- .../endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml | 2 +- detections/endpoint/ssa___unusually_long_command_line.yml | 2 +- detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml | 2 +- detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml | 2 +- detections/endpoint/start_up_during_safe_mode_boot.yml | 2 +- .../endpoint/suspicious_dllhost_no_command_line_arguments.yml | 2 +- detections/endpoint/suspicious_driver_loaded_path.yml | 2 +- detections/endpoint/suspicious_event_log_service_behavior.yml | 2 +- .../endpoint/suspicious_gpupdate_no_command_line_arguments.yml | 2 +- .../endpoint/suspicious_microsoft_workflow_compiler_rename.yml | 2 +- .../endpoint/suspicious_microsoft_workflow_compiler_usage.yml | 2 +- detections/endpoint/suspicious_msbuild_path.yml | 2 +- detections/endpoint/suspicious_msbuild_rename.yml | 2 +- detections/endpoint/suspicious_msbuild_spawn.yml | 2 +- detections/endpoint/suspicious_mshta_child_process.yml | 2 +- detections/endpoint/suspicious_mshta_spawn.yml | 2 +- detections/endpoint/suspicious_process_file_path.yml | 2 +- detections/endpoint/suspicious_reg_exe_process.yml | 2 +- .../endpoint/suspicious_regsvr32_register_suspicious_path.yml | 2 +- detections/endpoint/suspicious_rundll32_dllregisterserver.yml | 2 +- detections/endpoint/suspicious_rundll32_rename.yml | 2 +- detections/endpoint/suspicious_rundll32_startw.yml | 2 +- .../suspicious_rundll32_with_no_command_line_arguments.yml | 2 +- .../suspicious_scheduled_task_from_public_directory.yml | 2 +- .../suspicious_searchprotocolhost_no_command_line_arguments.yml | 2 +- detections/endpoint/suspicious_wevtutil_usage.yml | 2 +- .../endpoint/suspicious_writes_to_windows_recycle_bin.yml | 2 +- detections/endpoint/system_information_discovery_detection.yml | 2 +- .../endpoint/system_processes_run_from_unexpected_locations.yml | 2 +- detections/endpoint/trickbot_named_pipe.yml | 2 +- .../endpoint/unified_messaging_service_spawning_a_process.yml | 2 +- detections/endpoint/unload_sysmon_filter_driver.yml | 2 +- detections/endpoint/unloading_amsi_via_reflection.yml | 2 +- detections/endpoint/unusually_long_command_line.yml | 2 +- detections/endpoint/usn_journal_deletion.yml | 2 +- detections/endpoint/w3wp_spawning_shell.yml | 2 +- detections/endpoint/wbadmin_delete_system_backups.yml | 2 +- detections/endpoint/wbemprox_com_object_execution.yml | 2 +- .../wermgr_process_connecting_to_ip_check_web_services.yml | 2 +- detections/endpoint/wermgr_process_create_executable_file.yml | 2 +- .../wermgr_process_spawned_cmd_or_powershell_process.yml | 2 +- detections/endpoint/windows_disableantispyware_reg.yml | 2 +- detections/endpoint/windows_event_log_cleared.yml | 2 +- .../endpoint/windows_security_account_manager_stopped.yml | 2 +- .../endpoint/winevent_scheduled_task_created_to_spawn_shell.yml | 2 +- .../winevent_scheduled_task_created_within_public_path.yml | 2 +- detections/endpoint/winword_spawning_cmd.yml | 2 +- detections/endpoint/winword_spawning_powershell.yml | 2 +- detections/endpoint/winword_spawning_windows_script_host.yml | 2 +- .../endpoint/wmi_permanent_event_subscription___sysmon.yml | 2 +- detections/endpoint/wmi_recon_running_process_or_services.yml | 2 +- detections/endpoint/write_executable_in_smb_share.yml | 2 +- detections/endpoint/xmrig_driver_loaded.yml | 2 +- 218 files changed, 218 insertions(+), 218 deletions(-) diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index b272b7f7b0..2c266c2e44 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -3,7 +3,7 @@ id: a7e3f0f0-ae42-11eb-b245-acde48001122 version: 1 date: '2021-05-06' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic will identify suspicious executable or scripts (known file diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 4d6a00cb40..e9b637d32a 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -3,7 +3,7 @@ id: dc64d064-d346-11eb-8588-acde48001122 version: 1 date: '2021-06-22' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic will identify suspicious process of cscript.exe where it diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 9595c3518c..86dfd1d3ad 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -3,7 +3,7 @@ id: b06a555e-dce0-417d-a2eb-28a5d8d66ef7 version: 3 date: '2020-11-18' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for processes launched from files that have double diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index 95afab45cc..e610e04a22 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -3,7 +3,7 @@ id: 02c6cfc2-ae66-4735-bfc7-6291da834cbf version: 1 date: '2018-12-14' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The search looks for file writes with extensions consistent with a SamSam diff --git a/detections/endpoint/first_time_seen_child_process_of_zoom.yml b/detections/endpoint/first_time_seen_child_process_of_zoom.yml index 60eac8677a..3f373ceabb 100644 --- a/detections/endpoint/first_time_seen_child_process_of_zoom.yml +++ b/detections/endpoint/first_time_seen_child_process_of_zoom.yml @@ -3,7 +3,7 @@ id: e91bd102-d630-4e76-ab73-7e3ba22c5961 version: 1 date: '2020-05-20' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This search looks for child processes spawned by zoom.exe or zoom.us diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index fa26c3851e..14174aa751 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -3,7 +3,7 @@ id: 909f8fd8-7ac8-11eb-a1f3-acde48001122 version: 1 date: '2021-03-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index f80c817bf7..5cff54cd40 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -3,7 +3,7 @@ id: 2c853856-a140-11eb-a5b5-acde48001122 version: 1 date: '2021-04-19' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies gpupdate.exe with no command line arguments diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index a6f49eb071..8a68afbe2c 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -3,7 +3,7 @@ id: 834ba832-ad89-11eb-937d-acde48001122 version: 1 date: '2021-05-05' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies a suspicious registry modification to hide a diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 072f27287d..fd75ab05dc 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -3,7 +3,7 @@ id: c77162d3-f93c-45cc-80c8-22f6b5264g9f version: 4 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific diff --git a/detections/endpoint/high_file_deletion_frequency.yml b/detections/endpoint/high_file_deletion_frequency.yml index 50aba144f0..a8d825fe0b 100644 --- a/detections/endpoint/high_file_deletion_frequency.yml +++ b/detections/endpoint/high_file_deletion_frequency.yml @@ -3,7 +3,7 @@ id: 45b125c4-866f-11eb-a95a-acde48001122 version: 1 date: '2021-03-16' author: Teoderick Contreras -type: batch +type: Anomaly datamodel: - Endpoint description: This search looks for high frequency of file deletion relative to process diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index 5784960f38..ad5b04d2bf 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -3,7 +3,7 @@ id: 17cd75b2-8666-11eb-9ab4-acde48001122 version: 1 date: '2021-03-16' author: Teoderick Contreras -type: batch +type: Anomaly datamodel: - Endpoint description: This analytics are designed to indentify a high frequency of process diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index a65ce5d9e1..343477e39e 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -3,7 +3,7 @@ id: cf8d753e-a8fe-11eb-8f58-acde48001122 version: 1 date: '2021-04-29' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies a potential adversary that changes the security diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index 9b63e9eeb1..e008fba5b4 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -3,7 +3,7 @@ id: b1b1e316-accc-11eb-a9b4-acde48001122 version: 1 date: '2021-05-04' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies potential adversaries that modify the security diff --git a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml index 2ccaa299d6..936aac8eef 100644 --- a/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml +++ b/detections/endpoint/kerberoasting_spn_request_with_rc4_encryption.yml @@ -3,7 +3,7 @@ id: 5cc67381-44fa-4111-8a37-7a230943f027 version: 3 date: '2020-10-16' author: Jose Hernandez, Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: This search detects a potential kerberoasting attack via service principal name requests diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index 52dd38f375..aa8e8dcb8c 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -3,7 +3,7 @@ id: 3070f8e0-c528-11eb-b2a0-acde48001122 version: 1 date: '2021-06-04' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search detects a suspicioous termination of known services killed diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index 8ea1b6d64b..137653ce08 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -3,7 +3,7 @@ id: a36972c8-b894-11eb-9f78-acde48001122 version: 1 date: '2021-05-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect known mailsniper.ps1 functions executed in a diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index aeb26bd70a..d1ef4c04fb 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -3,7 +3,7 @@ id: 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8 version: 1 date: '2021-04-07' author: Ryan Becwar -type: batch +type: TTP datamodel: - Endpoint description: This detection is to identify the abuse the Windows SC.exe to execute diff --git a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml index ffebd2f670..060c574090 100644 --- a/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/malicious_powershell_process___connect_to_internet_with_hidden_window.yml @@ -3,7 +3,7 @@ id: ee18ed37-0802-4268-9435-b3b91aaa18db version: 5 date: '2020-11-20' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for PowerShell processes started with parameters to diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 962b5bcb15..442e2c0404 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -3,7 +3,7 @@ id: c4db14d9-7909-48b4-a054-aa14d89dbb19 version: 4 date: '2020-07-21' author: David Dorsey, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: This search looks for PowerShell processes that have encoded the script diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 2446a119a8..b6a8162d1a 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -3,7 +3,7 @@ id: 9be56c82-b1cc-4318-87eb-d138afaaca39 version: 4 date: '2020-07-21' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for PowerShell processes started with parameters used diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 9da3b6a47f..3d08a0628b 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -3,7 +3,7 @@ id: cde75cf6-3c7a-4dd6-af01-27cdb4511fd4 version: 4 date: '2021-01-19' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for PowerShell processes launched with arguments that diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index 2305d630fb..fe79a4c919 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -3,7 +3,7 @@ id: accb0712-c381-11eb-8e5b-acde48001122 version: 1 date: '2021-06-02' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies suspicious modification of registry to deface diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index 34433bd3d2..20e5d40864 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -3,7 +3,7 @@ id: 7e8458cc-acca-11eb-9e3f-acde48001122 version: 1 date: '2021-05-04' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies suspicious modification of ACL permission to diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index 836a01c18d..f0100c27df 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -3,7 +3,7 @@ id: f5f6af30-7ba7-4295-bfe9-07de87c01bbc version: 2 date: '2020-11-23' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index 1b2ffe5569..5949d345bf 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -3,7 +3,7 @@ id: 8bb3f280-dd9b-11eb-84d5-acde48001122 version: 1 date: '2021-07-05' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll diff --git a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml index bf8a988ea7..08aa8e7502 100644 --- a/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_disabled_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -3,7 +3,7 @@ id: 98f22d82-9d62-11eb-9fcf-acde48001122 version: 1 date: '2021-04-14' author: Mauricio Velazco, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: 'The following analytic identifies one source endpoint failing to authenticate diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml index 7b786d699f..366814ce63 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -3,7 +3,7 @@ id: 001266a6-9d5b-11eb-829b-acde48001122 version: 1 date: '2021-04-14' author: Mauricio Velazco, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: 'The following analytic identifies one source endpoint failing to authenticate diff --git a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml index a0d0f5fae7..fc431727f5 100644 --- a/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_invalid_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -3,7 +3,7 @@ id: 57ad5a64-9df7-11eb-a290-acde48001122 version: 1 date: '2021-04-15' author: Mauricio Velazco, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: 'The following analytic identifies one source endpoint failing to authenticate diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml index f55f42d909..ffe17bbee1 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml @@ -3,7 +3,7 @@ id: e61918fa-9ca4-11eb-836c-acde48001122 version: 1 date: '2021-04-13' author: Mauricio Velazco, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: 'The following analytic identifies a source user failing to authenticate diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index 4c2e2a99dc..70c4316f4f 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -3,7 +3,7 @@ id: 3a91a212-98a9-11eb-b86a-acde48001122 version: 1 date: '2021-04-08' author: Mauricio Velazco, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: 'The following analytic identifies one source endpoint failing to authenticate diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml index 274a1842c1..c160cb4bdb 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_ntlm.yml @@ -3,7 +3,7 @@ id: 7ed272a4-9c77-11eb-af22-acde48001122 version: 1 date: '2021-04-13' author: Mauricio Velazco, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: 'The following analytic identifies one source endpoint failing to authenticate diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml index d55bdf301c..61cbd384ce 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml @@ -3,7 +3,7 @@ id: 9015385a-9c84-11eb-bef2-acde48001122 version: 1 date: '2021-04-13' author: Mauricio Velazco, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: 'The following analytic identifies a source process name failing to authenticate diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index 89e2d6078d..b14980e4b8 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -3,7 +3,7 @@ id: 80f9d53e-9ca1-11eb-b0d6-acde48001122 version: 1 date: '2021-04-13' author: Mauricio Velazco, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: 'The following analytic identifies a source host failing to authenticate diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index 310b725e43..d45eacbb7c 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -3,7 +3,7 @@ id: 1a382c6c-7c2e-11eb-ac69-acde48001122 version: 1 date: '2021-03-03' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index e63be64c0a..a696a49fa0 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -3,7 +3,7 @@ id: c3e05466-5f22-11eb-ae93-0242ac130002 version: 1 date: '2021-01-25' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for the execution of `nltest.exe` with command-line diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index 1acf0ca3c6..28ce49dda3 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -3,7 +3,7 @@ id: da63bc76-61ae-11eb-ae93-0242ac130002 version: 1 date: '2021-01-28' author: Michael Haag, Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index ed6fda6d58..adcccc4b51 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -3,7 +3,7 @@ id: 958751e4-9c5f-11eb-b103-acde48001122 version: 1 date: '2021-04-13' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this detection was designed to identifies suspicious spawned process diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index 05a7c48c42..32dc6a7c55 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -3,7 +3,7 @@ id: cc8b7b74-9d0f-11eb-8342-acde48001122 version: 1 date: '2021-04-14' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search detects a potential malicious office document that create diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index f10e0baf8e..58459c2044 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -3,7 +3,7 @@ id: b12c89bc-9d06-11eb-a592-acde48001122 version: 1 date: '2021-04-14' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this detection was designed to identifies suspicious office documents diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index 59f1459ca4..dbd31a5f57 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -3,7 +3,7 @@ id: 6fed27d2-9ec7-11eb-8fe4-aa665a019aa3 version: 2 date: '2021-06-23' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to detect potential malicious office document executing diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index d72ea30fe9..b6cfe6c065 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -3,7 +3,7 @@ id: e8c591f4-a6d7-11eb-8cf7-acde48001122 version: 1 date: '2021-04-26' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following detection identifies the latest behavior utilized by different diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index 890bb0292a..77c1f33ec2 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -3,7 +3,7 @@ id: 6925fe72-a6d5-11eb-9e17-acde48001122 version: 1 date: '2021-04-26' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following detection identifies the latest behavior utilized by different diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 28634b0150..f992b114ed 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -3,7 +3,7 @@ id: 6078fa20-a6d2-11eb-b662-acde48001122 version: 1 date: '2021-04-26' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following detection identifies the latest behavior utilized by different diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index 989bb599be..6ce7ac010a 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -3,7 +3,7 @@ id: c661f6be-a38c-11eb-be57-acde48001122 version: 1 date: '2021-04-22' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following detection identifies the latest behavior utilized by IcedID diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index b65e641d1a..c6659dd4f4 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -3,7 +3,7 @@ id: ffc236d6-a6c9-11eb-95f1-acde48001122 version: 1 date: '2021-04-26' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following detection identifies the latest behavior utilized by Ursnif diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index f61e5c188d..390de9035a 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -3,7 +3,7 @@ id: 13c2f6c3-10c5-4deb-9ba1-7c4460ebe4ae version: 4 date: '2020-07-21' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Microsoft Windows contains accessibility features that can be launched diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 3ce21dd7be..d77c93025c 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -3,7 +3,7 @@ id: fa7ca5c6-c9d8-11eb-bce9-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a modification of file or directory permission diff --git a/detections/endpoint/powershell_creating_thread_mutex.yml b/detections/endpoint/powershell_creating_thread_mutex.yml index 4e5a50429f..33b08752df 100644 --- a/detections/endpoint/powershell_creating_thread_mutex.yml +++ b/detections/endpoint/powershell_creating_thread_mutex.yml @@ -3,7 +3,7 @@ id: 637557ec-ca08-11eb-bd0a-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index ec33904c56..ee1de0ea43 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -3,7 +3,7 @@ id: c148a894-dd93-11eb-bf2a-acde48001122 version: 1 date: '2021-07-05' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to identifies a modification in registry to disable the diff --git a/detections/endpoint/powershell_domain_enumeration.yml b/detections/endpoint/powershell_domain_enumeration.yml index 00f168f112..ec8b9e0ef9 100644 --- a/detections/endpoint/powershell_domain_enumeration.yml +++ b/detections/endpoint/powershell_domain_enumeration.yml @@ -3,7 +3,7 @@ id: e1866ce2-ca22-11eb-8e44-acde48001122 version: 1 date: '2021-06-10' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index 2ca40212f7..d1957dc29e 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -3,7 +3,7 @@ id: afed80b2-d34b-11eb-a952-acde48001122 version: 1 date: '2021-06-22' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious enabling of smb1protocol through diff --git a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml index 985ce97c1c..b2cadcd978 100644 --- a/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml +++ b/detections/endpoint/powershell_fileless_process_injection_via_getprocaddress.yml @@ -3,7 +3,7 @@ id: a26d9db4-c883-11eb-9d75-acde48001122 version: 1 date: '2021-06-08' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command diff --git a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml index d24d96b6a3..408d457660 100644 --- a/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml +++ b/detections/endpoint/powershell_fileless_script_contains_base64_encoded_content.yml @@ -3,7 +3,7 @@ id: 8acbc04c-c882-11eb-b060-acde48001122 version: 1 date: '2021-06-08' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command diff --git a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml index 24e146febb..af8c47f273 100644 --- a/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml +++ b/detections/endpoint/powershell_loading_dotnet_into_memory_via_system_reflection_assembly.yml @@ -3,7 +3,7 @@ id: 85bc3f30-ca28-11eb-bd21-acde48001122 version: 1 date: '2021-06-10' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index aab9f0b6b8..d32bb26912 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -3,7 +3,7 @@ id: 0d718b52-c9f1-11eb-bc61-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index 29267de07f..12044e9862 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -3,7 +3,7 @@ id: ec102cb2-a0f5-11eb-9b38-acde48001122 version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is designed to detect suspicious powershell process that diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 842a7805d4..dd49a51d78 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -3,7 +3,7 @@ id: 39e2605a-90d8-11eb-899e-acde48001122 version: 1 date: '2021-03-29' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar diff --git a/detections/endpoint/powershell_using_memory_as_backing_store.yml b/detections/endpoint/powershell_using_memory_as_backing_store.yml index 133a5e78e5..c70e0974b7 100644 --- a/detections/endpoint/powershell_using_memory_as_backing_store.yml +++ b/detections/endpoint/powershell_using_memory_as_backing_store.yml @@ -3,7 +3,7 @@ id: c396a0c4-c9f2-11eb-b4f5-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using memory stream as new object backstore. The malicious diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index ecb24c758d..a3091d42d1 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -3,7 +3,7 @@ id: 7742aa92-c9d9-11eb-bbfc-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious bcdedit.exe execution to ignore diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 9ea5bf48c9..cc1cfc97e3 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -3,7 +3,7 @@ id: 313681a2-da8e-11eb-adad-acde48001122 version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'The following analytic identifies new printer drivers being load by diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 2ed06e7632..6e5b4fc245 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -3,7 +3,7 @@ id: 1adc9548-da7c-11eb-8f13-acde48001122 version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'The following analytic identifies driver load errors utilizing the Windows diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 1ac2e4fbcf..749f4a498d 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -3,7 +3,7 @@ id: 5d814af1-1041-47b5-a9ac-d754e82e9a26 version: 4 date: '2021-01-28' author: Jose Hernandez, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index 20c35f71cd..3f9ae60c93 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -3,7 +3,7 @@ id: f7eda4bc-871c-11eb-b110-acde48001122 version: 1 date: '2021-03-17' author: Teoderick Contreras -type: batch +type: TTP datamodel: - Endpoint description: This detection is to identify a suspicious process that tries to delete diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index 7ee148c766..4dfffcf211 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -3,7 +3,7 @@ id: 24869767-8579-485d-9a4f-d9ddfd8f0cac version: 4 date: '2020-03-16' author: Rico Valdez, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies `WmiPrvSE.exe` spawning a process. diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index dfff9c0be0..fbb4a228e6 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -3,7 +3,7 @@ id: 5ffaa42c-acdb-11eb-9ad3-acde48001122 version: 1 date: '2021-05-04' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies the use of `wmic.exe` using `delete` diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index b82217f196..4e9bd9be60 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -3,7 +3,7 @@ id: b89919ed-fe5f-492c-b139-95dbb162040e version: 3 date: '2020-07-10' author: Josef Kuepker, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for processes launching netsh.exe. Netsh is a command-line diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index a66be16155..4468a475c4 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -3,7 +3,7 @@ id: eff7919a-8330-11eb-83f8-acde48001122 version: 1 date: '2021-03-12' author: Teoderick Contreras -type: batch +type: Anomaly datamodel: - Endpoint description: The following analytics identifies a big number of instance of ransomware diff --git a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml index b8a48d8e80..cfc96d3655 100644 --- a/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml +++ b/detections/endpoint/recon_avproduct_through_pwh_or_wmi.yml @@ -3,7 +3,7 @@ id: 28077620-c9f6-11eb-8785-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104 performing checks to identify anti-virus products installed on diff --git a/detections/endpoint/recon_using_wmi_class.yml b/detections/endpoint/recon_using_wmi_class.yml index dfcfbd8a9a..0a666071ed 100644 --- a/detections/endpoint/recon_using_wmi_class.yml +++ b/detections/endpoint/recon_using_wmi_class.yml @@ -3,7 +3,7 @@ id: 018c1972-ca07-11eb-9473-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index 5029a4ad3c..4fe458d6da 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -3,7 +3,7 @@ id: ba570b3a-d356-11eb-8358-acde48001122 version: 1 date: '2021-06-22' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious commandline designed to delete diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index a37c5aea78..82955ccc60 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -3,7 +3,7 @@ id: 8470d755-0c13-45b3-bd63-387a373c10cf version: 5 date: '2020-11-26' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The search looks for reg.exe modifying registry keys that define Windows diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 33f0d5de1f..43848f6b92 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -3,7 +3,7 @@ id: f5f6af30-7aa7-4295-bfe9-07fe87c01bbb version: 3 date: '2020-11-26' author: Bhavin Patel, Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 693447fe95..2555bb2743 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -3,7 +3,7 @@ id: f5f6af30-7aa7-4295-bfe9-07fe87c01a4b version: 5 date: '2020-11-27' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The search looks for modifications to registry keys that can be used diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index 970bc182ac..ce2f3cb32f 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -3,7 +3,7 @@ id: c9f4b923-f8af-4155-b697-1354f5bcbc5e version: 4 date: '2020-11-27' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 74922eb617..f39264a113 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -3,7 +3,7 @@ id: d25d2c3d-d9d8-40ec-8fdf-e86fe155a3da version: 5 date: '2020-11-30' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for wmic.exe being launched with parameters to spawn diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index 142ca96a90..091f40d2a0 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -3,7 +3,7 @@ id: 272df6de-61f1-4784-877c-1fbc3e2d0838 version: 3 date: '2018-12-03' author: Rico Valdez, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies usage of `wmic.exe` spawning a local diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 88d00108a5..6c28a08375 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -5,7 +5,7 @@ date: '2021-03-12' author: Teoderick Contreras type: batch datamodel: -- Endpoint +- TTP description: The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index cd7f3d85dc..46076a81ca 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -5,7 +5,7 @@ date: '2021-06-02' author: Teoderick Contreras, Splunk type: batch datamodel: -- Endpoint +- TTP description: This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index 9c43f53a5d..be2b3cf744 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -3,7 +3,7 @@ id: e3d3f57a-c381-11eb-9e35-acde48001122 version: 1 date: '2021-06-02' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies suspicious modification in registry entry to diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 1108290993..33d92a9bfb 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -3,7 +3,7 @@ id: 35307032-a12d-11eb-835f-acde48001122 version: 1 date: '2021-04-19' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies rundll32.exe with no command line arguments diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 7e143128e2..db0de47d04 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -3,7 +3,7 @@ id: 6c135f8d-5e60-454e-80b7-c56eed739833 version: 4 date: '2020-11-30' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for executing scripts with rundll32. Adversaries may diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index 73ccf05ea2..81adb3a8a9 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -3,7 +3,7 @@ id: 57d44d70-28d9-4ed1-acf5-1c80ae2bbce3 version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk -type: batch +type: TTP datamodel: [] description: The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index 02dda88cfa..4b7e06c506 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -3,7 +3,7 @@ id: 538d0152-7aaa-11eb-beaa-acde48001122 version: 1 date: '2021-03-01' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index 98742610b0..b965ae85ab 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -3,7 +3,7 @@ id: 493a879d-519d-428f-8f57-a06a0fdc107e version: 1 date: '2018-12-14' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The search looks for a file named "test.txt" written to the windows system diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index 5449991567..0348a59bd0 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -3,7 +3,7 @@ id: f0c693d8-2a89-4ce7-80b4-98fea4c3ea6d version: 4 date: '2020-07-21' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for arguments to sc.exe indicating the creation or diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml index 779e75f541..392bbd0174 100644 --- a/detections/endpoint/schedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -3,7 +3,7 @@ id: 523c2684-a101-11eb-916b-acde48001122 version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following query utilizes Windows Security EventCode 4698, `A scheduled diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index 2a393dc98d..fe232d96cc 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -3,7 +3,7 @@ id: 75b00fd8-a0ff-11eb-8b31-acde48001122 version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following query utilizes Windows Security EventCode 4698, `A scheduled diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 7291e4a0dd..6bab160978 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -3,7 +3,7 @@ id: d5af132c-7c17-439c-9d31-13d55340f36c version: 5 date: '2020-12-17' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for flags passed to schtasks.exe on the command-line diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index 42b3731f99..fbca9a55c9 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -3,7 +3,7 @@ id: bb37061e-af1f-11eb-a159-acde48001122 version: 1 date: '2021-05-07' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies an on demand run of a Windows Schedule Task diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index 449d8add05..f271e5455f 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -3,7 +3,7 @@ id: 1297fb80-f42a-4b4a-9c8a-88c066237cf6 version: 4 date: '2020-07-21' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for flags passed to schtasks.exe on the command-line diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index 86ffdcc0d3..72f2d8ef5f 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -3,7 +3,7 @@ id: 1297fb80-f42a-4b4a-9c8a-88c066437cf6 version: 4 date: '2020-12-07' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for flags passed to schtasks.exe on the command-line diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index e807dbf4c8..7cf2381968 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -3,7 +3,7 @@ id: aa73f80d-d728-4077-b226-81ea0c8be589 version: 4 date: '2020-03-16' author: Rico Valdez, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for scripts launched via WMI. diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 933bb0a662..4d461b1049 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -3,7 +3,7 @@ id: b690df8c-a145-11eb-a38b-acde48001122 version: 1 date: '2021-04-19' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies searchprotocolhost.exe with no command diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index 6fa39d9a41..626ba064a0 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -3,7 +3,7 @@ id: 5672819c-be09-11eb-bbfb-acde48001122 version: 1 date: '2021-05-26' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic detects a potential usage of secretsdump.py tool for dumping diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml index 68ad6ac3da..13ca0da27e 100644 --- a/detections/endpoint/services_escalate_exe.yml +++ b/detections/endpoint/services_escalate_exe.yml @@ -3,7 +3,7 @@ id: c448488c-b7ec-11eb-8253-acde48001122 version: 1 date: '2021-05-18' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies the use of `svc-exe` with Cobalt Strike. diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index 5fa61fe30d..bbfddee419 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -3,7 +3,7 @@ id: c2590137-0b08-4985-9ec5-6ae23d92f63d version: 6 date: '2020-11-06' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Monitor for changes of the ExecutionPolicy in the registry to the values diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index 6858157758..23965f18ff 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -3,7 +3,7 @@ id: 6e4c4588-ba2f-42fa-97e6-9f6f548eaa33 version: 3 date: '2020-12-08' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index 59318c5087..8eedde031b 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -3,7 +3,7 @@ id: 404620de-46d8-48b6-90cc-8a8d7b0876a3 version: 4 date: '2020-11-23' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search detects the process execution and arguments required to silently diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 81a9ef2239..f553594805 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -3,7 +3,7 @@ id: b25f6f62-0782-43c1-b403-083231ffd97d version: 2 date: '2020-07-06' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Change description: This search detects accounts that were created and deleted in a short diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 826f6d6855..fd721eb277 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -3,7 +3,7 @@ id: a4214f0b-e01c-41bc-8cc4-d2b71e3056b4 version: 3 date: '2020-12-08' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for process names that consist only of a single letter. diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml index 6b145f4359..9d918bd101 100644 --- a/detections/endpoint/slui_runas_elevated.yml +++ b/detections/endpoint/slui_runas_elevated.yml @@ -3,7 +3,7 @@ id: 8d124810-b3e4-11eb-96c7-acde48001122 version: 1 date: '2021-05-13' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies the Microsoft Software Licensing User diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index ad24b7c016..7a9e0217bd 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -3,7 +3,7 @@ id: 879c4330-b3e0-11eb-b1b1-acde48001122 version: 1 date: '2021-05-13' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies the Microsoft Software Licensing User diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 2e11089458..207ba2a6de 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -3,7 +3,7 @@ id: 15d905f6-da6b-11eb-ab82-acde48001122 version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies a suspicious child process, `rundll32.exe`, diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index c12ec1beb5..0836ae7c82 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -3,7 +3,7 @@ id: a5e451f8-da81-11eb-b245-acde48001122 version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect suspicious loading of dll in specific path relative diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index 13e1b1e906..041b34c2f5 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -3,7 +3,7 @@ id: 799b606e-da81-11eb-93f8-acde48001122 version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies a suspicious behavior related to PrintNightmare, diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index 02152f87d4..afc4984e1c 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -3,7 +3,7 @@ id: d5bf5cf2-da71-11eb-92c2-acde48001122 version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index d18c48cf54..a46a5d2e9f 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -3,7 +3,7 @@ id: 347fd388-da87-11eb-836d-acde48001122 version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml index ecb09f7e98..fe2cea836d 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: 759a653f-cb92-40f9-94c9-ec4e47b0f709 version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection indicates use of Mimikatz modules that facilitate Pass-the-Token attack, Golden or Silver kerberos ticket attack, and Skeleton key attack. diff --git a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml index 16e8b0e679..d948df75f4 100644 --- a/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 270b482d-2af2-448f-9923-9cf005f61be4 version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Stolen credentials are applied by methods such as user impersonation, credential injection, spoofing of authentication processes or getting hold of critical diff --git a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml index 633ae2f609..4e279727c4 100644 --- a/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___assess_credential_strength_via_dsinternals_modules.yml @@ -3,7 +3,7 @@ id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of DSInternals modules that verify password strength, i.e., identify week accounts that would be easily compromised. diff --git a/detections/endpoint/ssa___attempt_to_delete_services.yml b/detections/endpoint/ssa___attempt_to_delete_services.yml index c6b479fa22..a455f73c58 100644 --- a/detections/endpoint/ssa___attempt_to_delete_services.yml +++ b/detections/endpoint/ssa___attempt_to_delete_services.yml @@ -3,7 +3,7 @@ id: a0c8c292-d01a-11eb-aa18-acde48001122 version: 1 date: '2021-06-18' author: Teoderick Contreras, splunk -type: streaming +type: TTP datamodel: - Endpoint description: This analytic identifies suspicious series of attempt to kill multiple diff --git a/detections/endpoint/ssa___attempt_to_disable_services.yml b/detections/endpoint/ssa___attempt_to_disable_services.yml index 05865adfa6..febf8227db 100644 --- a/detections/endpoint/ssa___attempt_to_disable_services.yml +++ b/detections/endpoint/ssa___attempt_to_disable_services.yml @@ -3,7 +3,7 @@ id: afb31de4-d023-11eb-98d5-acde48001122 version: 1 date: '2021-06-18' author: Teoderick Contreras, Splunk -type: streaming +type: TTP datamodel: - Endpoint description: This analytic will identify suspicious series of command-line to disable diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml index 3d19e423e1..ee5b4bdd4c 100644 --- a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml @@ -3,7 +3,7 @@ id: 14038953-e5f2-4daf-acff-5452062baf03 version: 1 date: 2020-6-04 author: Jose Hernandez, Splunk -type: streaming +type: TTP datamodel: [] description: Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml index d8d32dad82..e7a6189558 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_conversion_modules.yml @@ -4,7 +4,7 @@ id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2 version: 1 date: '2020-10-21' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve diff --git a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml index 79db9249a7..61d03803c6 100644 --- a/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_dsinternals_modules.yml @@ -3,7 +3,7 @@ id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d version: 1 date: '2020-10-21' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml index d14effa4d7..9570d6ce16 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_s_option.yml @@ -3,7 +3,7 @@ id: 312582f2-5e91-42c1-a275-cd67f31373c8 version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve diff --git a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml index 4b4a04dc24..cb1d83ee82 100644 --- a/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml +++ b/detections/endpoint/ssa___credential_extraction_fgdump_cachedump_v_option.yml @@ -3,7 +3,7 @@ id: 3c40b0ef-a03f-460a-9484-e4b9117cbb38 version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve diff --git a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml index 6fc58c60fa..48c1461954 100644 --- a/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml +++ b/detections/endpoint/ssa___credential_extraction_getaddbaccount_from_dump.yml @@ -4,7 +4,7 @@ id: e4f126b5-e6bc-4a5c-b1a8-d07bc6c4a49f version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve diff --git a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml index 020080237e..c71ec2c27c 100644 --- a/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml +++ b/detections/endpoint/ssa___credential_extraction_lazagne_command_options.yml @@ -3,7 +3,7 @@ id: 341975fa-4ad0-4f01-9acc-df4f69742db7 version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve diff --git a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml index ebe6f4588f..359a6bf3f2 100644 --- a/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: 966b635f-98e8-4aa4-9b49-47ed2cedcc85 version: 1 date: '2020-10-21' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml index 95fb6ac305..6506854263 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_kernel_peek.yml @@ -3,7 +3,7 @@ id: c20bb8ec-e1b0-4640-b0ef-3a4c54f8c112 version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve diff --git a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml index 1c36de7878..cc5703d472 100644 --- a/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml +++ b/detections/endpoint/ssa___credential_extraction_ms_debuggers_z_option.yml @@ -3,7 +3,7 @@ id: adc51a77-90c9-4358-b43c-f10dd1a27d05 version: 1 date: '2020-10-18' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve diff --git a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml index 04dbeae255..675c82db87 100644 --- a/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml +++ b/detections/endpoint/ssa___credential_extraction_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 5f1186a4-e681-446e-851c-dc9574ad28eb version: 1 date: '2020-10-21' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: Credential extraction is often an illegal recovery of credential material from secured authentication resources and repositories. This process may also involve diff --git a/detections/endpoint/ssa___delete_a_net_user.yml b/detections/endpoint/ssa___delete_a_net_user.yml index 18226a3a7c..4944e530e8 100644 --- a/detections/endpoint/ssa___delete_a_net_user.yml +++ b/detections/endpoint/ssa___delete_a_net_user.yml @@ -3,7 +3,7 @@ id: 8776d79c-d26e-11eb-9a56-acde48001122 version: 1 date: '2021-06-21' author: Teoderick Contreras, Splunk -type: streaming +type: Anomaly datamodel: - Endpoint description: This analytic will detect a suspicious net.exe/net1.exe command-line diff --git a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml index fd7a4f7d52..be38f48e2c 100644 --- a/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___deny_permission_using_cacls_utility.yml @@ -3,7 +3,7 @@ id: b76eae28-cd25-11eb-9c92-acde48001122 version: 1 date: '2021-06-14' author: Teoderick Contreras, Splunk -type: streaming +type: TTP datamodel: - Endpoint description: This analytic identifies a potential adversary that changes the security diff --git a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml index 46397d9466..4f39782191 100644 --- a/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml +++ b/detections/endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml @@ -3,7 +3,7 @@ id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e version: 1 date: '2020-09-15' author: Jose Hernandez, Splunk -type: streaming +type: TTP datamodel: [] description: This search detects the memory of lsass.exe being dumped for offline credential theft attack. diff --git a/detections/endpoint/ssa___detect_kerberoasting.yml b/detections/endpoint/ssa___detect_kerberoasting.yml index ea4b3fe19e..1f5b4e4343 100644 --- a/detections/endpoint/ssa___detect_kerberoasting.yml +++ b/detections/endpoint/ssa___detect_kerberoasting.yml @@ -3,7 +3,7 @@ id: dabdd6d7-3e10-42be-8711-4e124f7a3850 version: 1 date: '2020-10-21' author: Xiao Lin, Splunk -type: streaming +type: TTP datamodel: [] description: This search detects a potential kerberoasting attack via service principal name requests diff --git a/detections/endpoint/ssa___detect_pass_hash.yml b/detections/endpoint/ssa___detect_pass_hash.yml index 3acdee459f..307126de72 100644 --- a/detections/endpoint/ssa___detect_pass_hash.yml +++ b/detections/endpoint/ssa___detect_pass_hash.yml @@ -3,7 +3,7 @@ id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f version: 1 date: '2020-10-21' author: Xiao Lin, Splunk -type: streaming +type: TTP datamodel: [] description: This search looks for specific authentication events from the Windows Security Event logs to detect potential attempts using Pass-the-Hash technique. diff --git a/detections/endpoint/ssa___disable_net_user_account.yml b/detections/endpoint/ssa___disable_net_user_account.yml index d7d1aff9a1..f03182c18e 100644 --- a/detections/endpoint/ssa___disable_net_user_account.yml +++ b/detections/endpoint/ssa___disable_net_user_account.yml @@ -3,7 +3,7 @@ id: ba858b08-d26c-11eb-af9b-acde48001122 version: 1 date: '2021-06-21' author: Teoderick Contreras, Splunk -type: streaming +type: TTP datamodel: - Endpoint description: This analytic will identify a suspicious command-line that disables a diff --git a/detections/endpoint/ssa___first_time_seen_cmd_line.yml b/detections/endpoint/ssa___first_time_seen_cmd_line.yml index 355cff51a4..4e44886c12 100644 --- a/detections/endpoint/ssa___first_time_seen_cmd_line.yml +++ b/detections/endpoint/ssa___first_time_seen_cmd_line.yml @@ -3,7 +3,7 @@ id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23 version: 2 date: 2021-2-1 author: Ignacio Bermudez Corrales, Splunk -type: streaming +type: Anomaly datamodel: [] description: This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. This is an implementation diff --git a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml index 60bbb7e39e..af0e0618bb 100644 --- a/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml +++ b/detections/endpoint/ssa___grant_permission_using_cacls_utility.yml @@ -3,7 +3,7 @@ id: c6da561a-cd29-11eb-ae65-acde48001122 version: 1 date: '2021-06-14' author: Teoderick Contreras, Splunk -type: streaming +type: TTP datamodel: - Endpoint description: This analytic identifies potential adversaries that modify the security diff --git a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml index d823bc0991..8b1638b8d0 100644 --- a/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_access_user_content_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 01fc7d91-eb0c-478e-8633-e4fa4904463a version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules that enable illegaly access user content, such as key logging, audio recording, screenshots, tapping diff --git a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml index 212c382844..a45ecf3e7c 100644 --- a/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 20fba62a-fa5b-46cc-b39f-473fa248fee2 version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules that create accounts illegaly. diff --git a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml index 8117269ce4..c7b05abca5 100644 --- a/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_account_enable_disable_via_dsinternals_modules.yml @@ -3,7 +3,7 @@ id: 3e0f9962-9989-445f-878c-939443326b63 version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of DSInternals modules that enable or disable accounts illegaly. diff --git a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml index 9820dcb2a8..85042ce830 100644 --- a/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_log_deletion_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: 4ddb3b0d-f95f-4ae2-b4e8-663296453a7b version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules that delete event logs. diff --git a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml index 4190380254..3223882d07 100644 --- a/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___illegal_management_AD_elements_and_policies_via_dsinternals_modules.yml @@ -4,7 +4,7 @@ id: a587ca9f-c138-47b4-ba51-699f319b8cc5 version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of DSInternals modules for illegal management of Active Directoty elements and policies. diff --git a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml index f078d62322..265178ec0a 100644 --- a/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_management_computers_and_AD_elements_via_powersploit_modules.yml @@ -4,7 +4,7 @@ id: 75760c11-7d48-4968-b828-013b299e8f6d version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules that enable illegal management of computers and Active Directory elements. diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml index d085cc9296..638ac2099c 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 88c10ee9-fe72-4bce-b343-5b129044b991 version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules that illegaly elevate general privileges or ensure persistence, e.g., enable manipulation of registry, diff --git a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml index fccfccad9f..72a48575e4 100644 --- a/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: 2f873b1f-6352-4844-b7b9-b419f09a42c7 version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of Mimikatz modules for illegal privilege elevation. diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml index 8f5d877367..920c2c3087 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: aaf3adf1-73e1-4477-b4ee-3771898964f1 version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of Mimikatz modules for illegal control over services and processes, including the authentication service. diff --git a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml index 8883cfe1e2..c224d0baa0 100644 --- a/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 0e910e5b-309d-4bc3-8af2-0030c02aa353 version: 1 date: '2020-11-09' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules that enable illegal control of services and processes, such as installing or spoofing of malicious services, diff --git a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml index dd384c8f64..f1556114fb 100644 --- a/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml +++ b/detections/endpoint/ssa___modify_acls_permission_of_files_or_folders.yml @@ -3,7 +3,7 @@ id: 9ae9a48a-cdbe-11eb-875a-acde48001122 version: 1 date: '2021-06-15' author: Teoderick Contreras, Splunk -type: streaming +type: Anomaly datamodel: - Endpoint description: This analytic identifies suspicious modification of ACL permission to diff --git a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml index 4f796555b4..8e07b350a2 100644 --- a/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: d405af5d-99f1-45af-8dfb-b8f98b764247 version: 1 date: '2020-11-04' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of PowerSploit modules that facilitate access probing with admin credentials as well as probing access to system services. diff --git a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml index 8fb17415ed..24da4393a2 100644 --- a/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml +++ b/detections/endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml @@ -3,7 +3,7 @@ id: c10a18cb-fd80-4ffa-a844-25026e0a0c94 version: 1 date: 2020-7-13 author: Ignacio Bermudez Corrales, Splunk -type: streaming +type: TTP datamodel: [] description: This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. This is diff --git a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml index f946e48aae..6567d28163 100644 --- a/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml +++ b/detections/endpoint/ssa___rare_parent_process_relationship_lolbas.yml @@ -3,7 +3,7 @@ id: cf090c78-bcc6-11eb-8529-0242ac130003 version: 1 date: '2021-05-20' author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk -type: streaming +type: Anomaly datamodel: [] description: An attacker may use LOLBAS tools spawned from vulnerable applications not typically used by system administrators. This search leverages the Splunk Streaming diff --git a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml index b1653762d6..537fdf3391 100644 --- a/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_access_and_persistence_opportunities_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7 version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of PowerSploit modules that discover opportunities for malicious access and persistence. Some examples include access to admin accounts, diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml index 7f8cf6e654..cfcb63b207 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_policies_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 63422f8e-766c-468f-8133-2ba6795e263b version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules that discover accounts, groups and policies that can be accessed or taken over. diff --git a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml index be4717def3..40fa43524e 100644 --- a/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_accounts_groups_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: 1bce67aa-3fc4-4886-9089-67f0bfebbef6 version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of Mimikatz modules for discovery of accounts and groups and access to them. diff --git a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml index a7e80199eb..ca03e6dcc1 100644 --- a/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_active_directory_infrastructure_via_powersploit_modules.yml @@ -4,7 +4,7 @@ id: db08ac40-ee14-43e9-9a75-dddd059ef812 version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules for reconnaissance and access to elements of Active Directory infrastructure, such as domain identifiers, diff --git a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml index 6e3077f5bd..86bcac8aae 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_domains_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: fe1c4c5a-09f3-4b43-8129-560a7f38a08b version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules that discover computers, servers and domains that can be accessed or taken over. diff --git a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml index f65abc61c0..49611352d8 100644 --- a/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_computers_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: 48664505-7d22-44ee-87d2-4c8a5bdc3d14 version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of Mimikatz modules for discovery of computers and servers and access to them. diff --git a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml index 02d762f620..1be62676ca 100644 --- a/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_operating_system_elements_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: c1d33ad9-1727-4f9f-a474-4adbe4fed68a version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules that discover and access operating system elements, such as processes, services, registry locations, diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml index a3f1c2d85b..0638c05c09 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: c97b6eb9-1d8b-4017-bbbb-2af7fc17bc3f version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of Mimikatz modules for discovery and access to network shares. diff --git a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml index 64a86372ba..fed9e72691 100644 --- a/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_and_use_shares_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 6b7ca431-6b1e-4b40-9589-21cb368e369e version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules that discover and access network and distributed file system shares. diff --git a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml index 647dcf4512..59c8c479dd 100644 --- a/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_connectivity_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 525d32fd-65dd-4732-9b72-3cfc7ddddbd2 version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies access to PowerSploit modules for reconnaissance of connectivity. diff --git a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml index 5cfdef007f..a325b9efbd 100644 --- a/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_credential_stores_and_services_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: 5facee5b-79e4-47ab-b0e6-c625acc0554f version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies reconnaissance of credential stores and use of CryptoAPI services by Mimikatz modules. diff --git a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml index 32ef4abbeb..b865a0e502 100644 --- a/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_defensive_tools_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 24b4e659-63a2-4e7b-89ac-87dd659c7110 version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of PowerSploit modules for assessment of presence of defensive tools. diff --git a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml index f8f29c6fdf..67a0ef44e8 100644 --- a/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___recon_privilege_escalation_opportunities_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: b9b4492c-2af8-449b-beb4-b1b78d963321 version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of PowerSploit modules for assessment of privilege escalation opportunities. diff --git a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml index 034d96eae1..c87e6d919d 100644 --- a/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_process_service_hijacking_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: fc5c1cbd-7494-4314-aad2-458d6fd4fada version: 1 date: '2020-11-05' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of Mimikatz modules for discovery of process or service hijacking opportunities via Microsoft Detours compatibility. Microsoft diff --git a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml index 1f7bf96dc5..3b849f17e0 100644 --- a/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___recon_processes_and_services_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: 0243d37c-57c1-4182-bfd1-39b212255fc8 version: 1 date: '2020-11-06' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies use of Mimikatz modules for discovery and access to services and processes. diff --git a/detections/endpoint/ssa___resize_shadowstorage_volume.yml b/detections/endpoint/ssa___resize_shadowstorage_volume.yml index 15aa136dae..de8bf510b9 100644 --- a/detections/endpoint/ssa___resize_shadowstorage_volume.yml +++ b/detections/endpoint/ssa___resize_shadowstorage_volume.yml @@ -3,7 +3,7 @@ id: dbc30554-d27e-11eb-9e5e-acde48001122 version: 1 date: '2021-06-21' author: Teoderick Contreras, Splunk -type: streaming +type: TTP datamodel: - Endpoint description: The following analytics identifies the resizing of shadowstorage by ransomware diff --git a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml index 20ee3eb47d..f46b03d47f 100644 --- a/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_dsinternals_modules.yml @@ -3,7 +3,7 @@ id: d5ef590f-9bde-49eb-9c63-2f5b62a65b9c version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies illegal setting of credentials via DSInternals modules. diff --git a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml index 7847644266..3eb0dff00f 100644 --- a/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_mimikatz_modules.yml @@ -3,7 +3,7 @@ id: c8b84699-7652-4363-910f-efd1ca82f780 version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies illegal setting of credentials via Mimikatz modules. diff --git a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml index 7099d84b62..04eb74c964 100644 --- a/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml +++ b/detections/endpoint/ssa___setting_credentials_via_powersploit_modules.yml @@ -3,7 +3,7 @@ id: 07b2a501-f967-4ddc-9f56-2dce46dfce44 version: 1 date: '2020-11-03' author: Stanislav Miskovic, Splunk -type: streaming +type: TTP datamodel: [] description: This detection identifies illegal setting of credentials via PowerSploit modules. diff --git a/detections/endpoint/ssa___system_process_running_unexpected_location.yml b/detections/endpoint/ssa___system_process_running_unexpected_location.yml index ca13c9e39c..57d463a102 100644 --- a/detections/endpoint/ssa___system_process_running_unexpected_location.yml +++ b/detections/endpoint/ssa___system_process_running_unexpected_location.yml @@ -3,7 +3,7 @@ id: 28179107-099a-464a-94d3-08301e6c055f version: 2 date: '2020-08-25' author: Ignacio Bermudez Corrales, Splunk -type: streaming +type: Anomaly datamodel: [] description: An attacker tries might try to use different version of a system command without overriding original, or they might try to avoid some detection running the diff --git a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml index 91a6f580d2..4d0f36e160 100644 --- a/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml +++ b/detections/endpoint/ssa___unusual_lolbas_in_short_period_of_time.yml @@ -3,7 +3,7 @@ id: 59c0dd70-169c-4900-9a1f-bfcf13302f93 version: 1 date: '2020-08-25' author: Ignacio Bermudez Corrales, Splunk -type: streaming +type: Anomaly datamodel: [] description: Attacker activity may compromise executing several LOLBAS applications in conjunction to accomplish their objectives. We are looking for more than usual diff --git a/detections/endpoint/ssa___unusually_long_command_line.yml b/detections/endpoint/ssa___unusually_long_command_line.yml index 3ec5e66803..f2fc25af16 100644 --- a/detections/endpoint/ssa___unusually_long_command_line.yml +++ b/detections/endpoint/ssa___unusually_long_command_line.yml @@ -3,7 +3,7 @@ id: 58f43aba-1775-445e-b19c-be2b87d83ae3 version: 1 date: '2020-10-06' author: Ignacio Bermudez Corrales, Splunk -type: streaming +type: Anomaly datamodel: [] description: Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin diff --git a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml index ebf3548b14..3fcd754a7e 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_clear_logs.yml @@ -3,7 +3,7 @@ id: 5438113c-cdd9-11eb-93b8-acde48001122 version: 1 date: '2021-06-15' author: Teoderick Contreras, Splunk -type: streaming +type: TTP datamodel: - Endpoint description: The wevtutil.exe application is the windows event log utility. This searches diff --git a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml index ce8612550c..0c3f11db68 100644 --- a/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml +++ b/detections/endpoint/ssa___wevtutil_usage_to_disable_logs.yml @@ -3,7 +3,7 @@ id: a4bdc944-cdd9-11eb-ac97-acde48001122 version: 1 date: '2021-06-15' author: Teoderick Contreras, Splunk -type: streaming +type: TTP datamodel: - Endpoint description: This search is to detect execution of wevtutil.exe to disable logs. This diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml index f575d5fe9a..ec6fb002a0 100644 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ b/detections/endpoint/start_up_during_safe_mode_boot.yml @@ -3,7 +3,7 @@ id: c6149154-c9d8-11eb-9da7-acde48001122 version: 1 date: '2021-06-10' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a modification or registry add to the safeboot diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index 076b4a3321..04747a5b77 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -3,7 +3,7 @@ id: ff61e98c-0337-4593-a78f-72a676c56f26 version: 1 date: '2021-02-23' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index abe14f904a..1cd8fd67d1 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -3,7 +3,7 @@ id: f880acd4-a8f1-11eb-a53b-acde48001122 version: 1 date: '2021-04-29' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic will detect suspicious driver loaded paths. This technique diff --git a/detections/endpoint/suspicious_event_log_service_behavior.yml b/detections/endpoint/suspicious_event_log_service_behavior.yml index 3ff1aad0d9..e167ed7e80 100644 --- a/detections/endpoint/suspicious_event_log_service_behavior.yml +++ b/detections/endpoint/suspicious_event_log_service_behavior.yml @@ -3,7 +3,7 @@ id: 2b85aa3d-f5f6-4c2e-a081-a09f6e1c2e40 version: 1 date: '2021-06-17' author: Mauricio Velazco, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic utilizes Windows Event ID 1100 to identify when Windows event log service is shutdown. Note that this is a voluminous analytic that diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index 40edcae0eb..335610bb18 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -3,7 +3,7 @@ id: f308490a-473a-40ef-ae64-dd7a6eba284a version: 1 date: '2021-02-23' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies gpupdate.exe with no command line arguments. It is unusual for gpupdate.exe to execute with no command line arguments present. diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index a45c436486..aaa633f690 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -3,7 +3,7 @@ id: f0db4464-55d9-11eb-ae93-0242ac130002 version: 1 date: '2021-01-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index 5eefa64853..7d348d49c4 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -3,7 +3,7 @@ id: 9bbc62e8-55d8-11eb-ae93-0242ac130002 version: 1 date: '2021-01-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies microsoft.workflow.compiler.exe usage. diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index 4d2970ff5f..17d6958e8a 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -3,7 +3,7 @@ id: f5198224-551c-11eb-ae93-0242ac130002 version: 1 date: '2021-01-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies msbuild.exe executing from a non-standard diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index 1ce79ca567..e5b7078fef 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -3,7 +3,7 @@ id: 4006adac-5937-11eb-ae93-0242ac130002 version: 1 date: '2021-01-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies renamed instances of msbuild.exe executing. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index fbfc02af18..34de01f65a 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -3,7 +3,7 @@ id: a115fba6-5514-11eb-ae93-0242ac130002 version: 1 date: '2021-01-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index da83ffc561..3c4d2ba9f1 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -3,7 +3,7 @@ id: 60023bb6-5500-11eb-ae93-0242ac130002 version: 1 date: '2021-01-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies child processes spawning from "mshta.exe". diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml index d3d9a537ce..4f8795d95b 100644 --- a/detections/endpoint/suspicious_mshta_spawn.yml +++ b/detections/endpoint/suspicious_mshta_spawn.yml @@ -3,7 +3,7 @@ id: 4d33a488-5b5f-11eb-ae93-0242ac130002 version: 1 date: '2021-01-20' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies wmiprvse.exe spawning mshta.exe. This diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index cb66970999..ff7ef7a5b0 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -3,7 +3,7 @@ id: 9be25988-ad82-11eb-a14f-acde48001122 version: 1 date: '2021-05-05' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic will detect a suspicious process running in a diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index d90df61adc..4bf54ded45 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -3,7 +3,7 @@ id: a6b3ab4e-dd77-4213-95fa-fc94701995e0 version: 4 date: '2020-07-22' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for reg.exe being launched from a command prompt not started by the user. When a user launches cmd.exe, the parent process is usually diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 6d00c6edeb..39585546ce 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -3,7 +3,7 @@ id: 62732736-6250-11eb-ae93-0242ac130002 version: 1 date: '2021-01-28' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index efceda4b73..f4aeea2f5b 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -3,7 +3,7 @@ id: 8c00a385-9b86-4ac0-8932-c9ec3713b159 version: 1 date: '2021-02-09' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies rundll32.exe using dllregisterserver diff --git a/detections/endpoint/suspicious_rundll32_rename.yml b/detections/endpoint/suspicious_rundll32_rename.yml index 9f8ae2a27e..b873107db8 100644 --- a/detections/endpoint/suspicious_rundll32_rename.yml +++ b/detections/endpoint/suspicious_rundll32_rename.yml @@ -3,7 +3,7 @@ id: 7360137f-abad-473e-8189-acbdaa34d114 version: 1 date: '2021-02-04' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies renamed instances of rundll32.exe executing. rundll32.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. During diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index 1c24057ef8..858c3193b1 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -3,7 +3,7 @@ id: 9319dda5-73f2-4d43-a85a-67ce961bddb7 version: 1 date: '2021-02-04' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies rundll32.exe executing a DLL function diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index d6b7327a87..8bfcc7d07d 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -3,7 +3,7 @@ id: e451bd16-e4c5-4109-8eb1-c4c6ecf048b4 version: 1 date: '2021-02-09' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index fe8a5c3407..c6f5229ee0 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -3,7 +3,7 @@ id: 7feb7972-7ac3-11eb-bac8-acde48001122 version: 1 date: '2021-03-01' author: Michael Haag, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: The following detection identifies Scheduled Tasks registering (creating diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index db76d6d087..cc96a6546a 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -3,7 +3,7 @@ id: f52d2db8-31f9-4aa7-a176-25779effe55c version: 1 date: '2021-02-23' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies searchprotocolhost.exe with no command line arguments. It is unusual for searchprotocolhost.exe to execute with no command diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index 118240e995..1008be5c49 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -3,7 +3,7 @@ id: 2827c0fd-e1be-4868-ae25-59d28e0f9d4f version: 3 date: '2020-07-22' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The wevtutil.exe application is the windows event log utility. This searches diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index e6e52c0c47..3a6d8ebc52 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -3,7 +3,7 @@ id: b5541828-8ffd-4070-9d95-b3da4de924cb version: 4 date: '2020-07-22' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: [] description: This search detects writes to the recycle bin by a process other than explorer.exe. diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index 55304c3f96..dff2edcb82 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -3,7 +3,7 @@ id: 8e99f89e-ae58-4ebc-bf52-ae0b1a277e72 version: 1 date: '2020-10-12' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Detect system information discovery techniques used by attackers to understand diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 9d68afdb5c..ccfd940108 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -3,7 +3,7 @@ id: a34aae96-ccf8-4aef-952c-3ea21444444d version: 6 date: '2020-12-08' author: David Dorsey, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'This search looks for system processes that typically execute from `C:\Windows\System32\` diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index 47bee135a7..00da26c2e7 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -3,7 +3,7 @@ id: 1804b0a4-a682-11eb-8f68-acde48001122 version: 1 date: '2021-04-26' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to detect potential trickbot infection through the create/connected diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml index aac1555177..b9bdc2bc84 100644 --- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml +++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml @@ -3,7 +3,7 @@ id: f1126df0-7bd5-11eb-988f-acde48001122 version: 1 date: '2021-03-02' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This detection identifies Microsoft Exchange Server's Unified Messaging diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 766fd5d2fd..88d68cc019 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -3,7 +3,7 @@ id: c77162d3-f93c-45cc-80c8-22f665664g9f version: 3 date: '2020-07-22' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: Attackers often disable security tools to avoid detection. This search diff --git a/detections/endpoint/unloading_amsi_via_reflection.yml b/detections/endpoint/unloading_amsi_via_reflection.yml index f4c8e8ccda..cdb19efa31 100644 --- a/detections/endpoint/unloading_amsi_via_reflection.yml +++ b/detections/endpoint/unloading_amsi_via_reflection.yml @@ -3,7 +3,7 @@ id: a21e3484-c94d-11eb-b55b-acde48001122 version: 1 date: '2021-06-09' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command diff --git a/detections/endpoint/unusually_long_command_line.yml b/detections/endpoint/unusually_long_command_line.yml index 9cecb80c5c..87cd287284 100644 --- a/detections/endpoint/unusually_long_command_line.yml +++ b/detections/endpoint/unusually_long_command_line.yml @@ -3,7 +3,7 @@ id: c77162d3-f93c-45cc-80c8-22f6a4264e7f version: 5 date: '2020-12-08' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: Command lines that are extremely long may be indicative of malicious activity on your hosts. diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index d994117bba..9a99f65741 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -3,7 +3,7 @@ id: b6e0ff70-b122-4227-9368-4cf322ab43c3 version: 2 date: '2018-12-03' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The fsutil.exe application is a legitimate Windows utility used to perform diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 463906186f..f6be453fcf 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -3,7 +3,7 @@ id: 0f03423c-7c6a-11eb-bc47-acde48001122 version: 1 date: '2021-03-03' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index c8a5890ee4..59a05b0476 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -3,7 +3,7 @@ id: cd5aed7e-5cea-11eb-ae93-0242ac130002 version: 1 date: '2021-01-22' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index 39115e4d85..f4e12a1e53 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -3,7 +3,7 @@ id: 9d911ce0-c3be-11eb-b177-acde48001122 version: 1 date: '2021-06-02' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is designed to detect potential malicious process loading diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index d1792692f1..5eb84c2083 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -3,7 +3,7 @@ id: ed313326-a0f9-11eb-a89c-acde48001122 version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is designed to detect suspicious wermgr.exe process that diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml index 2fc9acb437..6258d4561f 100644 --- a/detections/endpoint/wermgr_process_create_executable_file.yml +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -3,7 +3,7 @@ id: ab3bcce0-a105-11eb-973c-acde48001122 version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is designed to detect potential malicious wermgr.exe process diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index f41695c398..3549123aa7 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -3,7 +3,7 @@ id: e8fc95bc-a107-11eb-a978-acde48001122 version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is designed to detect suspicious cmd and powershell process diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index d4e86e5b1d..822d176ef0 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -3,7 +3,7 @@ id: 23150a40-9301-4195-b802-5bb4f43067fb version: 2 date: '2021-03-02' author: Rod Soto, Jose Hernandez, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The search looks for the Registry Key DisableAntiSpyware set to disable. diff --git a/detections/endpoint/windows_event_log_cleared.yml b/detections/endpoint/windows_event_log_cleared.yml index 2d1093afd1..9778a332d8 100644 --- a/detections/endpoint/windows_event_log_cleared.yml +++ b/detections/endpoint/windows_event_log_cleared.yml @@ -3,7 +3,7 @@ id: ad517544-aff9-4c96-bd99-d6eb43bfbb6a version: 6 date: '2020-07-06' author: Rico Valdez, Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic utilizes Windows Security Event ID 1102 or System log event 104 to identify when a Windows event log is cleared. Note that this analytic diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index fef52f7f43..a19aed6db2 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -3,7 +3,7 @@ id: 69c12d59-d951-431e-ab77-ec426b8d65e6 version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk -type: batch +type: TTP datamodel: [] description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 6398576f38..3a27ec69b9 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -3,7 +3,7 @@ id: 203ef0ea-9bd8-11eb-8201-acde48001122 version: 1 date: '2021-04-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index 50bf759520..475a1ee593 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -3,7 +3,7 @@ id: 5d9c6eee-988c-11eb-8253-acde48001122 version: 1 date: '2021-04-08' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 74c31fea07..82aa112a8f 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -3,7 +3,7 @@ id: 6fcbaedc-a37b-11eb-956b-acde48001122 version: 1 date: '2021-04-22' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following detection identifies Microsoft Word spawning `cmd.exe`. diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index a76e3afa90..dcfa34b011 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -3,7 +3,7 @@ id: b2c950b8-9be2-11eb-8658-acde48001122 version: 1 date: '2021-04-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following detection identifies Microsoft Word spawning PowerShell. diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index dfa44f671d..475a7cf429 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -3,7 +3,7 @@ id: 637e1b5c-9be1-11eb-9c32-acde48001122 version: 1 date: '2021-04-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following detection identifies Microsoft Winword.exe spawning Windows diff --git a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml index eaa0d67527..f189c529b7 100644 --- a/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml +++ b/detections/endpoint/wmi_permanent_event_subscription___sysmon.yml @@ -3,7 +3,7 @@ id: ad05aae6-3b2a-4f73-af97-57bd26cee3b9 version: 3 date: '2020-12-08' author: Rico Valdez, Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'This analytic looks for the creation of WMI permanent event subscriptions. The following analytic identifies the use of WMI Event Subscription to establish diff --git a/detections/endpoint/wmi_recon_running_process_or_services.yml b/detections/endpoint/wmi_recon_running_process_or_services.yml index 8fd1c719fb..3cfbab07f2 100644 --- a/detections/endpoint/wmi_recon_running_process_or_services.yml +++ b/detections/endpoint/wmi_recon_running_process_or_services.yml @@ -3,7 +3,7 @@ id: b5cd5526-cce7-11eb-b3bd-acde48001122 version: 1 date: '2021-06-14' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes diff --git a/detections/endpoint/write_executable_in_smb_share.yml b/detections/endpoint/write_executable_in_smb_share.yml index 52e1962464..16c6a2ee15 100644 --- a/detections/endpoint/write_executable_in_smb_share.yml +++ b/detections/endpoint/write_executable_in_smb_share.yml @@ -3,7 +3,7 @@ id: f63c34fe-a435-11eb-935a-acde48001122 version: 1 date: '2021-04-23' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect suspicious dropping or creating an executable diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index ac31e30b59..39a01c110c 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -3,7 +3,7 @@ id: 90080fa6-a8df-11eb-91e4-acde48001122 version: 1 date: '2021-04-29' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This analytic identifies XMRIG coinminer driver installation on the system. From cfae82505c5b80926a4f3fa61048c48ae1053dc6 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 19 Jul 2021 17:41:22 +0200 Subject: [PATCH 03/21] add analytic types to detections --- .../application/detect_new_login_attempts_to_routers.yml | 2 +- .../experimental/application/detect_phishing_content___ssa.yml | 2 +- .../application/email_attachments_with_lots_of_spaces.yml | 2 +- .../email_files_written_outside_of_the_outlook_directory.yml | 2 +- .../email_servers_sending_high_volume_traffic_to_hosts.yml | 2 +- .../experimental/application/monitor_email_for_brand_abuse.yml | 2 +- ...le_okta_users_with_invalid_credentails_from_the_same_ip.yml | 2 +- .../application/no_windows_updates_in_a_time_frame.yml | 2 +- .../experimental/application/okta_account_lockout_events.yml | 2 +- .../experimental/application/okta_failed_sso_attempts.yml | 2 +- .../application/okta_user_logins_from_multiple_cities.yml | 2 +- .../application/suspicious_email_attachment_extensions.yml | 2 +- .../experimental/application/suspicious_java_classes.yml | 2 +- .../application/web_servers_executing_suspicious_processes.yml | 2 +- .../cloud/abnormally_high_cloud_instances_destroyed.yml | 2 +- .../cloud/abnormally_high_cloud_instances_launched.yml | 2 +- .../cloud/amazon_eks_kubernetes_cluster_scan_detection.yml | 2 +- .../cloud/amazon_eks_kubernetes_pod_scan_detection.yml | 2 +- .../experimental/cloud/aws_detect_attach_to_role_policy.yml | 2 +- .../experimental/cloud/aws_detect_permanent_key_creation.yml | 2 +- detections/experimental/cloud/aws_detect_role_creation.yml | 2 +- .../experimental/cloud/aws_detect_sts_assume_role_abuse.yml | 2 +- .../cloud/aws_detect_sts_get_session_token_abuse.yml | 2 +- .../cloud/detect_gcp_storage_access_from_a_new_ip.yml | 2 +- .../experimental/cloud/detect_new_open_gcp_storage_buckets.yml | 2 +- .../experimental/cloud/detect_s3_access_from_a_new_ip.yml | 2 +- .../cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml | 2 +- .../detect_spike_in_blocked_outbound_traffic_from_your_aws.yml | 2 +- .../experimental/cloud/detect_spike_in_s3_bucket_deletion.yml | 2 +- detections/experimental/cloud/gcp_detect_gcploit_framework.yml | 3 +-- .../cloud/gcp_kubernetes_cluster_pod_scan_detection.yml | 2 +- .../high_number_of_login_failures_from_a_single_source.yml | 2 +- .../cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml | 2 +- .../experimental/cloud/new_container_uploaded_to_aws_ecr.yml | 2 +- .../experimental/endpoint/child_processes_of_spoolsv_exe.yml | 2 +- .../endpoint/detect_baron_samedit_cve_2021_3156.yml | 2 +- .../endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml | 2 +- .../detect_baron_samedit_cve_2021_3156_via_osquery.yml | 2 +- .../endpoint/detect_outlook_exe_writing_a_zip_file.yml | 2 +- detections/experimental/endpoint/detect_rare_executables.yml | 2 +- .../endpoint/detection_of_tools_built_by_nirsoft.yml | 2 +- .../endpoint/first_time_seen_running_windows_service.yml | 2 +- .../experimental/endpoint/macos___re_opened_applications.yml | 2 +- .../endpoint/processes_tapping_keyboard_events.yml | 2 +- .../endpoint/remote_desktop_process_running_on_system.yml | 2 +- detections/experimental/endpoint/spike_in_file_writes.yml | 2 +- .../endpoint/sunburst_correlation_dll_and_network_event.yml | 2 +- .../endpoint/suspicious_curl_network_connection.yml | 2 +- .../experimental/endpoint/suspicious_plistbuddy_usage.yml | 2 +- .../endpoint/suspicious_plistbuddy_usage_via_osquery.yml | 2 +- .../endpoint/suspicious_sqlite3_lsquarantine_behavior.yml | 2 +- .../endpoint/unusually_long_command_line___mltk.yml | 2 +- detections/experimental/endpoint/windows_adfind_exe.yml | 2 +- detections/experimental/endpoint/winrm_spawning_a_process.yml | 2 +- .../experimental/endpoint/wmi_permanent_event_subscription.yml | 2 +- .../experimental/endpoint/wmi_temporary_event_subscription.yml | 2 +- detections/experimental/network/detect_arp_poisoning.yml | 2 +- .../network/detect_ipv6_network_infrastructure_threats.yml | 2 +- .../network/detect_large_outbound_icmp_packets.yml | 2 +- .../experimental/network/detect_outbound_smb_traffic.yml | 2 +- .../experimental/network/detect_port_security_violation.yml | 2 +- detections/experimental/network/detect_rogue_dhcp_server.yml | 2 +- .../experimental/network/detect_snicat_sni_exfiltration.yml | 2 +- .../network/detect_software_download_to_network_device.yml | 2 +- detections/experimental/network/detect_traffic_mirroring.yml | 2 +- .../network/detect_unauthorized_assets_by_mac_address.yml | 2 +- .../network/detect_windows_dns_sigred_via_splunk_stream.yml | 2 +- .../network/detect_windows_dns_sigred_via_zeek.yml | 2 +- detections/experimental/network/detect_zerologon_via_zeek.yml | 2 +- .../experimental/network/dns_query_length_outliers___mltk.yml | 2 +- detections/experimental/network/excessive_dns_failures.yml | 2 +- ...eiving_high_volume_of_network_traffic_from_email_server.yml | 2 +- .../experimental/network/large_volume_of_dns_any_queries.yml | 2 +- .../network/prohibited_network_traffic_allowed.yml | 2 +- detections/experimental/network/protocol_or_port_mismatch.yml | 2 +- .../network/protocols_passing_authentication_in_cleartext.yml | 2 +- .../experimental/network/remote_desktop_network_bruteforce.yml | 2 +- .../experimental/network/remote_desktop_network_traffic.yml | 2 +- detections/experimental/network/smb_traffic_spike.yml | 2 +- detections/experimental/network/smb_traffic_spike___mltk.yml | 2 +- detections/experimental/network/tor_traffic.yml | 2 +- .../network/unusually_long_content_type_length.yml | 2 +- .../detect_attackers_scanning_for_vulnerable_jboss_servers.yml | 2 +- .../experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml | 2 +- .../web/detect_malicious_requests_to_exploit_jboss_servers.yml | 2 +- .../experimental/web/monitor_web_traffic_for_brand_abuse.yml | 2 +- detections/experimental/web/sql_injection_with_long_urls.yml | 2 +- detections/experimental/web/supernova_webshell.yml | 2 +- .../detect_hosts_connecting_to_dynamic_domain_providers.yml | 2 +- .../network/dns_query_length_with_high_standard_deviation.yml | 2 +- .../network/multiple_archive_files_http_post_traffic.yml | 2 +- detections/network/plain_http_post_exfiltrated_data.yml | 2 +- 92 files changed, 92 insertions(+), 93 deletions(-) diff --git a/detections/experimental/application/detect_new_login_attempts_to_routers.yml b/detections/experimental/application/detect_new_login_attempts_to_routers.yml index 64c82afde4..f3fc4ad026 100644 --- a/detections/experimental/application/detect_new_login_attempts_to_routers.yml +++ b/detections/experimental/application/detect_new_login_attempts_to_routers.yml @@ -3,7 +3,7 @@ id: 104658f4-afdc-499e-9719-17243rr826f1 version: 1 date: '2017-09-12' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Authentication description: The search queries the authentication logs for assets that are categorized diff --git a/detections/experimental/application/detect_phishing_content___ssa.yml b/detections/experimental/application/detect_phishing_content___ssa.yml index 567f739e5a..07abc4d512 100644 --- a/detections/experimental/application/detect_phishing_content___ssa.yml +++ b/detections/experimental/application/detect_phishing_content___ssa.yml @@ -3,7 +3,7 @@ id: 4b237388-dfa1-41a6-91d4-4de2d598376f version: 1 date: '2020-08-25' author: Xiao Lin, Splunk -type: streaming +type: Anomaly datamodel: [] description: Malicious mails can conduct phishing that induces readers to open attachment, click links or trigger third party service. This detect uses Natural Language Processing diff --git a/detections/experimental/application/email_attachments_with_lots_of_spaces.yml b/detections/experimental/application/email_attachments_with_lots_of_spaces.yml index 41756c1e47..119e97731c 100644 --- a/detections/experimental/application/email_attachments_with_lots_of_spaces.yml +++ b/detections/experimental/application/email_attachments_with_lots_of_spaces.yml @@ -3,7 +3,7 @@ id: 56e877a6-1455-4479-ada6-0550dc1e22f8 version: 2 date: '2017-09-19' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Email description: Attackers often use spaces as a means to obfuscate an attachment's file diff --git a/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml b/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml index 8d4f823b6c..a0d01cce1e 100644 --- a/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml +++ b/detections/experimental/application/email_files_written_outside_of_the_outlook_directory.yml @@ -3,7 +3,7 @@ id: ee18ed37-0802-4268-9435-b3b91aaa18xx version: 3 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The search looks at the change-analysis data model and detects email diff --git a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml index fdf21a24e1..6d87cd4cc5 100644 --- a/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml +++ b/detections/experimental/application/email_servers_sending_high_volume_traffic_to_hosts.yml @@ -3,7 +3,7 @@ id: 7f5fb3e1-4209-4914-90db-0ec21b556378 version: 2 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: - Network_Traffic description: This search looks for an increase of data transfers from your email server diff --git a/detections/experimental/application/monitor_email_for_brand_abuse.yml b/detections/experimental/application/monitor_email_for_brand_abuse.yml index bb4e5c8f99..9c30796093 100644 --- a/detections/experimental/application/monitor_email_for_brand_abuse.yml +++ b/detections/experimental/application/monitor_email_for_brand_abuse.yml @@ -3,7 +3,7 @@ id: b2ea1f38-3a3e-4b8a-9cf1-82760d86a6b8 version: 2 date: '2018-01-05' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Email description: This search looks for emails claiming to be sent from a domain similar diff --git a/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml b/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml index 998c33216e..85daab2383 100644 --- a/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml +++ b/detections/experimental/application/multiple_okta_users_with_invalid_credentails_from_the_same_ip.yml @@ -3,7 +3,7 @@ id: 19cba45f-cad3-4032-8911-0c09e0444552 version: 2 date: '2020-07-21' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: [] description: This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. diff --git a/detections/experimental/application/no_windows_updates_in_a_time_frame.yml b/detections/experimental/application/no_windows_updates_in_a_time_frame.yml index 436ad2e90a..ac9464d296 100644 --- a/detections/experimental/application/no_windows_updates_in_a_time_frame.yml +++ b/detections/experimental/application/no_windows_updates_in_a_time_frame.yml @@ -3,7 +3,7 @@ id: 1a77c08c-2f56-409c-a2d3-7d64617edd4f version: 1 date: '2017-09-15' author: Bhavin Patel, Splunk -type: batch +type: Hunting datamodel: - Updates description: This search looks for Windows endpoints that have not generated an event diff --git a/detections/experimental/application/okta_account_lockout_events.yml b/detections/experimental/application/okta_account_lockout_events.yml index 9e9fb09806..2adb262cc1 100644 --- a/detections/experimental/application/okta_account_lockout_events.yml +++ b/detections/experimental/application/okta_account_lockout_events.yml @@ -3,7 +3,7 @@ id: 62b70968-a0a5-4724-8ac4-67871e6f544d version: 2 date: '2020-07-21' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: [] description: Detect Okta user lockout events search: '`okta` displayMessage="Max sign in attempts exceeded" | rename client.geographicalContext.country diff --git a/detections/experimental/application/okta_failed_sso_attempts.yml b/detections/experimental/application/okta_failed_sso_attempts.yml index d3657a18aa..4f62292be1 100644 --- a/detections/experimental/application/okta_failed_sso_attempts.yml +++ b/detections/experimental/application/okta_failed_sso_attempts.yml @@ -3,7 +3,7 @@ id: 371a6545-2618-4032-ad84-93386b8698c5 version: 2 date: '2020-07-21' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: [] description: Detect failed Okta SSO events search: '`okta` displayMessage="User attempted unauthorized access to app" | stats min(_time) diff --git a/detections/experimental/application/okta_user_logins_from_multiple_cities.yml b/detections/experimental/application/okta_user_logins_from_multiple_cities.yml index f9af8ceabf..a394023881 100644 --- a/detections/experimental/application/okta_user_logins_from_multiple_cities.yml +++ b/detections/experimental/application/okta_user_logins_from_multiple_cities.yml @@ -3,7 +3,7 @@ id: 7594fa07-9f34-4d01-81cc-d6af6a5db9e8 version: 2 date: '2020-07-21' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: [] description: This search detects logins from the same user from different cities in a 24 hour period. diff --git a/detections/experimental/application/suspicious_email_attachment_extensions.yml b/detections/experimental/application/suspicious_email_attachment_extensions.yml index 0dd5924c4e..b4633adfe4 100644 --- a/detections/experimental/application/suspicious_email_attachment_extensions.yml +++ b/detections/experimental/application/suspicious_email_attachment_extensions.yml @@ -3,7 +3,7 @@ id: 473bd65f-06ca-4dfe-a2b8-ba04ab4a0084 version: 3 date: '2020-07-22' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Email description: This search looks for emails that have attachments with suspicious file diff --git a/detections/experimental/application/suspicious_java_classes.yml b/detections/experimental/application/suspicious_java_classes.yml index 71b239ab65..3588838433 100644 --- a/detections/experimental/application/suspicious_java_classes.yml +++ b/detections/experimental/application/suspicious_java_classes.yml @@ -3,7 +3,7 @@ id: if1fea6da-3c86-4c1d-b255-fc3b2781a491 version: 1 date: '2018-12-06' author: Jose Hernandez, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for suspicious Java classes that are often used to exploit remote command execution in common Java frameworks, such as Apache Struts. diff --git a/detections/experimental/application/web_servers_executing_suspicious_processes.yml b/detections/experimental/application/web_servers_executing_suspicious_processes.yml index 0b9aedda13..225805170e 100644 --- a/detections/experimental/application/web_servers_executing_suspicious_processes.yml +++ b/detections/experimental/application/web_servers_executing_suspicious_processes.yml @@ -3,7 +3,7 @@ id: ec3b7601-689a-4463-94e0-c9f45638efb9 version: 1 date: '2019-04-01' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for suspicious processes on all systems labeled as diff --git a/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml b/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml index 9c63535d48..e703c4b3e0 100644 --- a/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml +++ b/detections/experimental/cloud/abnormally_high_cloud_instances_destroyed.yml @@ -3,7 +3,7 @@ id: ef629fc9-1583-4590-b62a-f2247fbf7bbf version: 1 date: '2020-08-21' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search finds for the number successfully destroyed cloud instances diff --git a/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml b/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml index a51da3d794..8397f01576 100644 --- a/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml +++ b/detections/experimental/cloud/abnormally_high_cloud_instances_launched.yml @@ -3,7 +3,7 @@ id: f2361e9f-3928-496c-a556-120cd4223a65 version: 2 date: '2020-08-21' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Change description: This search finds for the number successfully created cloud instances diff --git a/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml b/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml index f480552aaf..4e0722abe3 100644 --- a/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml +++ b/detections/experimental/cloud/amazon_eks_kubernetes_cluster_scan_detection.yml @@ -3,7 +3,7 @@ id: 294c4686-63dd-4fe6-93a2-ca807626704a version: 1 date: '2020-04-15' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster in AWS diff --git a/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml b/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml index b08c483e37..c474bf0fd7 100644 --- a/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml +++ b/detections/experimental/cloud/amazon_eks_kubernetes_pod_scan_detection.yml @@ -3,7 +3,7 @@ id: dbfca1dd-b8e5-4ba4-be0e-e565e5d62002 version: 1 date: '2020-04-15' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides detection information on unauthenticated requests against Kubernetes' Pods API diff --git a/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml b/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml index dccf43f830..43fd78b9ce 100644 --- a/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml +++ b/detections/experimental/cloud/aws_detect_attach_to_role_policy.yml @@ -3,7 +3,7 @@ id: 88fc31dd-f331-448c-9856-d3d51dd5d3a1 version: 1 date: '2020-07-27' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides detection of an user attaching itself to a different role trust policy. This can be used for lateral movement and escalation of privileges. diff --git a/detections/experimental/cloud/aws_detect_permanent_key_creation.yml b/detections/experimental/cloud/aws_detect_permanent_key_creation.yml index fa9d678c60..89be918c7a 100644 --- a/detections/experimental/cloud/aws_detect_permanent_key_creation.yml +++ b/detections/experimental/cloud/aws_detect_permanent_key_creation.yml @@ -3,7 +3,7 @@ id: 12d6d713-3cb4-4ffc-a064-1dca3d1cca01 version: 1 date: '2020-07-27' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides detection of accounts creating permanent keys. Permanent keys are not created by default and they are only needed for programmatic calls. diff --git a/detections/experimental/cloud/aws_detect_role_creation.yml b/detections/experimental/cloud/aws_detect_role_creation.yml index 65da0b3a02..278d0f4e6c 100644 --- a/detections/experimental/cloud/aws_detect_role_creation.yml +++ b/detections/experimental/cloud/aws_detect_role_creation.yml @@ -3,7 +3,7 @@ id: 5f04081e-ddee-4353-afe4-504f288de9ad version: 1 date: '2020-07-27' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides detection of role creation by IAM users. Role creation is an event by itself if user is creating a new role with trust policies different diff --git a/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml b/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml index 930e970030..01737566db 100644 --- a/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml +++ b/detections/experimental/cloud/aws_detect_sts_assume_role_abuse.yml @@ -3,7 +3,7 @@ id: 8e565314-b6a2-46d8-9f05-1a34a176a662 version: 1 date: '2020-07-27' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides detection of suspicious use of sts:AssumeRole. These tokens can be created on the go and used by attackers to move laterally and escalate diff --git a/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml b/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml index 29e4b18515..f679ab2f5d 100644 --- a/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml +++ b/detections/experimental/cloud/aws_detect_sts_get_session_token_abuse.yml @@ -3,7 +3,7 @@ id: 85d7b35f-b8b5-4b01-916f-29b81e7a0551 version: 1 date: '2020-07-27' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides detection of suspicious use of sts:GetSessionToken. These tokens can be created on the go and used by attackers to move laterally and diff --git a/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml b/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml index a2a38b2fc3..88eb21c8bf 100644 --- a/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml +++ b/detections/experimental/cloud/detect_gcp_storage_access_from_a_new_ip.yml @@ -3,7 +3,7 @@ id: ccc3246a-daa1-11ea-87d0-0242ac130022 version: 1 date: '2020-08-10' author: Shannon Davis, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks at GCP Storage bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed a GCP Storage diff --git a/detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml b/detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml index b014153fc1..886749d524 100644 --- a/detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml +++ b/detections/experimental/cloud/detect_new_open_gcp_storage_buckets.yml @@ -3,7 +3,7 @@ id: f6ea3466-d6bb-11ea-87d0-0242ac130003 version: 1 date: '2020-08-05' author: Shannon Davis, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for GCP PubSub events where a user has created an open/public GCP Storage bucket. diff --git a/detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml b/detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml index 63a3286e81..dc1f9c384d 100644 --- a/detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml +++ b/detections/experimental/cloud/detect_s3_access_from_a_new_ip.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-291bq3d0daq4 version: 1 date: '2018-06-28' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks at S3 bucket-access logs and detects new or previously unseen remote IP addresses that have successfully accessed an S3 bucket. diff --git a/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml b/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml index 9b2b3d0f36..ad0109bbbc 100644 --- a/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml +++ b/detections/experimental/cloud/detect_spike_in_aws_security_hub_alerts_for_user.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6220-4345-b5ad-290bf5d0d222 version: 3 date: '2021-01-26' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for a spike in number of of AWS security Hub alerts for an AWS IAM User in 4 hours intervals. diff --git a/detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml b/detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml index f405807d9d..a79dcb7705 100644 --- a/detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml +++ b/detections/experimental/cloud/detect_spike_in_blocked_outbound_traffic_from_your_aws.yml @@ -3,7 +3,7 @@ id: ada0f278-84a8-46w1-a3f1-w32372d4bd53 version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search will detect spike in blocked outbound network connections originating from within your AWS environment. It will also update the cache file diff --git a/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml b/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml index 35ee75079d..54c3d1e3e2 100644 --- a/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml +++ b/detections/experimental/cloud/detect_spike_in_s3_bucket_deletion.yml @@ -3,7 +3,7 @@ id: ad12w478-84a8-4641-a3w1-e32372q4bd53 version: 1 date: '2018-11-27' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search detects users creating spikes in API activity related to deletion of S3 buckets in your AWS environment. It will also update the cache file diff --git a/detections/experimental/cloud/gcp_detect_gcploit_framework.yml b/detections/experimental/cloud/gcp_detect_gcploit_framework.yml index 55602d3497..1e1f89c240 100644 --- a/detections/experimental/cloud/gcp_detect_gcploit_framework.yml +++ b/detections/experimental/cloud/gcp_detect_gcploit_framework.yml @@ -3,8 +3,7 @@ id: a1c5a85e-a162-410c-a5d9-99ff639e5a52 version: 1 date: '2020-10-08' author: Rod Soto, Splunk -type: batch -datamodel: [] +type: TTP description: This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts. diff --git a/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml b/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml index 8c87e69ddf..fffbf72898 100644 --- a/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml +++ b/detections/experimental/cloud/gcp_kubernetes_cluster_pod_scan_detection.yml @@ -3,7 +3,7 @@ id: 19b53215-4a16-405b-8087-9e6acf619842 version: 1 date: '2020-07-17' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information of unauthenticated requests via user agent, and authentication data against Kubernetes cluster's pods diff --git a/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml b/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml index faf0db4630..73bfbbd7e2 100644 --- a/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml +++ b/detections/experimental/cloud/high_number_of_login_failures_from_a_single_source.yml @@ -3,7 +3,7 @@ id: 7f398cfb-918d-41f4-8db8-2e2474e02222 version: 1 date: '2020-12-16' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search will detect more than 5 login failures in Office365 Azure Active Directory from a single source IP address. Please adjust the threshold value diff --git a/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml b/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml index 68ee00b79c..ab046a969e 100644 --- a/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml +++ b/detections/experimental/cloud/kubernetes_aws_detect_suspicious_kubectl_calls.yml @@ -3,7 +3,7 @@ id: 042a3d32-8318-4763-9679-09db2644a8f2 version: 1 date: '2020-06-23' author: Rod Soto, Splunk -type: batch +type: Hunting datamodel: [] description: This search provides information on anonymous Kubectl calls with IP, verb namespace and object access context diff --git a/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml b/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml index 5209986e3a..11eadc3426 100644 --- a/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml +++ b/detections/experimental/cloud/new_container_uploaded_to_aws_ecr.yml @@ -3,7 +3,7 @@ id: f0f70b40-f7ad-489d-9905-23d149da8099 version: 1 date: '2020-02-20' author: Rod Soto, Rico Valdez, Splunk -type: batch +type: Hunting datamodel: [] description: This searches show information on uploaded containers including source user, image id, source IP user type, http user agent, region, first time, last time diff --git a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml index 390555875e..d678e09d43 100644 --- a/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml +++ b/detections/experimental/endpoint/child_processes_of_spoolsv_exe.yml @@ -3,7 +3,7 @@ id: aa0c4aeb-5b18-41c4-8c07-f1442d7599df version: 3 date: '2020-03-16' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for child processes of spoolsv.exe. This activity is diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml index 23777f2158..249358cf24 100644 --- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml +++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156.yml @@ -3,7 +3,7 @@ id: 93fbec4e-0375-440c-8db3-4508eca470c4 version: 1 date: '2021-01-27' author: Shannon Davis, Splunk -type: batch +type: TTP datamodel: [] description: This search detects the heap-based buffer overflow of sudoedit search: '`linux_hosts` | search "sudoedit -s \\" | `detect_baron_samedit_cve_2021_3156_filter`' diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml index f5106efba1..68efb44480 100644 --- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml +++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_segfault.yml @@ -3,7 +3,7 @@ id: 10f2bae0-bbe6-4984-808c-37dc1c67980d version: 1 date: '2021-01-29' author: Shannon Davis, Splunk -type: batch +type: TTP datamodel: [] description: This search detects the heap-based buffer overflow of sudoedit search: '`linux_hosts` | search sudoedit segfault | stats count min(_time) as firstTime diff --git a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml index f3f44fa477..6d8ee4915e 100644 --- a/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml +++ b/detections/experimental/endpoint/detect_baron_samedit_cve_2021_3156_via_osquery.yml @@ -3,7 +3,7 @@ id: 1de31d5d-8fa6-4ee0-af89-17069134118a version: 1 date: '2021-01-28' author: Shannon Davis, Splunk -type: batch +type: TTP datamodel: [] description: This search detects the heap-based buffer overflow of sudoedit search: '`osquery_process` | search "columns.cmdline"="sudoedit -s \\*" | `detect_baron_samedit_cve_2021_3156_via_osquery_filter`' diff --git a/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml b/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml index 6ae32a93c3..8dd0134931 100644 --- a/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml +++ b/detections/experimental/endpoint/detect_outlook_exe_writing_a_zip_file.yml @@ -3,7 +3,7 @@ id: a51bfe1a-94f0-4822-b1e4-16ae10145893 version: 3 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for execution of process `outlook.exe` where the process is writing a `.zip` file to the disk. diff --git a/detections/experimental/endpoint/detect_rare_executables.yml b/detections/experimental/endpoint/detect_rare_executables.yml index f401c5ef16..12fcddd9a5 100644 --- a/detections/experimental/endpoint/detect_rare_executables.yml +++ b/detections/experimental/endpoint/detect_rare_executables.yml @@ -3,7 +3,7 @@ id: 44fddcb2-8d3b-454c-874e-7c6de5a4f7ac version: 5 date: '2020-03-16' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: - Endpoint description: This search will return a table of rare processes, the names of the systems diff --git a/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml b/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml index 796d911a53..1e26050d02 100644 --- a/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml +++ b/detections/experimental/endpoint/detection_of_tools_built_by_nirsoft.yml @@ -3,7 +3,7 @@ id: 1297fb80-f42a-4q4a-9c8b-78c061417cf6 version: 3 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for specific command-line arguments that may indicate diff --git a/detections/experimental/endpoint/first_time_seen_running_windows_service.yml b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml index f96c33119a..e4db3b752f 100644 --- a/detections/experimental/endpoint/first_time_seen_running_windows_service.yml +++ b/detections/experimental/endpoint/first_time_seen_running_windows_service.yml @@ -3,7 +3,7 @@ id: 823136f2-d755-4b6d-ae04-372b486a5808 version: 4 date: '2020-07-21' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for the first and last time a Windows service is seen running in your environment. This table is then cached. diff --git a/detections/experimental/endpoint/macos___re_opened_applications.yml b/detections/experimental/endpoint/macos___re_opened_applications.yml index 983e1f6686..c3471e1e03 100644 --- a/detections/experimental/endpoint/macos___re_opened_applications.yml +++ b/detections/experimental/endpoint/macos___re_opened_applications.yml @@ -3,7 +3,7 @@ id: 40bb64f9-f619-4e3d-8732-328d40377c4b version: 1 date: '2020-02-07' author: Jamie Windley, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search looks for processes referencing the plist files that determine diff --git a/detections/experimental/endpoint/processes_tapping_keyboard_events.yml b/detections/experimental/endpoint/processes_tapping_keyboard_events.yml index 6582417e65..c13758062f 100644 --- a/detections/experimental/endpoint/processes_tapping_keyboard_events.yml +++ b/detections/experimental/endpoint/processes_tapping_keyboard_events.yml @@ -3,7 +3,7 @@ id: 2a371608-331d-4034-ae2c-21dda8f1d0ec version: 1 date: '2019-01-25' author: Jose Hernandez, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for processes in an MacOS system that is tapping keyboard events in MacOS, and essentially monitoring all keystrokes made by a user. This diff --git a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml index 29f2055d0b..cdd2a5433d 100644 --- a/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml +++ b/detections/experimental/endpoint/remote_desktop_process_running_on_system.yml @@ -3,7 +3,7 @@ id: f5939373-8054-40ad-8c64-cec478a22a4a version: 5 date: '2020-07-21' author: David Dorsey, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: This search looks for the remote desktop process mstsc.exe running on diff --git a/detections/experimental/endpoint/spike_in_file_writes.yml b/detections/experimental/endpoint/spike_in_file_writes.yml index 38d9e00271..1661777c58 100644 --- a/detections/experimental/endpoint/spike_in_file_writes.yml +++ b/detections/experimental/endpoint/spike_in_file_writes.yml @@ -3,7 +3,7 @@ id: fdb0f805-74e4-4539-8c00-618927333aae version: 3 date: '2020-03-16' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: [] description: The search looks for a sharp increase in the number of files written to a particular host diff --git a/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml b/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml index 8313925d74..64e2877222 100644 --- a/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml +++ b/detections/experimental/endpoint/sunburst_correlation_dll_and_network_event.yml @@ -3,7 +3,7 @@ id: 701a8740-e8db-40df-9190-5516d3819787 version: 1 date: '2020-12-14' author: Patrick Bareiss, Splunk -type: batch +type: TTP datamodel: [] description: The malware sunburst will load the malicious dll by SolarWinds.BusinessLayerHost.exe. After a period of 12-14 days, the malware will attempt to resolve a subdomain of diff --git a/detections/experimental/endpoint/suspicious_curl_network_connection.yml b/detections/experimental/endpoint/suspicious_curl_network_connection.yml index f940fafdba..f55ac89bd4 100644 --- a/detections/experimental/endpoint/suspicious_curl_network_connection.yml +++ b/detections/experimental/endpoint/suspicious_curl_network_connection.yml @@ -3,7 +3,7 @@ id: 3f613dc0-21f2-4063-93b1-5d3c15eef22f version: 1 date: '2021-02-22' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies the use of a curl contacting suspicious diff --git a/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml b/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml index 5228a3b666..f5f6319585 100644 --- a/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml +++ b/detections/experimental/endpoint/suspicious_plistbuddy_usage.yml @@ -3,7 +3,7 @@ id: c3194009-e0eb-4f84-87a9-4070f8688f00 version: 1 date: '2021-02-22' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'The following analytic identifies the use of a native MacOS utility, diff --git a/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml b/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml index 0a39f86f1b..89642145e4 100644 --- a/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml +++ b/detections/experimental/endpoint/suspicious_plistbuddy_usage_via_osquery.yml @@ -3,7 +3,7 @@ id: 20ba6c32-c733-4a32-b64e-2688cf231399 version: 1 date: '2021-02-22' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance diff --git a/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml b/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml index 7f7a1b127d..8d2ca0f819 100644 --- a/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml +++ b/detections/experimental/endpoint/suspicious_sqlite3_lsquarantine_behavior.yml @@ -3,7 +3,7 @@ id: e1997b2e-655f-4561-82fd-aeba8e1c1a86 version: 1 date: '2021-02-22' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies the use of a SQLite3 querying the MacOS diff --git a/detections/experimental/endpoint/unusually_long_command_line___mltk.yml b/detections/experimental/endpoint/unusually_long_command_line___mltk.yml index 67c273e04e..cfd863f5ce 100644 --- a/detections/experimental/endpoint/unusually_long_command_line___mltk.yml +++ b/detections/experimental/endpoint/unusually_long_command_line___mltk.yml @@ -3,7 +3,7 @@ id: 57edaefa-a73b-45e5-bbae-f39c1473f941 version: 1 date: '2019-05-08' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: [] description: Command lines that are extremely long may be indicative of malicious activity on your hosts. This search leverages the Machine Learning Toolkit (MLTK) diff --git a/detections/experimental/endpoint/windows_adfind_exe.yml b/detections/experimental/endpoint/windows_adfind_exe.yml index cd184c74e6..1037723467 100644 --- a/detections/experimental/endpoint/windows_adfind_exe.yml +++ b/detections/experimental/endpoint/windows_adfind_exe.yml @@ -3,7 +3,7 @@ id: bd3b0187-189b-46c0-be45-f52da2bae67f version: 1 date: '2020-12-16' author: Jose Hernandez, Splunk -type: batch +type: TTP datamodel: - Endpoint description: 'This search looks for the execution of `adfind.exe` with command-line diff --git a/detections/experimental/endpoint/winrm_spawning_a_process.yml b/detections/experimental/endpoint/winrm_spawning_a_process.yml index 4fe3646173..f058786ecd 100644 --- a/detections/experimental/endpoint/winrm_spawning_a_process.yml +++ b/detections/experimental/endpoint/winrm_spawning_a_process.yml @@ -3,7 +3,7 @@ id: a081836a-ba4d-11eb-8593-acde48001122 version: 1 date: '2021-05-21' author: Drew Church, Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies suspicious processes spawning from diff --git a/detections/experimental/endpoint/wmi_permanent_event_subscription.yml b/detections/experimental/endpoint/wmi_permanent_event_subscription.yml index d2ae61da94..f5b7a1d1dd 100644 --- a/detections/experimental/endpoint/wmi_permanent_event_subscription.yml +++ b/detections/experimental/endpoint/wmi_permanent_event_subscription.yml @@ -3,7 +3,7 @@ id: 71bfdb13-f200-4c6c-b2c9-a2e07adf437d version: 1 date: '2018-10-23' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for the creation of WMI permanent event subscriptions. search: '`wmi` EventCode=5861 Binding | rex field=Message "Consumer =\s+(?[^;|^$]+)" diff --git a/detections/experimental/endpoint/wmi_temporary_event_subscription.yml b/detections/experimental/endpoint/wmi_temporary_event_subscription.yml index 0e0f55805d..35198a8c69 100644 --- a/detections/experimental/endpoint/wmi_temporary_event_subscription.yml +++ b/detections/experimental/endpoint/wmi_temporary_event_subscription.yml @@ -3,7 +3,7 @@ id: 38cbd42c-1098-41bb-99cf-9d6d2b296d83 version: 1 date: '2018-10-23' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for the creation of WMI temporary event subscriptions. search: '`wmi` EventCode=5860 Temporary | rex field=Message "NotificationQuery =\s+(?[^;|^$]+)" diff --git a/detections/experimental/network/detect_arp_poisoning.yml b/detections/experimental/network/detect_arp_poisoning.yml index e0449004d5..613adbe10f 100644 --- a/detections/experimental/network/detect_arp_poisoning.yml +++ b/detections/experimental/network/detect_arp_poisoning.yml @@ -3,7 +3,7 @@ id: b44bebd6-bd39-467b-9321-73971bcd7aac version: 1 date: '2020-08-11' author: Mikael Bjerkeland, Splunk -type: batch +type: TTP datamodel: [] description: By enabling Dynamic ARP Inspection as a Layer 2 Security measure on the organization's network devices, we will be able to detect ARP Poisoning attacks diff --git a/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml b/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml index be07ec8c26..418a0cb16a 100644 --- a/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml +++ b/detections/experimental/network/detect_ipv6_network_infrastructure_threats.yml @@ -3,7 +3,7 @@ id: c3be767e-7959-44c5-8976-0e9c12a91ad2 version: 1 date: '2020-10-28' author: Mikael Bjerkeland, Splunk -type: batch +type: TTP datamodel: [] description: By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such diff --git a/detections/experimental/network/detect_large_outbound_icmp_packets.yml b/detections/experimental/network/detect_large_outbound_icmp_packets.yml index 458a1d582d..b6c28a321f 100644 --- a/detections/experimental/network/detect_large_outbound_icmp_packets.yml +++ b/detections/experimental/network/detect_large_outbound_icmp_packets.yml @@ -3,7 +3,7 @@ id: e9c102de-4d43-42a7-b1c8-8062ea297419 version: 2 date: '2018-06-01' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Network_Traffic description: This search looks for outbound ICMP packets with a packet size larger diff --git a/detections/experimental/network/detect_outbound_smb_traffic.yml b/detections/experimental/network/detect_outbound_smb_traffic.yml index 705a631f2d..1d7072fd2d 100644 --- a/detections/experimental/network/detect_outbound_smb_traffic.yml +++ b/detections/experimental/network/detect_outbound_smb_traffic.yml @@ -3,7 +3,7 @@ id: 7f5fb3e1-4209-414-90db-0ec21b936378 version: 3 date: '2020-07-21' author: Bhavin Patel, Stuart Hopkins from Splunk -type: batch +type: TTP datamodel: - Network_Traffic description: This search looks for outbound SMB connections made by hosts within your diff --git a/detections/experimental/network/detect_port_security_violation.yml b/detections/experimental/network/detect_port_security_violation.yml index 0763318773..178f235bf4 100644 --- a/detections/experimental/network/detect_port_security_violation.yml +++ b/detections/experimental/network/detect_port_security_violation.yml @@ -3,7 +3,7 @@ id: 2de3d5b8-a4fa-45c5-8540-6d071c194d24 version: 1 date: '2020-10-28' author: Mikael Bjerkeland, Splunk -type: batch +type: TTP datamodel: [] description: By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that diff --git a/detections/experimental/network/detect_rogue_dhcp_server.yml b/detections/experimental/network/detect_rogue_dhcp_server.yml index c11c9f1fe2..d8ad514d5a 100644 --- a/detections/experimental/network/detect_rogue_dhcp_server.yml +++ b/detections/experimental/network/detect_rogue_dhcp_server.yml @@ -3,7 +3,7 @@ id: 6e1ada88-7a0d-4ac1-92c6-03d354686079 version: 1 date: '2020-08-11' author: Mikael Bjerkeland, Splunk -type: batch +type: TTP datamodel: [] description: By enabling DHCP Snooping as a Layer 2 Security measure on the organization's network devices, we will be able to detect unauthorized DHCP servers handing out diff --git a/detections/experimental/network/detect_snicat_sni_exfiltration.yml b/detections/experimental/network/detect_snicat_sni_exfiltration.yml index 58a0866c3a..7f6da7e8e4 100644 --- a/detections/experimental/network/detect_snicat_sni_exfiltration.yml +++ b/detections/experimental/network/detect_snicat_sni_exfiltration.yml @@ -3,7 +3,7 @@ id: 82d06410-134c-11eb-adc1-0242ac120002 version: 1 date: '2020-10-21' author: Shannon Davis, Splunk -type: batch +type: TTP datamodel: [] description: This search looks for commands that the SNICat tool uses in the TLS SNI field. diff --git a/detections/experimental/network/detect_software_download_to_network_device.yml b/detections/experimental/network/detect_software_download_to_network_device.yml index ce7d4d8706..7e4b4d3055 100644 --- a/detections/experimental/network/detect_software_download_to_network_device.yml +++ b/detections/experimental/network/detect_software_download_to_network_device.yml @@ -3,7 +3,7 @@ id: cc590c66-f65f-48f2-986a-4797244762f8 version: 1 date: '2020-10-28' author: Mikael Bjerkeland, Splunk -type: batch +type: TTP datamodel: - Network_Traffic description: Adversaries may abuse netbooting to load an unauthorized network device diff --git a/detections/experimental/network/detect_traffic_mirroring.yml b/detections/experimental/network/detect_traffic_mirroring.yml index 18fc745a0e..341c3a929b 100644 --- a/detections/experimental/network/detect_traffic_mirroring.yml +++ b/detections/experimental/network/detect_traffic_mirroring.yml @@ -3,7 +3,7 @@ id: 42b3b753-5925-49c5-9742-36fa40a73990 version: 1 date: '2020-10-28' author: Mikael Bjerkeland, Splunk -type: batch +type: TTP datamodel: [] description: Adversaries may leverage traffic mirroring in order to automate data exfiltration over compromised network infrastructure. Traffic mirroring is a native diff --git a/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml b/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml index c99f37bc8a..bb7d0d5ad7 100644 --- a/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml +++ b/detections/experimental/network/detect_unauthorized_assets_by_mac_address.yml @@ -3,7 +3,7 @@ id: dcfd6b40-42f9-469d-a433-2e53f7489ff4 version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Network_Sessions description: By populating the organization's assets within the assets_by_str.csv, diff --git a/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml b/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml index 1496580093..0e09903e82 100644 --- a/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml +++ b/detections/experimental/network/detect_windows_dns_sigred_via_splunk_stream.yml @@ -3,7 +3,7 @@ id: babd8d10-d073-11ea-87d0-0242ac130003 version: 1 date: '2020-07-28' author: Shannon Davis, Splunk -type: batch +type: TTP datamodel: [] description: This search detects SIGRed via Splunk Stream. search: '`stream_dns` | spath "query_type{}" | search "query_type{}" IN (SIG,KEY) diff --git a/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml b/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml index b7b07a6692..7cc63741fc 100644 --- a/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml +++ b/detections/experimental/network/detect_windows_dns_sigred_via_zeek.yml @@ -3,7 +3,7 @@ id: c5c622e4-d073-11ea-87d0-0242ac130003 version: 1 date: '2020-07-28' author: Shannon Davis, Splunk -type: batch +type: TTP datamodel: - Network_Resolution description: This search detects SIGRed via Zeek DNS and Zeek Conn data. diff --git a/detections/experimental/network/detect_zerologon_via_zeek.yml b/detections/experimental/network/detect_zerologon_via_zeek.yml index 20e6c3a9b3..156c81236a 100644 --- a/detections/experimental/network/detect_zerologon_via_zeek.yml +++ b/detections/experimental/network/detect_zerologon_via_zeek.yml @@ -3,7 +3,7 @@ id: bf7a06ec-f703-11ea-adc1-0242ac120002 version: 1 date: '2020-09-15' author: Shannon Davis, Splunk -type: batch +type: TTP datamodel: [] description: This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC diff --git a/detections/experimental/network/dns_query_length_outliers___mltk.yml b/detections/experimental/network/dns_query_length_outliers___mltk.yml index 11ea5beddd..03f5388f72 100644 --- a/detections/experimental/network/dns_query_length_outliers___mltk.yml +++ b/detections/experimental/network/dns_query_length_outliers___mltk.yml @@ -3,7 +3,7 @@ id: 85fbcfe8-9718-4911-adf6-7000d077a3a9 version: 2 date: '2020-01-22' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: - Network_Resolution description: This search allows you to identify DNS requests that are unusually large diff --git a/detections/experimental/network/excessive_dns_failures.yml b/detections/experimental/network/excessive_dns_failures.yml index ec0e5764bf..c2d8316ce3 100644 --- a/detections/experimental/network/excessive_dns_failures.yml +++ b/detections/experimental/network/excessive_dns_failures.yml @@ -3,7 +3,7 @@ id: 104658f4-afdc-499e-9719-17243f9826f1 version: 2 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: - Network_Resolution description: This search identifies DNS query failures by counting the number of DNS diff --git a/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml b/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml index 21cfde7487..7cfb188bc5 100644 --- a/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml +++ b/detections/experimental/network/hosts_receiving_high_volume_of_network_traffic_from_email_server.yml @@ -3,7 +3,7 @@ id: 7f5fb3e1-4209-4914-90db-0ec21b556368 version: 2 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: - Network_Traffic description: This search looks for an increase of data transfers from your email server diff --git a/detections/experimental/network/large_volume_of_dns_any_queries.yml b/detections/experimental/network/large_volume_of_dns_any_queries.yml index eb86051009..cb209f823c 100644 --- a/detections/experimental/network/large_volume_of_dns_any_queries.yml +++ b/detections/experimental/network/large_volume_of_dns_any_queries.yml @@ -3,7 +3,7 @@ id: 8fa891f7-a533-4b3c-af85-5aa2e7c1f1eb version: 1 date: '2017-09-20' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: - Network_Resolution description: The search is used to identify attempts to use your DNS Infrastructure diff --git a/detections/experimental/network/prohibited_network_traffic_allowed.yml b/detections/experimental/network/prohibited_network_traffic_allowed.yml index 970f4ec790..5a8069c717 100644 --- a/detections/experimental/network/prohibited_network_traffic_allowed.yml +++ b/detections/experimental/network/prohibited_network_traffic_allowed.yml @@ -3,7 +3,7 @@ id: ce5a0962-849f-4720-a678-753fe6674479 version: 2 date: '2020-07-21' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Network_Traffic description: This search looks for network traffic defined by port and transport layer diff --git a/detections/experimental/network/protocol_or_port_mismatch.yml b/detections/experimental/network/protocol_or_port_mismatch.yml index 4b906ec85f..a20dc93a0f 100644 --- a/detections/experimental/network/protocol_or_port_mismatch.yml +++ b/detections/experimental/network/protocol_or_port_mismatch.yml @@ -3,7 +3,7 @@ id: 54dc1265-2f74-4b6d-b30d-49eb506a31b3 version: 2 date: '2020-07-21' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: - Network_Traffic description: This search looks for network traffic on common ports where a higher diff --git a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml index 24a747ac9e..c68df0a06b 100644 --- a/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml +++ b/detections/experimental/network/protocols_passing_authentication_in_cleartext.yml @@ -3,7 +3,7 @@ id: 6923cd64-17a0-453c-b945-81ac2d8c6db9 version: 2 date: '2020-11-04' author: Rico Valdez, Splunk -type: batch +type: TTP datamodel: - Network_Traffic description: This search looks for cleartext protocols at risk of leaking credentials. diff --git a/detections/experimental/network/remote_desktop_network_bruteforce.yml b/detections/experimental/network/remote_desktop_network_bruteforce.yml index 7c8b3f7adb..5b09dc86c4 100644 --- a/detections/experimental/network/remote_desktop_network_bruteforce.yml +++ b/detections/experimental/network/remote_desktop_network_bruteforce.yml @@ -3,7 +3,7 @@ id: a98727cc-286b-4ff2-b898-41df64695923 version: 2 date: '2020-07-21' author: Jose Hernandez, Splunk -type: batch +type: TTP datamodel: - Network_Traffic description: This search looks for RDP application network traffic and filters any diff --git a/detections/experimental/network/remote_desktop_network_traffic.yml b/detections/experimental/network/remote_desktop_network_traffic.yml index cf6c5a380f..52b3cf7198 100644 --- a/detections/experimental/network/remote_desktop_network_traffic.yml +++ b/detections/experimental/network/remote_desktop_network_traffic.yml @@ -3,7 +3,7 @@ id: 272b8407-842d-4b3d-bead-a704584003d3 version: 3 date: '2020-07-07' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Network_Traffic description: This search looks for network traffic on TCP/3389, the default port used diff --git a/detections/experimental/network/smb_traffic_spike.yml b/detections/experimental/network/smb_traffic_spike.yml index 75d375e5e5..baa84760a4 100644 --- a/detections/experimental/network/smb_traffic_spike.yml +++ b/detections/experimental/network/smb_traffic_spike.yml @@ -3,7 +3,7 @@ id: 7f5fb3e1-4209-4914-90db-0ec21b936378 version: 3 date: '2020-07-22' author: David Dorsey, Splunk -type: batch +type: Anomaly datamodel: - Network_Traffic description: This search looks for spikes in the number of Server Message Block (SMB) diff --git a/detections/experimental/network/smb_traffic_spike___mltk.yml b/detections/experimental/network/smb_traffic_spike___mltk.yml index fde25fac02..3964f2025d 100644 --- a/detections/experimental/network/smb_traffic_spike___mltk.yml +++ b/detections/experimental/network/smb_traffic_spike___mltk.yml @@ -3,7 +3,7 @@ id: d25773ba-9ad8-48d1-858e-07ad0bbeb828 version: 3 date: '2020-07-22' author: Rico Valdez, Splunk -type: batch +type: Anomaly datamodel: - Network_Traffic description: This search uses the Machine Learning Toolkit (MLTK) to identify spikes diff --git a/detections/experimental/network/tor_traffic.yml b/detections/experimental/network/tor_traffic.yml index 7c3795b66d..9365a50b95 100644 --- a/detections/experimental/network/tor_traffic.yml +++ b/detections/experimental/network/tor_traffic.yml @@ -3,7 +3,7 @@ id: ea688274-9c06-4473-b951-e4cb7a5d7a45 version: 2 date: '2020-07-22' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Network_Traffic description: This search looks for network traffic identified as The Onion Router diff --git a/detections/experimental/network/unusually_long_content_type_length.yml b/detections/experimental/network/unusually_long_content_type_length.yml index ecfa2b1182..d750349cb9 100644 --- a/detections/experimental/network/unusually_long_content_type_length.yml +++ b/detections/experimental/network/unusually_long_content_type_length.yml @@ -3,7 +3,7 @@ id: 57a0a2bf-353f-40c1-84dc-29293f3c35b7 version: 1 date: '2017-10-13' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: [] description: This search looks for unusually long strings in the Content-Type http header that the client sends the server. diff --git a/detections/experimental/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml b/detections/experimental/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml index f5ac2e42ec..88be39beaa 100644 --- a/detections/experimental/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml +++ b/detections/experimental/web/detect_attackers_scanning_for_vulnerable_jboss_servers.yml @@ -3,7 +3,7 @@ id: 104658f4-afdc-499e-9719-17243f982681 version: 1 date: '2017-09-23' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Web description: This search looks for specific GET or HEAD requests to web servers that diff --git a/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml b/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml index 118dcf5367..c59807a6b5 100644 --- a/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml +++ b/detections/experimental/web/detect_f5_tmui_rct_cve_2020_5902.yml @@ -3,7 +3,7 @@ id: 810e4dbc-d46e-11ea-87d0-0242ac130003 version: 1 date: '2020-08-02' author: Shannon Davis, Splunk -type: batch +type: TTP datamodel: [] description: This search detects remote code exploit attempts on F5 BIG-IP, BIG-IQ, and Traffix SDC devices diff --git a/detections/experimental/web/detect_malicious_requests_to_exploit_jboss_servers.yml b/detections/experimental/web/detect_malicious_requests_to_exploit_jboss_servers.yml index 5d8fd58b5b..a8d46e234b 100644 --- a/detections/experimental/web/detect_malicious_requests_to_exploit_jboss_servers.yml +++ b/detections/experimental/web/detect_malicious_requests_to_exploit_jboss_servers.yml @@ -3,7 +3,7 @@ id: c8bff7a4-11ea-4416-a27d-c5bca472913d version: 1 date: '2017-09-23' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Web description: This search is used to detect malicious HTTP requests crafted to exploit diff --git a/detections/experimental/web/monitor_web_traffic_for_brand_abuse.yml b/detections/experimental/web/monitor_web_traffic_for_brand_abuse.yml index e97391ea34..6621361bdf 100644 --- a/detections/experimental/web/monitor_web_traffic_for_brand_abuse.yml +++ b/detections/experimental/web/monitor_web_traffic_for_brand_abuse.yml @@ -3,7 +3,7 @@ id: 134da869-e264-4a8f-8d7e-fcd0ec88f301 version: 1 date: '2017-09-23' author: David Dorsey, Splunk -type: batch +type: TTP datamodel: - Web description: This search looks for Web requests to faux domains similar to the one diff --git a/detections/experimental/web/sql_injection_with_long_urls.yml b/detections/experimental/web/sql_injection_with_long_urls.yml index 631bac6e6d..ae53b74d2c 100644 --- a/detections/experimental/web/sql_injection_with_long_urls.yml +++ b/detections/experimental/web/sql_injection_with_long_urls.yml @@ -3,7 +3,7 @@ id: e0aad4cf-0790-423b-8328-7564d0d938f9 version: 2 date: '2020-07-21' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Web description: This search looks for long URLs that have several SQL commands visible diff --git a/detections/experimental/web/supernova_webshell.yml b/detections/experimental/web/supernova_webshell.yml index 0cb51a9f4a..060fbfacbd 100644 --- a/detections/experimental/web/supernova_webshell.yml +++ b/detections/experimental/web/supernova_webshell.yml @@ -3,7 +3,7 @@ id: 2ec08a09-9ff1-4dac-b59f-1efd57972ec1 version: 1 date: '2021-01-06' author: John Stoner, Splunk -type: batch +type: TTP datamodel: - Web description: This search aims to detect the Supernova webshell used in the SUNBURST diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index e86301192a..5255d941ca 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -3,7 +3,7 @@ id: c77162d3-f93c-45cc-80c8-22f6v5464g9f version: 3 date: '2021-01-14' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: - Network_Resolution description: Malicious actors often abuse legitimate Dynamic DNS services to host diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 5748355bb6..aae908129c 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -3,7 +3,7 @@ id: 1a67f15a-f4ff-4170-84e9-08cf6f75d6f5 version: 3 date: '2021-01-18' author: Bhavin Patel, Splunk -type: batch +type: Anomaly datamodel: - Network_Resolution description: This search allows you to identify DNS requests and compute the standard diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index 5680b6cebb..69fcdb5942 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -3,7 +3,7 @@ id: 4477f3ea-a28f-11eb-b762-acde48001122 version: 1 date: '2021-04-21' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Network_Traffic description: This search is designed to detect high frequency of archive files data diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 540090ea25..f9c89b355d 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -3,7 +3,7 @@ id: e2b36208-a364-11eb-8909-acde48001122 version: 1 date: '2021-04-22' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Network_Traffic description: This search is to detect potential plain HTTP POST method data exfiltration. From cb77f0301db1264cd45be8c87d71338e079c67a8 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 20 Jul 2021 10:12:17 +0200 Subject: [PATCH 04/21] analytic types --- detections/endpoint/resize_shadowstorage_volume.yml | 4 ++-- detections/endpoint/revil_common_exec_parameter.yml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index 6c28a08375..28ada840a4 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -3,9 +3,9 @@ id: bc760ca6-8336-11eb-bcbb-acde48001122 version: 1 date: '2021-03-12' author: Teoderick Contreras -type: batch +type: TTP datamodel: -- TTP +- Endpoint description: The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index 46076a81ca..2681873598 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -3,9 +3,9 @@ id: 85facebe-c382-11eb-9c3e-acde48001122 version: 1 date: '2021-06-02' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: -- TTP +- Endpoint description: This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) From 9568fc7807e765956f064fc6ba4052a748eafab1 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 20 Jul 2021 13:19:22 +0200 Subject: [PATCH 05/21] migrated baselines into detections folder --- bin/validate.py | 36 +++---------------- .../baseline_of_api_calls_per_user_arn.yml | 10 ++++-- ...e_of_blocked_outbound_traffic_from_aws.yml | 9 ++++- ...loud_infrastructure_api_calls_per_user.yml | 8 ++++- .../baseline_of_cloud_instances_destroyed.yml | 9 ++++- .../baseline_of_cloud_instances_launched.yml | 9 ++++- ...loud_security_group_api_calls_per_user.yml | 9 ++++- ..._aws_instances_launched_by_user___mltk.yml | 9 ++++- ...ws_instances_terminated_by_user___mltk.yml | 9 ++++- ...aseline_of_network_acl_activity_by_arn.yml | 7 +++- ..._of_s3_bucket_deletion_activity_by_arn.yml | 7 +++- ...line_of_security_group_activity_by_arn.yml | 7 +++- ..._list_of_approved_aws_service_accounts.yml | 8 ++++- ..._api_call_per_user_roles_in_cloudtrail.yml | 11 +++++- ...iously_seen_aws_cross_account_activity.yml | 9 ++++- ...een_aws_cross_account_activity_initial.yml | 11 +++++- ...seen_aws_cross_account_activity_update.yml | 11 +++++- ...seen_aws_provisioning_activity_sources.yml | 8 ++++- .../cloud}/previously_seen_aws_regions.yml | 7 +++- ..._cloud_api_calls_per_user_role_initial.yml | 10 +++++- ...n_cloud_api_calls_per_user_role_update.yml | 10 +++++- ...loud_compute_creations_by_user_initial.yml | 9 ++++- ...cloud_compute_creations_by_user_update.yml | 9 ++++- ...usly_seen_cloud_compute_images_initial.yml | 8 ++++- ...ously_seen_cloud_compute_images_update.yml | 8 ++++- ...n_cloud_compute_instance_types_initial.yml | 8 ++++- ...en_cloud_compute_instance_types_update.yml | 8 ++++- ...instance_modifications_by_user_initial.yml | 12 +++++-- ..._instance_modifications_by_user_update.yml | 10 +++++- ..._provisioning_activity_sources_initial.yml | 9 ++++- ...d_provisioning_activity_sources_update.yml | 9 ++++- .../previously_seen_cloud_regions_initial.yml | 8 ++++- .../previously_seen_cloud_regions_update.yml | 8 ++++- .../cloud}/previously_seen_ec2_amis.yml | 9 ++++- .../previously_seen_ec2_instance_types.yml | 9 ++++- .../previously_seen_ec2_launches_by_user.yml | 9 ++++- ...viously_seen_ec2_modifications_by_user.yml | 8 ++++- ...sly_seen_s3_bucket_access_by_remote_ip.yml | 9 ++++- .../previously_seen_users_in_cloudtrail.yml | 9 ++++- ...ously_seen_users_in_cloudtrail_initial.yml | 9 ++++- ...iously_seen_users_in_cloudtrail_update.yml | 9 ++++- ...te_previously_seen_users_in_cloudtrail.yml | 9 ++++- ...bited_processes_to_enterprise_security.yml | 6 +++- ...baseline_of_command_line_length___mltk.yml | 10 +++++- .../endpoint}/count_of_assets_by_category.yml | 8 ++++- .../identify_systems_using_remote_desktop.yml | 8 ++++- .../endpoint}/monitor_successful_backups.yml | 6 +++- .../monitor_unsuccessful_backups.yml | 6 +++- ...previously_seen_command_line_arguments.yml | 8 ++++- ...eviously_seen_running_windows_services.yml | 8 ++++- ...y_seen_running_windows_services_update.yml | 8 ++++- ...usly_seen_zoom_child_processes_initial.yml | 9 ++++- ...ously_seen_zoom_child_processes_update.yml | 9 ++++- ...ady_for_spectre_meltdown_windows_patch.yml | 15 ++++++-- .../windows_updates_install_failures.yml | 8 ++++- .../windows_updates_install_successes.yml | 8 ++++- .../baseline_of_dns_query_length___mltk.yml | 8 ++++- .../baseline_of_smb_traffic___mltk.yml | 9 ++++- ...ount_of_unique_ips_connecting_to_ports.yml | 8 ++++- .../network}/discover_dns_records.yml | 9 ++++- .../network}/dnstwist_domain_names.yml | 6 +++- ...ystems_creating_remote_desktop_traffic.yml | 8 ++++- ...stems_receiving_remote_desktop_traffic.yml | 8 ++++- 63 files changed, 477 insertions(+), 96 deletions(-) rename {baselines => detections/cloud}/baseline_of_api_calls_per_user_arn.yml (87%) rename {baselines => detections/cloud}/baseline_of_blocked_outbound_traffic_from_aws.yml (92%) rename {baselines => detections/cloud}/baseline_of_cloud_infrastructure_api_calls_per_user.yml (94%) rename {baselines => detections/cloud}/baseline_of_cloud_instances_destroyed.yml (93%) rename {baselines => detections/cloud}/baseline_of_cloud_instances_launched.yml (93%) rename {baselines => detections/cloud}/baseline_of_cloud_security_group_api_calls_per_user.yml (92%) rename {baselines => detections/cloud}/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml (93%) rename {baselines => detections/cloud}/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml (93%) rename {baselines => detections/cloud}/baseline_of_network_acl_activity_by_arn.yml (92%) rename {baselines => detections/cloud}/baseline_of_s3_bucket_deletion_activity_by_arn.yml (91%) rename {baselines => detections/cloud}/baseline_of_security_group_activity_by_arn.yml (92%) rename {baselines => detections/cloud}/create_a_list_of_approved_aws_service_accounts.yml (90%) rename {baselines => detections/cloud}/previously_seen_api_call_per_user_roles_in_cloudtrail.yml (88%) rename {baselines => detections/cloud}/previously_seen_aws_cross_account_activity.yml (88%) rename {baselines => detections/cloud}/previously_seen_aws_cross_account_activity_initial.yml (87%) rename {baselines => detections/cloud}/previously_seen_aws_cross_account_activity_update.yml (88%) rename {baselines => detections/cloud}/previously_seen_aws_provisioning_activity_sources.yml (90%) rename {baselines => detections/cloud}/previously_seen_aws_regions.yml (89%) rename {baselines => detections/cloud}/previously_seen_cloud_api_calls_per_user_role_initial.yml (87%) rename {baselines => detections/cloud}/previously_seen_cloud_api_calls_per_user_role_update.yml (88%) rename {baselines => detections/cloud}/previously_seen_cloud_compute_creations_by_user_initial.yml (85%) rename {baselines => detections/cloud}/previously_seen_cloud_compute_creations_by_user_update.yml (88%) rename {baselines => detections/cloud}/previously_seen_cloud_compute_images_initial.yml (87%) rename {baselines => detections/cloud}/previously_seen_cloud_compute_images_update.yml (89%) rename {baselines => detections/cloud}/previously_seen_cloud_compute_instance_types_initial.yml (87%) rename {baselines => detections/cloud}/previously_seen_cloud_compute_instance_types_update.yml (89%) rename {baselines => detections/cloud}/previously_seen_cloud_instance_modifications_by_user_initial.yml (80%) rename {baselines => detections/cloud}/previously_seen_cloud_instance_modifications_by_user_update.yml (89%) rename {baselines => detections/cloud}/previously_seen_cloud_provisioning_activity_sources_initial.yml (90%) rename {baselines => detections/cloud}/previously_seen_cloud_provisioning_activity_sources_update.yml (93%) rename {baselines => detections/cloud}/previously_seen_cloud_regions_initial.yml (89%) rename {baselines => detections/cloud}/previously_seen_cloud_regions_update.yml (90%) rename {baselines => detections/cloud}/previously_seen_ec2_amis.yml (83%) rename {baselines => detections/cloud}/previously_seen_ec2_instance_types.yml (85%) rename {baselines => detections/cloud}/previously_seen_ec2_launches_by_user.yml (85%) rename {baselines => detections/cloud}/previously_seen_ec2_modifications_by_user.yml (88%) rename {baselines => detections/cloud}/previously_seen_s3_bucket_access_by_remote_ip.yml (89%) rename {baselines => detections/cloud}/previously_seen_users_in_cloudtrail.yml (91%) rename {baselines => detections/cloud}/previously_seen_users_in_cloudtrail_initial.yml (90%) rename {baselines => detections/cloud}/previously_seen_users_in_cloudtrail_update.yml (91%) rename {baselines => detections/cloud}/update_previously_seen_users_in_cloudtrail.yml (92%) rename {baselines => detections}/deprecated/add_prohibited_processes_to_enterprise_security.yml (91%) rename {baselines => detections/endpoint}/baseline_of_command_line_length___mltk.yml (92%) rename {baselines => detections/endpoint}/count_of_assets_by_category.yml (87%) rename {baselines => detections/endpoint}/identify_systems_using_remote_desktop.yml (83%) rename {baselines => detections/endpoint}/monitor_successful_backups.yml (89%) rename {baselines => detections/endpoint}/monitor_unsuccessful_backups.yml (89%) rename {baselines => detections/endpoint}/previously_seen_command_line_arguments.yml (91%) rename {baselines => detections/endpoint}/previously_seen_running_windows_services.yml (89%) rename {baselines => detections/endpoint}/previously_seen_running_windows_services_update.yml (92%) rename {baselines => detections/endpoint}/previously_seen_zoom_child_processes_initial.yml (87%) rename {baselines => detections/endpoint}/previously_seen_zoom_child_processes_update.yml (90%) rename {baselines => detections/endpoint}/systems_ready_for_spectre_meltdown_windows_patch.yml (83%) rename {baselines => detections/endpoint}/windows_updates_install_failures.yml (83%) rename {baselines => detections/endpoint}/windows_updates_install_successes.yml (83%) rename {baselines => detections/network}/baseline_of_dns_query_length___mltk.yml (93%) rename {baselines => detections/network}/baseline_of_smb_traffic___mltk.yml (93%) rename {baselines => detections/network}/count_of_unique_ips_connecting_to_ports.yml (84%) rename {baselines => detections/network}/discover_dns_records.yml (92%) rename {baselines => detections/network}/dnstwist_domain_names.yml (91%) rename {baselines => detections/network}/identify_systems_creating_remote_desktop_traffic.yml (83%) rename {baselines => detections/network}/identify_systems_receiving_remote_desktop_traffic.yml (85%) diff --git a/bin/validate.py b/bin/validate.py index e65deb8610..d72c6015c5 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -73,7 +73,7 @@ def validate_objects(REPO_PATH, objects, verbose): for lookup in objects['lookups']: errors = errors + validate_lookups_content(REPO_PATH, "lookups/%s", lookup) - objects_array = objects['stories'] + objects['detections'] + objects['baselines'] + objects['response_tasks'] + objects['responses'] + objects_array = objects['stories'] + objects['detections'] + objects['response_tasks'] + objects['responses'] for object in objects_array: validation_errors, uuids = validate_standard_fields(object, uuids) errors = errors + validation_errors @@ -83,9 +83,6 @@ def validate_objects(REPO_PATH, objects, verbose): errors = errors + validate_detection_search(object, objects['macros']) errors = errors + validate_fields(object) - for object in objects['baselines']: - errors = errors + validate_baseline_search(object, objects['macros']) - for object in objects['tests']: errors = errors + validate_tests(REPO_PATH, object) @@ -187,8 +184,9 @@ def validate_standard_fields(object, uuids): def validate_detection_search(object, macros): errors = [] - if not '_filter' in object['search']: - errors.append("ERROR: Missing filter for detection: " + object['name']) + if not object['type'] == "Baseline": + if not '_filter' in object['search']: + errors.append("ERROR: Missing filter for detection: " + object['name']) filter_macro = re.search("([a-z0-9_]*_filter)", object['search']) @@ -216,30 +214,6 @@ def validate_detection_search(object, macros): return errors -def validate_baseline_search(object, macros): - errors = [] - - if any(x in object['search'] for x in ['eventtype=', 'sourcetype=', ' source=', 'index=']): - if not 'index=_internal' in object['search']: - errors.append("ERROR: Use source macro instead of eventtype, sourcetype, source or index in detection: " + object['name']) - - macros_found = re.findall('\`([^\s]+)`',object['search']) - macros_filtered = [] - for macro in macros_found: - if not '_filter' in macro and not 'security_content_ctime' in macro and not 'drop_dm_object_name' in macro and not 'cim_' in macro and not 'get_' in macro: - macros_filtered.append(macro) - - for macro in macros_filtered: - found_macro = False - for macro_obj in macros: - if macro_obj['name'] == macro: - found_macro = True - - if not found_macro: - errors.append("ERROR: macro definition for " + macro + " can't be found for detection " + object['name']) - - return errors - def validate_lookups_content(REPO_PATH, lookup_path, lookup): errors = [] @@ -267,7 +241,7 @@ def validate_tests(REPO_PATH, object): def main(REPO_PATH, verbose): - validation_objects = ['macros','lookups','stories','detections','baselines','response_tasks','responses','deployments', 'tests'] + validation_objects = ['macros','lookups','stories','detections','response_tasks','responses','deployments', 'tests'] objects = {} schema_error = False diff --git a/baselines/baseline_of_api_calls_per_user_arn.yml b/detections/cloud/baseline_of_api_calls_per_user_arn.yml similarity index 87% rename from baselines/baseline_of_api_calls_per_user_arn.yml rename to detections/cloud/baseline_of_api_calls_per_user_arn.yml index c29df505a0..afbf3db46f 100644 --- a/baselines/baseline_of_api_calls_per_user_arn.yml +++ b/detections/cloud/baseline_of_api_calls_per_user_arn.yml @@ -1,9 +1,9 @@ name: Baseline of API Calls per User ARN -id: fc0edc96-ff2b-48b0-9f6f-63da3783fd63 +id: 4b5119c3-5369-4040-9430-b63b1a314229 version: 1 date: '2018-04-09' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number @@ -17,6 +17,7 @@ search: '`cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity. how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +known_false_positives: none references: [] tags: analytic_story: @@ -27,3 +28,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventType + - userIdentity.arn + security_domain: network diff --git a/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml b/detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml similarity index 92% rename from baselines/baseline_of_blocked_outbound_traffic_from_aws.yml rename to detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml index ecd04d8b11..c9076612d3 100644 --- a/baselines/baseline_of_blocked_outbound_traffic_from_aws.yml +++ b/detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml @@ -3,7 +3,7 @@ id: fc0edd96-ff2b-48b0-9f1f-63da3782fd63 version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk -type: batch +type: Baseline datamodel: [] description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by @@ -21,6 +21,7 @@ search: '`cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=17 how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. +known_false_positives: none references: [] tags: analytic_story: @@ -33,3 +34,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - action + - src_ip + - dest_ip + security_domain: network \ No newline at end of file diff --git a/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml b/detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml similarity index 94% rename from baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml rename to detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml index c3bdf79021..62ab889750 100644 --- a/baselines/baseline_of_cloud_infrastructure_api_calls_per_user.yml +++ b/detections/cloud/baseline_of_cloud_infrastructure_api_calls_per_user.yml @@ -3,7 +3,7 @@ id: 1da5d5ea-4382-447d-98a9-87c358c95fcb version: 1 date: '2020-09-07' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search is used to build a Machine Learning Toolkit (MLTK) model @@ -29,6 +29,7 @@ how_to_implement: You must have Enterprise Security 6.0 or later, if not you wil 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. +known_false_positives: none references: [] tags: analytic_story: @@ -42,3 +43,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.user + - All_Changes.status + security_domain: network \ No newline at end of file diff --git a/baselines/baseline_of_cloud_instances_destroyed.yml b/detections/cloud/baseline_of_cloud_instances_destroyed.yml similarity index 93% rename from baselines/baseline_of_cloud_instances_destroyed.yml rename to detections/cloud/baseline_of_cloud_instances_destroyed.yml index d0be475bd5..b00f6c66f2 100644 --- a/baselines/baseline_of_cloud_instances_destroyed.yml +++ b/detections/cloud/baseline_of_cloud_instances_destroyed.yml @@ -3,7 +3,7 @@ id: a2f701f8-5296-4d74-829c-0b7eb346d549 version: 1 date: '2020-08-25' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search is used to build a Machine Learning Toolkit (MLTK) model @@ -31,6 +31,7 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi re-run this search to rebuild the model with the latest data.\ More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.' +known_false_positives: none references: [] tags: analytic_story: @@ -45,3 +46,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.status + - All_Changes.object_category + security_domain: network \ No newline at end of file diff --git a/baselines/baseline_of_cloud_instances_launched.yml b/detections/cloud/baseline_of_cloud_instances_launched.yml similarity index 93% rename from baselines/baseline_of_cloud_instances_launched.yml rename to detections/cloud/baseline_of_cloud_instances_launched.yml index d054ee2a88..2302134934 100644 --- a/baselines/baseline_of_cloud_instances_launched.yml +++ b/detections/cloud/baseline_of_cloud_instances_launched.yml @@ -3,7 +3,7 @@ id: b01bd274-f661-4f9c-bd9f-cf23ff6ae0bc version: 1 date: '2020-08-14' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search is used to build a Machine Learning Toolkit (MLTK) model @@ -31,6 +31,7 @@ how_to_implement: 'You must have Enterprise Security 6.0 or later, if not you wi re-run this search to rebuild the model with the latest data.\ More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.' +known_false_positives: none references: [] tags: analytic_story: @@ -45,3 +46,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.status + - All_Changes.object_category + security_domain: network \ No newline at end of file diff --git a/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml b/detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml similarity index 92% rename from baselines/baseline_of_cloud_security_group_api_calls_per_user.yml rename to detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml index 58e61f4890..ce71ab6be8 100644 --- a/baselines/baseline_of_cloud_security_group_api_calls_per_user.yml +++ b/detections/cloud/baseline_of_cloud_security_group_api_calls_per_user.yml @@ -3,7 +3,7 @@ id: 67b84d51-8329-4909-849f-8d38ce54260a version: 1 date: '2020-09-07' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search is used to build a Machine Learning Toolkit (MLTK) model @@ -28,6 +28,7 @@ how_to_implement: You must have Enterprise Security 6.0 or later, if not you wil 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. +known_false_positives: none references: [] tags: analytic_story: @@ -41,3 +42,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.user + - All_Changes.status + - All_Changes.object_category + security_domain: network \ No newline at end of file diff --git a/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml similarity index 93% rename from baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml rename to detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml index 89b19ba4ec..ddc8c6bfe5 100644 --- a/baselines/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml +++ b/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml @@ -3,7 +3,7 @@ id: fa5634df-fb05-4b4b-aba0-6115138bb1ba version: 1 date: '2019-11-14' author: Jason Brewer, Splunk -type: batch +type: Baseline datamodel: [] description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses @@ -27,6 +27,7 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat search to rebuild the model with the latest data.\ More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.' +known_false_positives: none references: [] tags: analytic_story: @@ -38,3 +39,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - src_user + security_domain: network \ No newline at end of file diff --git a/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml similarity index 93% rename from baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml rename to detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml index 2ae61114e3..5e5f375eb9 100644 --- a/baselines/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml +++ b/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml @@ -3,7 +3,7 @@ id: b28ed6de-e4ba-40f7-ae0a-93a088c774ab version: 1 date: '2019-11-14' author: Jason Brewer, Splunk -type: batch +type: Baseline datamodel: [] description: This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search @@ -28,6 +28,7 @@ how_to_implement: 'You must install the AWS App for Splunk (version 5.1.0 or lat search to rebuild the model with the latest data.\ More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`.' +known_false_positives: none references: [] tags: analytic_story: @@ -38,3 +39,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - src_user + security_domain: network \ No newline at end of file diff --git a/baselines/baseline_of_network_acl_activity_by_arn.yml b/detections/cloud/baseline_of_network_acl_activity_by_arn.yml similarity index 92% rename from baselines/baseline_of_network_acl_activity_by_arn.yml rename to detections/cloud/baseline_of_network_acl_activity_by_arn.yml index 40fdcb8dc9..c81a98ef2c 100644 --- a/baselines/baseline_of_network_acl_activity_by_arn.yml +++ b/detections/cloud/baseline_of_network_acl_activity_by_arn.yml @@ -3,7 +3,7 @@ id: fc0edd96-ff2b-4810-9f1f-63da3783fd63 version: 1 date: '2018-05-21' author: Bhavin Patel, Splunk -type: batch +type: Baseline datamodel: [] description: This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each @@ -18,6 +18,7 @@ search: '`cloudtrail` `network_acl_events` | spath output=arn path=userIdentity. how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. +known_false_positives: none references: [] tags: analytic_story: @@ -28,3 +29,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - userIdentity.arn + security_domain: network \ No newline at end of file diff --git a/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml b/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml similarity index 91% rename from baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml rename to detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml index 23c168289d..033488e995 100644 --- a/baselines/baseline_of_s3_bucket_deletion_activity_by_arn.yml +++ b/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml @@ -3,7 +3,7 @@ id: fc0edd96-ff2b-48b0-9f1f-63eq3783fd63 version: 1 date: '2018-07-17' author: Bhavin Patel, Splunk -type: batch +type: Baseline datamodel: [] description: This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. @@ -17,6 +17,7 @@ search: '`cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentit how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +known_false_positives: none references: [] tags: analytic_story: @@ -27,3 +28,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - userIdentity.arn + security_domain: network \ No newline at end of file diff --git a/baselines/baseline_of_security_group_activity_by_arn.yml b/detections/cloud/baseline_of_security_group_activity_by_arn.yml similarity index 92% rename from baselines/baseline_of_security_group_activity_by_arn.yml rename to detections/cloud/baseline_of_security_group_activity_by_arn.yml index 78c5e7356a..227a8b72ec 100644 --- a/baselines/baseline_of_security_group_activity_by_arn.yml +++ b/detections/cloud/baseline_of_security_group_activity_by_arn.yml @@ -3,7 +3,7 @@ id: fc0edd96-ff2b-48b0-9f1f-63da3783fd63 version: 1 date: '2018-04-17' author: Bhavin Patel, Splunk -type: batch +type: Baseline datamodel: [] description: This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. @@ -18,6 +18,7 @@ search: '`cloudtrail` `security_group_api_calls` | spath output=arn path=userIde how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +known_false_positives: none references: [] tags: analytic_story: @@ -28,3 +29,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - userIdentity.arn + security_domain: network \ No newline at end of file diff --git a/baselines/create_a_list_of_approved_aws_service_accounts.yml b/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml similarity index 90% rename from baselines/create_a_list_of_approved_aws_service_accounts.yml rename to detections/cloud/create_a_list_of_approved_aws_service_accounts.yml index c7d9285e4a..af4226cacb 100644 --- a/baselines/create_a_list_of_approved_aws_service_accounts.yml +++ b/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml @@ -3,7 +3,7 @@ id: fc0edc95-ff2b-48b1-5f6f-63ga3789fd43 version: 2 date: '2018-12-03' author: Bhavin Patel, Splunk -type: batch +type: Baseline datamodel: [] description: This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values @@ -16,6 +16,7 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. +known_false_positives: none references: [] tags: analytic_story: @@ -26,3 +27,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - errorCode + - userName + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml similarity index 88% rename from baselines/previously_seen_api_call_per_user_roles_in_cloudtrail.yml rename to detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml index 6e2fed12ec..770b305ae9 100644 --- a/baselines/previously_seen_api_call_per_user_roles_in_cloudtrail.yml +++ b/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml @@ -3,7 +3,7 @@ id: fc0edc95-fq2c-48b0-9f6f-63da3289fd03 version: 1 date: '2018-04-16' author: Bhavin Patel, Splunk -type: batch +type: Baseline datamodel: [] description: This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this @@ -17,6 +17,7 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. +known_false_positives: none references: [] tags: analytic_story: @@ -27,3 +28,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventType + - errorCode + - userIdentity.type + - userName + - eventName + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_aws_cross_account_activity.yml b/detections/cloud/previously_seen_aws_cross_account_activity.yml similarity index 88% rename from baselines/previously_seen_aws_cross_account_activity.yml rename to detections/cloud/previously_seen_aws_cross_account_activity.yml index 7c067846c4..4214f2cade 100644 --- a/baselines/previously_seen_aws_cross_account_activity.yml +++ b/detections/cloud/previously_seen_aws_cross_account_activity.yml @@ -3,7 +3,7 @@ id: 1cc22b09-c867-416e-a511-cb36ac44aee2 version: 1 date: '2018-06-04' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup @@ -17,6 +17,7 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +known_false_positives: none references: [] tags: analytic_story: @@ -27,3 +28,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - userIdentity.accountId + - resources{}.accountId + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_aws_cross_account_activity_initial.yml b/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml similarity index 87% rename from baselines/previously_seen_aws_cross_account_activity_initial.yml rename to detections/cloud/previously_seen_aws_cross_account_activity_initial.yml index f84c122a14..1ff6d5f48d 100644 --- a/baselines/previously_seen_aws_cross_account_activity_initial.yml +++ b/detections/cloud/previously_seen_aws_cross_account_activity_initial.yml @@ -3,7 +3,7 @@ id: 82af2ed9-8f4b-4785-a152-ba61e6a23bbf version: 1 date: '2020-08-15' author: Rico Valdez, Splunk -type: batch +type: Baseline datamodel: - Authentication description: This search looks for **AssumeRole** events where the requesting account @@ -21,6 +21,7 @@ how_to_implement: You must install and configure the Splunk Add-on for AWS (vers to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +known_false_positives: none references: [] tags: analytic_story: @@ -34,3 +35,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Authentication.signature + - Authentication.vendor_account + - Authentication.user + - Authentication.src + - Authentication.user_role + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_aws_cross_account_activity_update.yml b/detections/cloud/previously_seen_aws_cross_account_activity_update.yml similarity index 88% rename from baselines/previously_seen_aws_cross_account_activity_update.yml rename to detections/cloud/previously_seen_aws_cross_account_activity_update.yml index dd2e2ea33c..13b57df69c 100644 --- a/baselines/previously_seen_aws_cross_account_activity_update.yml +++ b/detections/cloud/previously_seen_aws_cross_account_activity_update.yml @@ -3,7 +3,7 @@ id: dd6fb3a9-4906-48cb-8626-c88a25a056c3 version: 1 date: '2020-08-15' author: Rico Valdez, Splunk -type: batch +type: Baseline datamodel: - Authentication description: This search looks for **AssumeRole** events where the requesting account @@ -22,6 +22,7 @@ how_to_implement: You must install and configure the Splunk Add-on for AWS (vers to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +known_false_positives: none references: [] tags: analytic_story: @@ -35,3 +36,11 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Authentication.signature + - Authentication.vendor_account + - Authentication.user + - Authentication.src + - Authentication.user_role + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_aws_provisioning_activity_sources.yml b/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml similarity index 90% rename from baselines/previously_seen_aws_provisioning_activity_sources.yml rename to detections/cloud/previously_seen_aws_provisioning_activity_sources.yml index 60d6b7aa8a..08b0334bd3 100644 --- a/baselines/previously_seen_aws_provisioning_activity_sources.yml +++ b/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml @@ -3,7 +3,7 @@ id: ac88e6a0-4fba-4dfd-b7b9-8964df7d1aee version: 1 date: '2018-03-16' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning @@ -15,6 +15,7 @@ search: '`cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceI how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +known_false_positives: none references: [] tags: analytic_story: @@ -28,3 +29,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - sourceIPAddress + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_aws_regions.yml b/detections/cloud/previously_seen_aws_regions.yml similarity index 89% rename from baselines/previously_seen_aws_regions.yml rename to detections/cloud/previously_seen_aws_regions.yml index 1df505e38b..7b33b338a7 100644 --- a/baselines/previously_seen_aws_regions.yml +++ b/detections/cloud/previously_seen_aws_regions.yml @@ -3,7 +3,7 @@ id: fc0edc95-ff2b-48b0-9f6f-63da3789fd63 version: 1 date: '2018-01-08' author: Bhavin Patel, Splunk -type: batch +type: Baseline datamodel: [] description: This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) @@ -14,6 +14,7 @@ search: '`cloudtrail` StartInstances | stats earliest(_time) as earliest latest( how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +known_false_positives: none references: [] tags: analytic_story: @@ -25,3 +26,7 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - awsRegion + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_api_calls_per_user_role_initial.yml b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml similarity index 87% rename from baselines/previously_seen_cloud_api_calls_per_user_role_initial.yml rename to detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml index 2bd37b3ba9..c9330473a3 100644 --- a/baselines/previously_seen_cloud_api_calls_per_user_role_initial.yml +++ b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_initial.yml @@ -3,7 +3,7 @@ id: 69d75f4b-b794-4a66-a777-730357b886b4 version: 1 date: '2020-09-03' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search builds a table of the first and last times seen for every @@ -17,6 +17,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role' how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud provider. +known_false_positives: none references: [] tags: analytic_story: @@ -30,3 +31,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.user_type + - All_Changes.status + - All_Changes.user + - All_Changes.command + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_api_calls_per_user_role_update.yml b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml similarity index 88% rename from baselines/previously_seen_cloud_api_calls_per_user_role_update.yml rename to detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml index 741c5f8e11..809e71c692 100644 --- a/baselines/previously_seen_cloud_api_calls_per_user_role_update.yml +++ b/detections/cloud/previously_seen_cloud_api_calls_per_user_role_update.yml @@ -3,7 +3,7 @@ id: c4b760a0-6a97-47e9-b089-8ae9e57f210e version: 1 date: '2020-09-03' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search updates the table of the first and last times seen for every @@ -19,6 +19,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role' how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud provider. +known_false_positives: none references: [] tags: analytic_story: @@ -32,3 +33,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.user_type + - All_Changes.status + - All_Changes.user + - All_Changes.command + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_compute_creations_by_user_initial.yml b/detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml similarity index 85% rename from baselines/previously_seen_cloud_compute_creations_by_user_initial.yml rename to detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml index 7ae0c6c7b3..4ed0087dd0 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user_initial.yml +++ b/detections/cloud/previously_seen_cloud_compute_creations_by_user_initial.yml @@ -3,7 +3,7 @@ id: dd4ced8a-15a9-4285-94ac-7e4134673bf8 version: 1 date: '2020-08-15' author: Rico Valdez, Splunk -type: batch +type: Baseline datamodel: - Change description: This search builds a table of previously seen users that have launched @@ -14,6 +14,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | stats count' how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. +known_false_positives: none references: [] tags: analytic_story: @@ -27,3 +28,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.object_category + - All_Changes.user + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_compute_creations_by_user_update.yml b/detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml similarity index 88% rename from baselines/previously_seen_cloud_compute_creations_by_user_update.yml rename to detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml index 5284003406..9e23581bd1 100644 --- a/baselines/previously_seen_cloud_compute_creations_by_user_update.yml +++ b/detections/cloud/previously_seen_cloud_compute_creations_by_user_update.yml @@ -3,7 +3,7 @@ id: 6bf75d69-7766-47bc-8097-e41696807a6f version: 1 date: '2020-08-15' author: Rico Valdez, Splunk -type: batch +type: Baseline datamodel: - Change description: This search builds a table of previously seen users that have launched @@ -17,6 +17,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user' how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. +known_false_positives: none references: [] tags: analytic_story: @@ -30,3 +31,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.object_category + - All_Changes.user + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_compute_images_initial.yml b/detections/cloud/previously_seen_cloud_compute_images_initial.yml similarity index 87% rename from baselines/previously_seen_cloud_compute_images_initial.yml rename to detections/cloud/previously_seen_cloud_compute_images_initial.yml index 2a0afddd07..faabd60b6c 100644 --- a/baselines/previously_seen_cloud_compute_images_initial.yml +++ b/detections/cloud/previously_seen_cloud_compute_images_initial.yml @@ -3,7 +3,7 @@ id: 7744597f-d07a-4cea-94a7-e0f8aaebc410 version: 1 date: '2020-10-08' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search builds a table of previously seen images used to launch cloud @@ -16,6 +16,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | outputlookup previously_seen_cloud_compute_images' how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated +known_false_positives: none references: [] tags: analytic_story: @@ -29,3 +30,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.Instance_Changes.image_id + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_compute_images_update.yml b/detections/cloud/previously_seen_cloud_compute_images_update.yml similarity index 89% rename from baselines/previously_seen_cloud_compute_images_update.yml rename to detections/cloud/previously_seen_cloud_compute_images_update.yml index f5075e5acd..67cd23a815 100644 --- a/baselines/previously_seen_cloud_compute_images_update.yml +++ b/detections/cloud/previously_seen_cloud_compute_images_update.yml @@ -3,7 +3,7 @@ id: 6f1ca5dc-e445-401c-9845-a96d2b6ba184 version: 1 date: '2020-08-12' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search builds a table of previously seen images used to launch cloud @@ -17,6 +17,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images' how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs +known_false_positives: none references: [] tags: analytic_story: @@ -30,3 +31,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.Instance_Changes.image_id + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_compute_instance_types_initial.yml b/detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml similarity index 87% rename from baselines/previously_seen_cloud_compute_instance_types_initial.yml rename to detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml index a347f7e156..eae87e87e1 100644 --- a/baselines/previously_seen_cloud_compute_instance_types_initial.yml +++ b/detections/cloud/previously_seen_cloud_compute_instance_types_initial.yml @@ -3,7 +3,7 @@ id: 3c78025c-1ffe-4976-a640-75ef604842be version: 1 date: 2020-9-03 author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search builds a table of previously seen cloud compute instance @@ -15,6 +15,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types' how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +known_false_positives: none references: [] tags: analytic_story: @@ -28,3 +29,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.Instance_Changes.instance_type + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_compute_instance_types_update.yml b/detections/cloud/previously_seen_cloud_compute_instance_types_update.yml similarity index 89% rename from baselines/previously_seen_cloud_compute_instance_types_update.yml rename to detections/cloud/previously_seen_cloud_compute_instance_types_update.yml index b1bacfafd8..4a368a7706 100644 --- a/baselines/previously_seen_cloud_compute_instance_types_update.yml +++ b/detections/cloud/previously_seen_cloud_compute_instance_types_update.yml @@ -3,7 +3,7 @@ id: 7b7ef9ab-acb9-4e07-af76-4cf1e722885c version: 1 date: 2020-9-03 author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search builds a table of previously seen cloud compute instance @@ -17,6 +17,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types' how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs +known_false_positives: none references: [] tags: analytic_story: @@ -30,3 +31,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.Instance_Changes.instance_type + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_instance_modifications_by_user_initial.yml b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml similarity index 80% rename from baselines/previously_seen_cloud_instance_modifications_by_user_initial.yml rename to detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml index 8f07e2938d..e1efb82c0b 100644 --- a/baselines/previously_seen_cloud_instance_modifications_by_user_initial.yml +++ b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_initial.yml @@ -3,18 +3,19 @@ id: f36dc403-739d-42f3-83a3-49237d8654c5 version: 1 date: '2020-07-29' author: Rico Valdez, Splunk -type: batch +type: Baseline datamodel: - Change description: This search builds a table of previously seen users that have modified a cloud instance. search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 - All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` + c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user' how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. +known_false_positives: none references: [] tags: analytic_story: @@ -28,3 +29,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.change_type + - All_Changes.status + - All_Changes.user + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_instance_modifications_by_user_update.yml b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml similarity index 89% rename from baselines/previously_seen_cloud_instance_modifications_by_user_update.yml rename to detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml index d35fe1c709..df579ad762 100644 --- a/baselines/previously_seen_cloud_instance_modifications_by_user_update.yml +++ b/detections/cloud/previously_seen_cloud_instance_modifications_by_user_update.yml @@ -3,7 +3,7 @@ id: 534b7d30-7b0c-4510-8f55-65439850d58d version: 1 date: '2020-07-29' author: Rico Valdez, Splunk -type: batch +type: Baseline datamodel: - Change description: This search updates a table of previously seen Cloud Instance modifications @@ -19,6 +19,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +known_false_positives: none references: [] tags: analytic_story: @@ -32,3 +33,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.change_type + - All_Changes.status + - All_Changes.user + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml similarity index 90% rename from baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml rename to detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml index 4f7e2760e7..128b455081 100644 --- a/baselines/previously_seen_cloud_provisioning_activity_sources_initial.yml +++ b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_initial.yml @@ -3,7 +3,7 @@ id: 4ce865fc-f43e-4521-a8ed-ab8af99052d7 version: 1 date: '2020-08-19' author: Rico Valdez, Splunk -type: batch +type: Baseline datamodel: - Change description: This search builds a table of the first and last times seen for every @@ -19,6 +19,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee previously_seen_cloud_provisioning_activity_sources' how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud provider. +known_false_positives: none references: [] tags: analytic_story: @@ -35,3 +36,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.src + - All_Changes.status + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_provisioning_activity_sources_update.yml b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml similarity index 93% rename from baselines/previously_seen_cloud_provisioning_activity_sources_update.yml rename to detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml index 440103974c..c202455342 100644 --- a/baselines/previously_seen_cloud_provisioning_activity_sources_update.yml +++ b/detections/cloud/previously_seen_cloud_provisioning_activity_sources_update.yml @@ -3,7 +3,7 @@ id: 9830abb9-be80-4563-b232-09bf1f628cf3 version: 1 date: '2020-08-20' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This returns the first and last times seen for every IP address (along @@ -24,6 +24,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources' how_to_implement: You must be ingesting Cloud infrastructure logs from your cloud provider. +known_false_positives: none references: [] tags: analytic_story: @@ -40,3 +41,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.src + - All_Changes.status + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_regions_initial.yml b/detections/cloud/previously_seen_cloud_regions_initial.yml similarity index 89% rename from baselines/previously_seen_cloud_regions_initial.yml rename to detections/cloud/previously_seen_cloud_regions_initial.yml index da9eb78590..0b4c77ce2d 100644 --- a/baselines/previously_seen_cloud_regions_initial.yml +++ b/detections/cloud/previously_seen_cloud_regions_initial.yml @@ -3,7 +3,7 @@ id: b5e232db-dec6-4db8-aaa1-dd5474521e40 version: 1 date: '2020-09-02' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search looks for cloud compute events where a compute instance is @@ -17,6 +17,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | outputlookup previously_seen_cloud_regions' how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +known_false_positives: none references: [] tags: analytic_story: @@ -30,3 +31,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.vendor_region + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_cloud_regions_update.yml b/detections/cloud/previously_seen_cloud_regions_update.yml similarity index 90% rename from baselines/previously_seen_cloud_regions_update.yml rename to detections/cloud/previously_seen_cloud_regions_update.yml index ee2a7ed961..67c8a9a16a 100644 --- a/baselines/previously_seen_cloud_regions_update.yml +++ b/detections/cloud/previously_seen_cloud_regions_update.yml @@ -3,7 +3,7 @@ id: 512f928a-a461-41b4-8984-db4dd2c472e4 version: 1 date: '2020-09-02' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Change description: This search looks for cloud compute events where a compute instance is @@ -20,6 +20,7 @@ search: '| tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSee | stats count' how_to_implement: You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +known_false_positives: none references: [] tags: analytic_story: @@ -33,3 +34,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - All_Changes.action + - All_Changes.vendor_region + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_ec2_amis.yml b/detections/cloud/previously_seen_ec2_amis.yml similarity index 83% rename from baselines/previously_seen_ec2_amis.yml rename to detections/cloud/previously_seen_ec2_amis.yml index 5617881387..6f8fff93e7 100644 --- a/baselines/previously_seen_ec2_amis.yml +++ b/detections/cloud/previously_seen_ec2_amis.yml @@ -3,7 +3,7 @@ id: bb1bd99d-1e93-45f1-9571-cfed42d372b9 version: 1 date: '2018-03-12' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This search builds a table of previously seen AMIs used to launch EC2 instances @@ -13,6 +13,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestP how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +known_false_positives: none references: [] tags: analytic_story: @@ -23,3 +24,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - requestParameters.instancesSet.items{}.imageId + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_ec2_instance_types.yml b/detections/cloud/previously_seen_ec2_instance_types.yml similarity index 85% rename from baselines/previously_seen_ec2_instance_types.yml rename to detections/cloud/previously_seen_ec2_instance_types.yml index f7d824b7bc..508004f369 100644 --- a/baselines/previously_seen_ec2_instance_types.yml +++ b/detections/cloud/previously_seen_ec2_instance_types.yml @@ -3,7 +3,7 @@ id: b8f029f2-65a6-4d76-be98-dad1c9d59c45 version: 1 date: '2018-03-08' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This search builds a table of previously seen EC2 instance types search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType @@ -13,6 +13,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success | rename requestP how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +known_false_positives: none references: [] tags: analytic_story: @@ -23,3 +24,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - requestParameters.instanceType + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_ec2_launches_by_user.yml b/detections/cloud/previously_seen_ec2_launches_by_user.yml similarity index 85% rename from baselines/previously_seen_ec2_launches_by_user.yml rename to detections/cloud/previously_seen_ec2_launches_by_user.yml index ac11dca07c..c6c38626f3 100644 --- a/baselines/previously_seen_ec2_launches_by_user.yml +++ b/detections/cloud/previously_seen_ec2_launches_by_user.yml @@ -3,7 +3,7 @@ id: 6c767ac0-0906-4355-9a83-927f5ee7bdad version: 1 date: '2018-03-15' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This search builds a table of previously seen ARNs that have launched a EC2 instance. @@ -13,6 +13,7 @@ search: '`cloudtrail` eventName=RunInstances errorCode=success | rename userIden how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +known_false_positives: none references: [] tags: analytic_story: @@ -24,3 +25,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - errorCode + - requestParameters.instanceType + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_ec2_modifications_by_user.yml b/detections/cloud/previously_seen_ec2_modifications_by_user.yml similarity index 88% rename from baselines/previously_seen_ec2_modifications_by_user.yml rename to detections/cloud/previously_seen_ec2_modifications_by_user.yml index ab0ee91c62..b5dd318e51 100644 --- a/baselines/previously_seen_ec2_modifications_by_user.yml +++ b/detections/cloud/previously_seen_ec2_modifications_by_user.yml @@ -3,7 +3,7 @@ id: 4d69091b-d975-4267-85df-888bd41034eb version: 1 date: '2018-04-05' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This search builds a table of previously seen ARNs that have launched a EC2 instance. @@ -13,6 +13,7 @@ search: '`cloudtrail` `ec2_modification_api_calls` errorCode=success | spath out how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +known_false_positives: none references: [] tags: analytic_story: @@ -23,3 +24,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - userIdentity.arn + - errorCode + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml b/detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml similarity index 89% rename from baselines/previously_seen_s3_bucket_access_by_remote_ip.yml rename to detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml index e233c7e139..0cdf91a2a1 100644 --- a/baselines/previously_seen_s3_bucket_access_by_remote_ip.yml +++ b/detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml @@ -3,7 +3,7 @@ id: fc0edc15-fq2c-48b0-9f6f-63qa1281fd03 version: 1 date: '2018-06-28' author: Bhavin Patel, Splunk -type: batch +type: Baseline datamodel: [] description: This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered @@ -16,6 +16,7 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. +known_false_positives: none references: [] tags: analytic_story: @@ -26,3 +27,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - http_status + - bucket_name + - remote_ip + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_users_in_cloudtrail.yml b/detections/cloud/previously_seen_users_in_cloudtrail.yml similarity index 91% rename from baselines/previously_seen_users_in_cloudtrail.yml rename to detections/cloud/previously_seen_users_in_cloudtrail.yml index 64061c014f..3b6c389848 100644 --- a/baselines/previously_seen_users_in_cloudtrail.yml +++ b/detections/cloud/previously_seen_users_in_cloudtrail.yml @@ -3,7 +3,7 @@ id: fc0edc95-ff2b-48b0-9f6f-63da3789fd03 version: 1 date: '2018-04-30' author: Jason Brewer, Splunk -type: batch +type: Baseline datamodel: [] description: This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country @@ -18,6 +18,7 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. +known_false_positives: none references: [] tags: analytic_story: @@ -31,3 +32,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - userIdentity.arn + - src + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_users_in_cloudtrail_initial.yml b/detections/cloud/previously_seen_users_in_cloudtrail_initial.yml similarity index 90% rename from baselines/previously_seen_users_in_cloudtrail_initial.yml rename to detections/cloud/previously_seen_users_in_cloudtrail_initial.yml index d284348643..2e97e649a2 100644 --- a/baselines/previously_seen_users_in_cloudtrail_initial.yml +++ b/detections/cloud/previously_seen_users_in_cloudtrail_initial.yml @@ -3,7 +3,7 @@ id: 0a87ecf9-dc6a-43af-861a-205e75a09bf5 version: 1 date: '2020-05-28' author: Rico Valdez, Splunk -type: batch +type: Baseline datamodel: - Authentication description: This search looks for CloudTrail events where a user logs into the console, @@ -20,6 +20,7 @@ how_to_implement: You must install and configure the Splunk Add-on for AWS (vers to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. +known_false_positives: none references: [] tags: analytic_story: @@ -36,3 +37,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Authentication.signature + - Authentication.user + - Authentication.src + security_domain: network \ No newline at end of file diff --git a/baselines/previously_seen_users_in_cloudtrail_update.yml b/detections/cloud/previously_seen_users_in_cloudtrail_update.yml similarity index 91% rename from baselines/previously_seen_users_in_cloudtrail_update.yml rename to detections/cloud/previously_seen_users_in_cloudtrail_update.yml index b1bd4db6c0..ac04bf4f5d 100644 --- a/baselines/previously_seen_users_in_cloudtrail_update.yml +++ b/detections/cloud/previously_seen_users_in_cloudtrail_update.yml @@ -3,7 +3,7 @@ id: 66ff71c2-7e01-47dd-a041-906688c9d322 version: 1 date: '2020-05-28' author: Rico Valdez, Splunk -type: batch +type: Baseline datamodel: - Authentication description: This search looks for CloudTrail events where a user logs into the console, @@ -20,6 +20,7 @@ how_to_implement: You must install and configure the Splunk Add-on for AWS (vers to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. +known_false_positives: none references: [] tags: analytic_story: @@ -36,3 +37,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Authentication.signature + - Authentication.user + - Authentication.src + security_domain: network \ No newline at end of file diff --git a/baselines/update_previously_seen_users_in_cloudtrail.yml b/detections/cloud/update_previously_seen_users_in_cloudtrail.yml similarity index 92% rename from baselines/update_previously_seen_users_in_cloudtrail.yml rename to detections/cloud/update_previously_seen_users_in_cloudtrail.yml index ff05c11dae..703754631e 100644 --- a/baselines/update_previously_seen_users_in_cloudtrail.yml +++ b/detections/cloud/update_previously_seen_users_in_cloudtrail.yml @@ -3,7 +3,7 @@ id: 06c036e6-d6d7-4daa-bd76-411c3d356031 version: 1 date: '2018-04-30' author: Jason Brewer, Splunk -type: batch +type: Baseline datamodel: [] description: This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country @@ -20,6 +20,7 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. +known_false_positives: none references: [] tags: analytic_story: @@ -33,3 +34,9 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - eventName + - userIdentity.arn + - src + security_domain: network \ No newline at end of file diff --git a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml b/detections/deprecated/add_prohibited_processes_to_enterprise_security.yml similarity index 91% rename from baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml rename to detections/deprecated/add_prohibited_processes_to_enterprise_security.yml index e24ce8914c..b4a2986cdc 100644 --- a/baselines/deprecated/add_prohibited_processes_to_enterprise_security.yml +++ b/detections/deprecated/add_prohibited_processes_to_enterprise_security.yml @@ -3,7 +3,7 @@ id: 251930a5-1451-4428-bb13-eed5775be0ce version: 1 date: '2017-09-15' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes @@ -13,6 +13,7 @@ search: '| inputlookup prohibited_processes | search note!=ESCU* | inputlookup a is_required is_secure | fillnull value=true is_prohibited | outputlookup prohibited_processes | stats count' how_to_implement: This search should be run on each new install of ESCU. +known_false_positives: none references: [] tags: analytic_story: @@ -25,3 +26,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + security_domain: endpoint \ No newline at end of file diff --git a/baselines/baseline_of_command_line_length___mltk.yml b/detections/endpoint/baseline_of_command_line_length___mltk.yml similarity index 92% rename from baselines/baseline_of_command_line_length___mltk.yml rename to detections/endpoint/baseline_of_command_line_length___mltk.yml index 929bf94c16..6977e800b2 100644 --- a/baselines/baseline_of_command_line_length___mltk.yml +++ b/detections/endpoint/baseline_of_command_line_length___mltk.yml @@ -3,7 +3,7 @@ id: d2a4d85b-fc6a-47a0-82f6-bc1ec2ebc459 version: 1 date: '2019-05-08' author: Rico Valdez, Splunk -type: batch +type: Baseline datamodel: [] description: This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. @@ -25,6 +25,7 @@ how_to_implement: You must be ingesting endpoint data and populating the Endpoin a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +known_false_positives: none references: [] tags: analytic_story: @@ -40,3 +41,10 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.user + - Processes.dest + - Processes.process_name + - Processes.process + security_domain: endpoint \ No newline at end of file diff --git a/baselines/count_of_assets_by_category.yml b/detections/endpoint/count_of_assets_by_category.yml similarity index 87% rename from baselines/count_of_assets_by_category.yml rename to detections/endpoint/count_of_assets_by_category.yml index ceabf9c8ca..5ea968fa31 100644 --- a/baselines/count_of_assets_by_category.yml +++ b/detections/endpoint/count_of_assets_by_category.yml @@ -3,7 +3,7 @@ id: dcfd6b40-42f9-469d-a433-2e53f7489ff9 version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk -type: batch +type: Baseline datamodel: [] description: This search shows you every asset category you have and the assets that belong to those categories. @@ -14,6 +14,7 @@ how_to_implement: To successfully implement this search you must first leverage file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. +known_false_positives: none references: [] tags: analytic_story: @@ -24,3 +25,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Identity_Management.All_Assets + - category + security_domain: endpoint \ No newline at end of file diff --git a/baselines/identify_systems_using_remote_desktop.yml b/detections/endpoint/identify_systems_using_remote_desktop.yml similarity index 83% rename from baselines/identify_systems_using_remote_desktop.yml rename to detections/endpoint/identify_systems_using_remote_desktop.yml index f1ba95bb24..0b8f0f974e 100644 --- a/baselines/identify_systems_using_remote_desktop.yml +++ b/detections/endpoint/identify_systems_using_remote_desktop.yml @@ -3,7 +3,7 @@ id: 063dfe9f-b1d7-4254-a16d-1e2e7eadd6a8 version: 1 date: '2019-04-01' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: - Endpoint description: This search counts the numbers of times the remote desktop process, mstsc.exe, @@ -13,9 +13,15 @@ search: '| tstats `security_content_summariesonly` count from datamodel=Endpoint | `drop_dm_object_name(Processes)` | sort - count' how_to_implement: To successfully implement this search you must be ingesting endpoint data that records process activity. +known_false_positives: none references: [] tags: product: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.dest + security_domain: endpoint \ No newline at end of file diff --git a/baselines/monitor_successful_backups.yml b/detections/endpoint/monitor_successful_backups.yml similarity index 89% rename from baselines/monitor_successful_backups.yml rename to detections/endpoint/monitor_successful_backups.yml index d9a0ebaecc..68d32b36e8 100644 --- a/baselines/monitor_successful_backups.yml +++ b/detections/endpoint/monitor_successful_backups.yml @@ -3,7 +3,7 @@ id: b4d0dfb2-2195-4f6e-93a3-48468ed9734e version: 1 date: '2017-09-12' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you @@ -13,6 +13,7 @@ search: '`netbackup` "Disk/Partition backup completed successfully." | bucket _t MESSAGE' how_to_implement: To successfully implement this search you must be ingesting your backup logs. +known_false_positives: none references: [] tags: analytic_story: @@ -23,3 +24,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + security_domain: endpoint \ No newline at end of file diff --git a/baselines/monitor_unsuccessful_backups.yml b/detections/endpoint/monitor_unsuccessful_backups.yml similarity index 89% rename from baselines/monitor_unsuccessful_backups.yml rename to detections/endpoint/monitor_unsuccessful_backups.yml index 0ea3dcac07..e3c7901a6f 100644 --- a/baselines/monitor_unsuccessful_backups.yml +++ b/detections/endpoint/monitor_unsuccessful_backups.yml @@ -3,7 +3,7 @@ id: b2178fed-592f-492b-b851-74161678aa56 version: 1 date: '2017-09-12' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine @@ -12,6 +12,7 @@ search: '`netbackup` "An error occurred, failed to backup." | bucket _time span= | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE' how_to_implement: To successfully implement this search you must be ingesting your backup logs. +known_false_positives: none references: [] tags: analytic_story: @@ -22,3 +23,6 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + security_domain: endpoint \ No newline at end of file diff --git a/baselines/previously_seen_command_line_arguments.yml b/detections/endpoint/previously_seen_command_line_arguments.yml similarity index 91% rename from baselines/previously_seen_command_line_arguments.yml rename to detections/endpoint/previously_seen_command_line_arguments.yml index bc4759a0de..329d32879a 100644 --- a/baselines/previously_seen_command_line_arguments.yml +++ b/detections/endpoint/previously_seen_command_line_arguments.yml @@ -3,7 +3,7 @@ id: 56059acf-50fe-4f60-98d1-b75b51b5c2f3 version: 2 date: '2019-03-01' author: Bhavin Patel, Splunk -type: batch +type: Baseline datamodel: - Endpoint description: This search looks for command-line arguments where `cmd.exe /c` is used @@ -17,6 +17,7 @@ how_to_implement: You must be ingesting data that records process activity from logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. +known_false_positives: none references: [] tags: analytic_story: @@ -36,3 +37,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + required_fields: + - _time + - Processes.process_name + - Processes.process + security_domain: endpoint \ No newline at end of file diff --git a/baselines/previously_seen_running_windows_services.yml b/detections/endpoint/previously_seen_running_windows_services.yml similarity index 89% rename from baselines/previously_seen_running_windows_services.yml rename to detections/endpoint/previously_seen_running_windows_services.yml index 772f12e108..f6141d2fe2 100644 --- a/baselines/previously_seen_running_windows_services.yml +++ b/detections/endpoint/previously_seen_running_windows_services.yml @@ -3,7 +3,7 @@ id: 64ce0ade-cb01-4678-bddd-d31c0b175394 version: 3 date: '2020-06-23' author: David Dorsey, Splunk -type: batch +type: Baseline datamodel: [] description: This collects the services that have been started across your entire enterprise. @@ -13,6 +13,7 @@ search: '`wineventlog_system` EventCode=7036 | rex field=Message "The (? Date: Tue, 20 Jul 2021 16:17:07 +0200 Subject: [PATCH 06/21] updated generate --- bin/generate.py | 64 +- bin/jinja2_templates/savedsearches.j2 | 57 +- bin/jinja2_templates/use_case_library.j2 | 19 - dist/escu/default/analytic_stories.conf | 18 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/macros.conf | 254 +- dist/escu/default/savedsearches.conf | 3764 ++++++++++++++-------- dist/escu/default/transforms.conf | 10 +- dist/escu/default/use_case_library.conf | 1077 ++++--- dist/escu/lookups/attacker_tools.csv | 26 + dist/escu/lookups/mitre_enrichment.csv | 540 ++-- 11 files changed, 3708 insertions(+), 2123 deletions(-) create mode 100644 dist/escu/lookups/attacker_tools.csv diff --git a/bin/generate.py b/bin/generate.py index 39138b9c3c..bd78d11921 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -88,16 +88,14 @@ def generate_collections_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH): return output_path -def generate_savedsearches_conf(detections, response_tasks, baselines, deployments, TEMPLATE_PATH, OUTPUT_PATH): +def generate_savedsearches_conf(detections, response_tasks, deployments, TEMPLATE_PATH, OUTPUT_PATH): ''' @param detections: input list of individual YAML detections in detections/ directory @param response_tasks: - @param baselines: @param deployments: @return: the savedsearches.conf file located in package/default/ ''' - utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat() j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), @@ -105,14 +103,14 @@ def generate_savedsearches_conf(detections, response_tasks, baselines, deploymen j2_env.filters['custom_jinja2_enrichment_filter'] = custom_jinja2_enrichment_filter template = j2_env.get_template('savedsearches.j2') output_path = path.join(OUTPUT_PATH, 'default/savedsearches.conf') - output = template.render(detections=detections, baselines=baselines, response_tasks=response_tasks, time=utc_time) + output = template.render(detections=detections, response_tasks=response_tasks, time=utc_time) with open(output_path, 'w') as f: output = output.encode('ascii', 'ignore').decode('ascii') f.write(output) return output_path -def generate_analytic_story_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH): +def generate_analytic_story_conf(stories, detections, response_tasks, TEMPLATE_PATH, OUTPUT_PATH): utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat() j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), @@ -125,7 +123,7 @@ def generate_analytic_story_conf(stories, detections, response_tasks, baselines, return output_path -def generate_use_case_library_conf(stories, detections, response_tasks, baselines, TEMPLATE_PATH, OUTPUT_PATH): +def generate_use_case_library_conf(stories, detections, response_tasks, TEMPLATE_PATH, OUTPUT_PATH): utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat() j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), @@ -134,7 +132,7 @@ def generate_use_case_library_conf(stories, detections, response_tasks, baseline output_path = path.join(OUTPUT_PATH, 'default/use_case_library.conf') output = template.render(stories=stories, detections=detections, response_tasks=response_tasks, - baselines=baselines, time=utc_time) + time=utc_time) with open(output_path, 'w', encoding="utf-8") as f: f.write(output) @@ -202,7 +200,6 @@ def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PAT return workbench_panel_objects - def parse_data_models_from_search(search): match = re.search(r'from\sdatamodel\s?=\s?([^\s.]*)', search) if match is not None: @@ -224,7 +221,6 @@ def parse_author_company(story): return match_author, match_company - def get_deployments(object, deployments): matched_deployments = [] @@ -297,11 +293,9 @@ def map_baselines_to_stories(baselines): if 'tags' in baseline: if 'analytic_story' in baseline['tags']: for story in baseline['tags']['analytic_story']: - if 'type' in baseline.keys(): - if baseline['type'] == 'batch': - baseline_name = str('ESCU - ' + baseline['name']) - else: - baseline_name = str('ESCU - ' + baseline['name']) + if 'Splunk Behavioral Analytics' in baseline['tags']['product']: + continue + baseline_name = str('ESCU - ' + baseline['name']) if not (story in sto_bas): sto_bas[story] = {baseline_name} else: @@ -434,19 +428,6 @@ def prepare_detections(detections, deployments, OUTPUT_PATH): return detections -def prepare_baselines(baselines, deployments, OUTPUT_PATH): - for baseline in baselines: - data_model = parse_data_models_from_search(baseline['search']) - if data_model: - baseline['data_model'] = data_model - if (OUTPUT_PATH) == 'dist/saaws': - baseline['disabled'] = 'false' - - matched_deployment = get_deployments(baseline, deployments) - baseline['deployment'] = matched_deployment - - return baselines - def prepare_response_tasks(response_tasks): for response_task in response_tasks: if 'search' in response_task: @@ -456,7 +437,7 @@ def prepare_response_tasks(response_tasks): return response_tasks -def prepare_stories(stories, detections, response_tasks, baselines): +def prepare_stories(stories, detections, response_tasks): # enrich stories with information from detections: data_models, mitre_ids, kill_chain_phases, nists sto_to_data_models = {} sto_to_mitre_attack_ids = {} @@ -464,14 +445,15 @@ def prepare_stories(stories, detections, response_tasks, baselines): sto_to_ciss = {} sto_to_nists = {} sto_to_det = {} + + baselines = [object for object in detections if 'Baseline' in object['type']] + for detection in detections: + if detection['type'] == 'Baseline': + continue if 'analytic_story' in detection['tags']: for story in detection['tags']['analytic_story']: - if 'type' in detection.keys(): - if detection['type'] == 'batch': - rule_name = str('ESCU - ' + detection['name'] + ' - Rule') - else: - rule_name = str('ESCU - ' + detection['name'] + ' - Rule') + rule_name = str('ESCU - ' + detection['name'] + ' - Rule') if story in sto_to_det.keys(): sto_to_det[story].add(rule_name) @@ -552,7 +534,6 @@ def prepare_stories(stories, detections, response_tasks, baselines): return stories - def generate_mitre_lookup(OUTPUT_PATH): csv_mitre_rows = [["mitre_id", "technique", "tactics", "groups"]] @@ -585,7 +566,6 @@ def import_objects(VERBOSE, REPO_PATH): "stories": load_objects("stories/*.yml", VERBOSE, REPO_PATH), "macros": load_objects("macros/*.yml", VERBOSE, REPO_PATH), "lookups": load_objects("lookups/*.yml", VERBOSE, REPO_PATH), - "baselines": load_objects("baselines/*.yml", VERBOSE, REPO_PATH), "responses": load_objects("responses/*.yml", VERBOSE, REPO_PATH), "response_tasks": load_objects("response_tasks/*.yml", VERBOSE, REPO_PATH), "deployments": load_objects("deployments/*.yml", VERBOSE, REPO_PATH), @@ -599,22 +579,19 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH): if PRODUCT == "SAAWS": objects["detections"] = [object for object in objects["detections"] if 'Splunk Security Analytics for AWS' in object['tags']['product']] objects["stories"] = [object for object in objects["stories"] if 'Splunk Security Analytics for AWS' in object['tags']['product']] - objects["baselines"] = [object for object in objects["baselines"] if 'Splunk Security Analytics for AWS' in object['tags']['product']] objects["response_tasks"] = [object for object in objects["response_tasks"] if 'Splunk Security Analytics for AWS' in object['tags']['product']] # only use ESCU detections to the configurations - objects["detections"] = sorted(filter(lambda d: d['type'].lower() == 'batch', objects["detections"]), key=lambda d: d['name']) + objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name']) # only use ESCU stories to the configuration objects["stories"] = sorted(filter(lambda s: s['type'].lower() == 'batch', objects["stories"]), key=lambda s: s['name']) objects["response_tasks"] = sorted(objects["response_tasks"], key=lambda i: i['name']) - objects["baselines"] = sorted(objects["baselines"], key=lambda b: b['name']) objects["macros"] = sorted(objects["macros"], key=lambda m: m['name']) objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], OUTPUT_PATH) - objects["baselines"] = prepare_baselines(objects["baselines"], objects["deployments"], OUTPUT_PATH) objects["response_tasks"] = prepare_response_tasks(objects["response_tasks"]) - objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["response_tasks"], objects["baselines"]) + objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["response_tasks"]) return objects @@ -641,11 +618,11 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE): lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH) lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH) - detection_path = generate_savedsearches_conf(objects["detections"], objects["response_tasks"], objects["baselines"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH) + detection_path = generate_savedsearches_conf(objects["detections"], objects["response_tasks"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH) - story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], objects["response_tasks"], objects["baselines"], TEMPLATE_PATH, OUTPUT_PATH) + story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], objects["response_tasks"], TEMPLATE_PATH, OUTPUT_PATH) - use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], objects["response_tasks"], objects["baselines"], TEMPLATE_PATH, OUTPUT_PATH) + use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], objects["response_tasks"], TEMPLATE_PATH, OUTPUT_PATH) macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) @@ -662,7 +639,6 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE): print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path)) print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path)) print("{0} response tasks have been successfully written to {1}".format(len(objects["response_tasks"]), detection_path)) - print("{0} baselines have been successfully written to {1}".format(len(objects["baselines"]), detection_path)) print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path)) print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*")) print("security content generation completed..") diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index f53e192fd4..f6b8641208 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -12,7 +12,9 @@ action.escu = 0 action.escu.enabled = 1 description = {{ detection.description }} +{% if detection.mappings is defined %} action.escu.mappings = {{ detection.mappings | tojson }} +{% endif %} {% if detection.data_model is defined %} action.escu.data_models = [{{ detection.data_model | tojson }}] {% else %} @@ -32,8 +34,13 @@ action.escu.known_false_positives = None action.escu.creation_date = {{ detection.date }} action.escu.modification_date = {{ detection.date }} action.escu.confidence = high +{% if detection.type == "Baseline" %} +action.escu.full_search_name = ESCU - {{ detection.name }} +action.escu.search_type = support +{% else %} action.escu.full_search_name = ESCU - {{ detection.name }} - Rule action.escu.search_type = detection +{% endif %} {% if detection.product is defined %} action.escu.product = {{ detection.product | tojson }} {% endif %} @@ -106,56 +113,6 @@ search = {{ detection.search }} ### END ESCU DETECTIONS ### -### ESCU BASELINES ### - -{% for baseline in baselines %} -[ESCU - {{ baseline.name }}] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - {{ baseline.name }} -description = {{ baseline.description }} -action.escu.creation_date = {{ baseline.date }} -action.escu.modification_date = {{ baseline.date }} -{% if baseline.tags.analytic_story is defined %} -action.escu.analytic_story = {{ baseline.tags.analytic_story | tojson }} -{% else %} -action.escu.analytic_story = [] -{% endif %} -{% if baseline.data_model is defined %} -action.escu.data_models = [{{ baseline.data_model | tojson }}] -{% else %} -action.escu.data_models = [] -{% endif %} -cron_schedule = {{ baseline.deployment.scheduling.cron_schedule }} -enableSched = 1 -dispatch.earliest_time = {{ baseline.deployment.scheduling.earliest_time }} -dispatch.latest_time = {{ baseline.deployment.scheduling.latest_time }} -{% if baseline.deployment.scheduling.schedule_window is defined %} -schedule_window = {{ baseline.deployment.scheduling.schedule_window }} -{% endif %} -{% if baseline.providing_technologies is defined %} -action.escu.providing_technologies = {{ baseline.providing_technologies | tojson }} -{% else %} -action.escu.providing_technologies = [] -{% endif %} -action.escu.eli5 = {{ baseline.description }} -{% if baseline.how_to_implement is defined %} -action.escu.how_to_implement = {{ baseline.how_to_implement }} -{% else %} -action.escu.how_to_implement = none -{% endif %} -{% if baseline.disabled is defined %} -disabled = false -{% else %} -disabled = true -{% endif %} -is_visible = false -search = {{ baseline.search }} - -{% endfor %} - - ### ESCU RESPONSE TASKS ### {% for response_task in response_tasks %} diff --git a/bin/jinja2_templates/use_case_library.j2 b/bin/jinja2_templates/use_case_library.j2 index 605c7e2c4e..3f453cb323 100644 --- a/bin/jinja2_templates/use_case_library.j2 +++ b/bin/jinja2_templates/use_case_library.j2 @@ -62,22 +62,3 @@ latest_time_offset = 0 {% endfor %} ### END RESPONSE TASKS ### -### BASELINES ### -{% for baseline in baselines %} -[savedsearch://ESCU - {{ baseline.name }}] -type = support -explanation = {{ baseline.description }} -{% if baseline.how_to_implement is defined %} -how_to_implement = {{ baseline.how_to_implement }} -{% else %} -how_to_implement = none -{% endif %} -{% if baseline.known_false_positives is defined %} -known_false_positives = {{ baseline.known_false_positives }} -{% else %} -known_false_positives = not defined -{% endif %} -providing_technologies = none - -{% endfor %} -### END ESCU BASELINES ### diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 29e609d4e5..b7c67f19ec 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-13T23:06:08 UTC +# On Date: 2021-07-20T14:08:27 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -598,7 +598,7 @@ reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1021.002", "T1059.003", "T1072", "T1547.001", "T1566.001"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] -support_searches = ["ESCU - Baseline of SMB Traffic - MLTK"] +support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of SMB Traffic - MLTK"] data_models = ["Email", "Endpoint", "Network_Traffic"] providing_technologies = none description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. @@ -1136,10 +1136,10 @@ modification_date = 2018-12-13 id = c4b89506-fbcf-4cb7-bfd6-527e54789604 version = 1 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] -detection_searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] -mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Execution", "Exploitation", "Installation", "Lateral Movement", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1021.002", "T1082", "T1204.002", "T1485", "T1486", "T1490", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]} +detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] +mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Execution", "Exploitation", "Installation", "Lateral Movement", "Reconnaissance"], "mitre_attack": ["T1003", "T1021.001", "T1021.002", "T1036.005", "T1082", "T1204.002", "T1485", "T1486", "T1490", "T1569.002", "T1595"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]} investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] -support_searches = [] +support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security"] data_models = ["Endpoint", "Network_Traffic", "Web"] providing_technologies = none description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. @@ -1599,8 +1599,8 @@ modification_date = 2020-02-04 id = f4368e3f-d59f-4192-84f6-748ac5a3ddb6 version = 2 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] -detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"] -mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Denial of Service", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1016", "T1036.003", "T1190", "T1204.002", "T1218.011"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]} +detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"] +mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Denial of Service", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1003", "T1016", "T1036.003", "T1036.005", "T1190", "T1204.002", "T1218.011", "T1595"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK"] data_models = ["Endpoint"] @@ -1759,8 +1759,8 @@ modification_date = 2021-05-07 id = 06723e6a-6bd8-4817-ace2-5fb8a7b06628 version = 1 reference = ["https://github.com/xmrig/xmrig", "https://www.getmonero.org/resources/user-guides/mine-to-pool.html", "https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"] -detection_searches = ["ESCU - Deleting Of Net Users - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disabling Net User Account - Rule", "ESCU - Download Files Using Telegram - Rule", "ESCU - Enumerate Users Local Group Using Telegram - Rule", "ESCU - Excessive Attempt To Disable Services - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Icacls Deny Command - Rule", "ESCU - Modify ACL permission To Files Or Folder - Rule", "ESCU - Process Kill Base On File Path - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - XMRIG Driver Loaded - Rule"] -mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036", "T1053", "T1087", "T1105", "T1222", "T1489", "T1531", "T1543", "T1543.003", "T1562.001"]} +detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Deleting Of Net Users - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disabling Net User Account - Rule", "ESCU - Download Files Using Telegram - Rule", "ESCU - Enumerate Users Local Group Using Telegram - Rule", "ESCU - Excessive Attempt To Disable Services - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Icacls Deny Command - Rule", "ESCU - Modify ACL permission To Files Or Folder - Rule", "ESCU - Process Kill Base On File Path - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - XMRIG Driver Loaded - Rule"] +mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation"], "mitre_attack": ["T1003", "T1036", "T1036.005", "T1053", "T1087", "T1105", "T1222", "T1489", "T1531", "T1543", "T1543.003", "T1562.001", "T1595"], "nist": ["ID.AM", "PR.DS"]} investigative_searches = [] support_searches = [] data_models = ["Endpoint"] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index e6fff8d394..cc0d24aca2 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-13T23:06:08 UTC +# On Date: 2021-07-20T14:08:27 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index bc4fd4fdf4..2a811b0cc9 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-13T23:06:08 UTC +# On Date: 2021-07-20T14:08:27 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -431,6 +431,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[add_prohibited_processes_to_enterprise_security_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [allow_file_and_printing_sharing_in_firewall_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -471,6 +475,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[attacker_tools_on_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [attempt_to_add_certificate_to_untrusted_store_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -495,6 +503,62 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[baseline_of_cloud_infrastructure_api_calls_per_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_instances_destroyed_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_instances_launched_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_cloud_security_group_api_calls_per_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_api_calls_per_user_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_command_line_length___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_dns_query_length___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_excessive_aws_instances_launched_by_user___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_excessive_aws_instances_terminated_by_user___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_network_acl_activity_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_s3_bucket_deletion_activity_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_smb_traffic___mltk_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_security_group_activity_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[baseline_of_blocked_outbound_traffic_from_aws_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [batch_file_write_to_system32_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -603,6 +667,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[count_of_unique_ips_connecting_to_ports_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[count_of_assets_by_category_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [create_remote_thread_into_lsass_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -611,6 +683,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[create_a_list_of_approved_aws_service_accounts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [create_local_admin_accounts_using_net_exe_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -663,6 +739,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[dnstwist_domain_names_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [dsquery_domain_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1123,6 +1203,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[discover_dns_records_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [download_files_using_telegram_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1343,6 +1427,18 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[identify_systems_creating_remote_desktop_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[identify_systems_receiving_remote_desktop_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[identify_systems_using_remote_desktop_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [kerberoasting_spn_request_with_rc4_encryption_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1483,6 +1579,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[monitor_successful_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[monitor_unsuccessful_backups_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [monitor_web_traffic_for_brand_abuse_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1711,6 +1815,138 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[previously_seen_aws_cross_account_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_cross_account_activity___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_cross_account_activity___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_provisioning_activity_sources_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_aws_regions_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_api_calls_per_user_role___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_api_calls_per_user_role___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_creations_by_user___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_creations_by_user___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_images___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_images___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_instance_types___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_compute_instance_types___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_instance_modifications_by_user___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_instance_modifications_by_user___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_provisioning_activity_sources___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_provisioning_activity_sources___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_regions___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_cloud_regions___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_amis_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_instance_types_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_launches_by_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_ec2_modifications_by_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_running_windows_services___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_running_windows_services___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_zoom_child_processes___initial_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_zoom_child_processes___update_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_api_call_per_user_roles_in_cloudtrail_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_s3_bucket_access_by_remote_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_command_line_arguments_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[previously_seen_users_in_cloudtrail_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [print_spooler_adding_a_printer_driver_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2123,6 +2359,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[systems_ready_for_spectre_meltdown_windows_patch_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [tor_traffic_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2171,6 +2411,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[update_previously_seen_users_in_cloudtrail_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [w3wp_spawning_shell_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2255,6 +2499,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[windows_updates_install_failures_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[windows_updates_install_successes_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [windows_connhost_exe_started_forcefully_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index a3c29701e8..c2f68e80f4 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-13T23:06:08 UTC +# On Date: 2021-07-20T14:08:27 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1411,6 +1411,47 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter` +[ESCU - Add Prohibited Processes to Enterprise Security - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. +action.escu.how_to_implement = This search should be run on each new install of ESCU. +action.escu.known_false_positives = none +action.escu.creation_date = 2017-09-15 +action.escu.modification_date = 2017-09-15 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Add Prohibited Processes to Enterprise Security +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Monitor for Unauthorized Software", "SamSam Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Deprecated - Add Prohibited Processes to Enterprise Security - Rule +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Monitor for Unauthorized Software", "SamSam Ransomware"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. +action.notable.param.rule_title = Add Prohibited Processes to Enterprise Security +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | inputlookup prohibited_processes | search note!=ESCU* | inputlookup append=T prohibited_processes | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup prohibited_processes | stats count + [ESCU - Allow File And Printing Sharing In Firewall - Rule] action.escu = 0 action.escu.enabled = 1 @@ -1818,6 +1859,47 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=powershell.exe OR Processes.process_name=pwsh.exe OR Processes.process_name=PowerShell_ISE.exe Processes.process=*.DownloadString* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `any_powershell_downloadstring_filter` +[ESCU - Attacker Tools On Endpoint - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for execution of commonly used attacker tools on an endpoint. +action.escu.mappings = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1595", "T1003"], "nist": ["ID.AM", "PR.DS"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search looks for execution of commonly used attacker tools on an endpoint. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. +action.escu.known_false_positives = Some administrator activity can be potentially triggered, please add those users to the filter macro. +action.escu.creation_date = 2021-06-21 +action.escu.modification_date = 2021-06-21 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Attacker Tools On Endpoint - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Attacker Tools On Endpoint - Rule +action.correlationsearch.annotations = {"analytic_story": ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1595", "T1003"], "nist": ["ID.AM", "PR.DS"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search looks for execution of commonly used attacker tools on an endpoint. +action.notable.param.rule_title = Attacker Tools On Endpoint +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime values(Processes.process) as process values(Processes.parent_process) as parent_process from datamodel=Endpoint.Processes where Processes.dest!=unknown Processes.user!=unknown by Processes.dest Processes.user Processes.process_name Processes.process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | lookup attacker_tools attacker_tool_names AS process_name OUTPUT description | search description=* | `attacker_tools_on_endpoint_filter` + [ESCU - Attempt To Add Certificate To Untrusted Store - Rule] action.escu = 0 action.escu.enabled = 1 @@ -2064,6 +2146,556 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bitsadmin_download_file_filter` +[ESCU - Baseline Of Cloud Infrastructure API Calls Per User - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-09-07 +action.escu.modification_date = 2020-09-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline Of Cloud Infrastructure API Calls Per User +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud User Activities"] +cron_schedule = 0 2 * * 0 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline Of Cloud Infrastructure API Calls Per User - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true + +[ESCU - Baseline Of Cloud Instances Destroyed - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. +action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-08-25 +action.escu.modification_date = 2020-08-25 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Destroyed +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"] +cron_schedule = 0 2 * * 0 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline Of Cloud Instances Destroyed - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true + +[ESCU - Baseline Of Cloud Instances Launched - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-08-14 +action.escu.modification_date = 2020-08-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Launched +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] +cron_schedule = 0 2 * * 0 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline Of Cloud Instances Launched - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true + +[ESCU - Baseline Of Cloud Security Group API Calls Per User - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. +action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-09-07 +action.escu.modification_date = 2020-09-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline Of Cloud Security Group API Calls Per User +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud User Activities"] +cron_schedule = 0 2 * * 0 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline Of Cloud Security Group API Calls Per User - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend | eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true + +[ESCU - Baseline of API Calls per User ARN - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-04-09 +action.escu.modification_date = 2018-04-09 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline of API Calls per User ARN +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS User Monitoring"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline of API Calls per User ARN - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.notable.param.rule_title = Baseline of API Calls per User ARN +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count + +[ESCU - Baseline of Command Line Length - MLTK - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. +action.escu.how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +action.escu.known_false_positives = none +action.escu.creation_date = 2019-05-08 +action.escu.modification_date = 2019-05-08 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline of Command Line Length - MLTK +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline of Command Line Length - MLTK - Rule +action.correlationsearch.annotations = {"analytic_story": ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. +action.notable.param.rule_title = Baseline of Command Line Length - MLTK +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel + +[ESCU - Baseline of DNS Query Length - MLTK - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. +action.escu.mappings = {} +action.escu.data_models = ["Network_Resolution"] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. +action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +action.escu.known_false_positives = none +action.escu.creation_date = 2019-05-08 +action.escu.modification_date = 2019-05-08 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline of DNS Query Length - MLTK +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline of DNS Query Length - MLTK - Rule +action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. +action.notable.param.rule_title = Baseline of DNS Query Length - MLTK +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel + +[ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ +In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +action.escu.known_false_positives = none +action.escu.creation_date = 2019-11-14 +action.escu.modification_date = 2019-11-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user'] +action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. +action.notable.param.rule_title = Baseline of Excessive AWS Instances Launched by User - MLTK +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_launched by _time src_user | fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1 + +[ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ +In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +action.escu.known_false_positives = none +action.escu.creation_date = 2019-11-14 +action.escu.modification_date = 2019-11-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious AWS EC2 Activities"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user'] +action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. +action.notable.param.rule_title = Baseline of Excessive AWS Instances Terminated by User - MLTK +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_terminated by _time src_user | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1 + +[ESCU - Baseline of Network ACL Activity by ARN - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-05-21 +action.escu.modification_date = 2018-05-21 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline of Network ACL Activity by ARN +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS Network ACL Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline of Network ACL Activity by ARN - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.notable.param.rule_title = Baseline of Network ACL Activity by ARN +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats count + +[ESCU - Baseline of S3 Bucket deletion activity by ARN - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-07-17 +action.escu.modification_date = 2018-07-17 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline of S3 Bucket deletion activity by ARN +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious AWS S3 Activities"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline of S3 Bucket deletion activity by ARN - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.notable.param.rule_title = Baseline of S3 Bucket deletion activity by ARN +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count + +[ESCU - Baseline of SMB Traffic - MLTK - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. +action.escu.mappings = {} +action.escu.data_models = ["Network_Traffic"] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. +action.escu.how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +action.escu.known_false_positives = none +action.escu.creation_date = 2019-05-08 +action.escu.modification_date = 2019-05-08 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline of SMB Traffic - MLTK +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline of SMB Traffic - MLTK - Rule +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['src'] +action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. +action.notable.param.rule_title = Baseline of SMB Traffic - MLTK +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction count by "HourOfDay,DayOfWeek" into smb_pdfmodel + +[ESCU - Baseline of Security Group Activity by ARN - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-04-17 +action.escu.modification_date = 2018-04-17 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline of Security Group Activity by ARN +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS User Monitoring"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline of Security Group Activity by ARN - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.notable.param.rule_title = Baseline of Security Group Activity by ARN +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats count + +[ESCU - Baseline of blocked outbound traffic from AWS - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-05-07 +action.escu.modification_date = 2018-05-07 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Baseline of blocked outbound traffic from AWS +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Baseline of blocked outbound traffic from AWS - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. +action.notable.param.rule_title = Baseline of blocked outbound traffic from AWS +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections | stats count + [ESCU - Batch File Write to System32 - Rule] action.escu = 0 action.escu.enabled = 1 @@ -3192,6 +3824,86 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*" OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process = "*-nomutex*" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `conti_common_exec_parameter_filter` +[ESCU - Count of Unique IPs Connecting to Ports - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. +action.escu.mappings = {} +action.escu.data_models = ["Network_Traffic"] +action.escu.eli5 = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. +action.escu.known_false_positives = none +action.escu.creation_date = 2017-09-13 +action.escu.modification_date = 2017-09-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Count of Unique IPs Connecting to Ports +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = [] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Count of Unique IPs Connecting to Ports - Rule +action.correlationsearch.annotations = {} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. +action.notable.param.rule_title = Count of Unique IPs Connecting to Ports +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` | sort - count + +[ESCU - Count of assets by category - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search shows you every asset category you have and the assets that belong to those categories. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search shows you every asset category you have and the assets that belong to those categories. +action.escu.how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. +action.escu.known_false_positives = none +action.escu.creation_date = 2017-09-13 +action.escu.modification_date = 2017-09-13 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Count of assets by category +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Asset Tracking"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Count of assets by category - Rule +action.correlationsearch.annotations = {"analytic_story": ["Asset Tracking"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search shows you every asset category you have and the assets that belong to those categories. +action.notable.param.rule_title = Count of assets by category +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | from datamodel Identity_Management.All_Assets | stats count values(nt_host) by category | sort -count + [ESCU - Create Remote Thread into LSASS - Rule] action.escu = 0 action.escu.enabled = 1 @@ -3274,6 +3986,46 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) Service_Type = "user mode service" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_service_in_suspicious_file_path_filter` +[ESCU - Create a list of approved AWS service accounts - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-12-03 +action.escu.modification_date = 2018-12-03 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Create a list of approved AWS service accounts +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS User Monitoring"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Create a list of approved AWS service accounts - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. +action.notable.param.rule_title = Create a list of approved AWS service accounts +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` errorCode=success | rename userName as identity | search NOT [inputlookup identity_lookup_expanded | fields identity] | stats count by identity | table identity | outputlookup aws_service_accounts | stats count + [ESCU - Create local admin accounts using net exe - Rule] action.escu = 0 action.escu.enabled = 1 @@ -3816,6 +4568,46 @@ realtime_schedule = 0 is_visible = false search = | inputlookup discovered_dns_records | rename answer as discovered_answer | join domain[|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query | where query!="unknown" | rex field=query "(?\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer | makemv delim=" " type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n) | `dns_record_changed_filter` +[ESCU - DNSTwist Domain Names - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. +action.escu.how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-10-08 +action.escu.modification_date = 2018-10-08 +action.escu.confidence = high +action.escu.full_search_name = ESCU - DNSTwist Domain Names +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - DNSTwist Domain Names - Rule +action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring", "Suspicious Emails"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. +action.notable.param.rule_title = DNSTwist Domain Names +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse="true" | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count + [ESCU - DSQuery Domain Discovery - Rule] action.escu = 0 action.escu.enabled = 1 @@ -8657,6 +9449,46 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter` +[ESCU - Discover DNS records - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup +action.escu.mappings = {} +action.escu.data_models = ["Network_Resolution"] +action.escu.eli5 = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup +action.escu.how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation +action.escu.known_false_positives = none +action.escu.creation_date = 2019-02-14 +action.escu.modification_date = 2019-02-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Discover DNS records +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["DNS Hijacking"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Discover DNS records - Rule +action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup +action.notable.param.rule_title = Discover DNS records +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, "\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query | where query!="unknown" | rex field=query "(?\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer | makemv delim=" " type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records + [ESCU - Download Files Using Telegram - Rule] action.escu = 0 action.escu.enabled = 1 @@ -10929,6 +11761,129 @@ realtime_schedule = 0 is_visible = false search = | from datamodel Identity_Management.All_Identities | eval empStatus=case((now()-startDate)<604800, "Accounts created in last week") | search empStatus="Accounts created in last week"| `security_content_ctime(endDate)` | `security_content_ctime(startDate)`| table identity empStatus endDate startDate | `identify_new_user_accounts_filter` +[ESCU - Identify Systems Creating Remote Desktop Traffic - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search counts the numbers of times the system has generated remote desktop traffic. +action.escu.mappings = {} +action.escu.data_models = ["Network_Traffic"] +action.escu.eli5 = This search counts the numbers of times the system has generated remote desktop traffic. +action.escu.how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. +action.escu.known_false_positives = none +action.escu.creation_date = 2017-09-15 +action.escu.modification_date = 2017-09-15 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Identify Systems Creating Remote Desktop Traffic +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = [] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Identify Systems Creating Remote Desktop Traffic - Rule +action.correlationsearch.annotations = {} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['src'] +action.notable.param.rule_description = This search counts the numbers of times the system has generated remote desktop traffic. +action.notable.param.rule_title = Identify Systems Creating Remote Desktop Traffic +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.src | `drop_dm_object_name("All_Traffic")` | sort - count + +[ESCU - Identify Systems Receiving Remote Desktop Traffic - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search counts the numbers of times the system has created remote desktop traffic +action.escu.mappings = {} +action.escu.data_models = ["Network_Traffic"] +action.escu.eli5 = This search counts the numbers of times the system has created remote desktop traffic +action.escu.how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. +action.escu.known_false_positives = none +action.escu.creation_date = 2017-09-15 +action.escu.modification_date = 2017-09-15 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Identify Systems Receiving Remote Desktop Traffic +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = [] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Identify Systems Receiving Remote Desktop Traffic - Rule +action.correlationsearch.annotations = {} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search counts the numbers of times the system has created remote desktop traffic +action.notable.param.rule_title = Identify Systems Receiving Remote Desktop Traffic +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name("All_Traffic")` | sort - count + +[ESCU - Identify Systems Using Remote Desktop - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. +action.escu.mappings = {} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. +action.escu.how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity. +action.escu.known_false_positives = none +action.escu.creation_date = 2019-04-01 +action.escu.modification_date = 2019-04-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Identify Systems Using Remote Desktop +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = [] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Identify Systems Using Remote Desktop - Rule +action.correlationsearch.annotations = {} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. +action.notable.param.rule_title = Identify Systems Using Remote Desktop +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name | `drop_dm_object_name(Processes)` | sort - count + [ESCU - Kerberoasting spn request with RC4 encryption - Rule] action.escu = 0 action.escu.enabled = 1 @@ -12346,6 +13301,88 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name Registry.action | `drop_dm_object_name(Registry)` | `monitor_registry_keys_for_print_monitors_filter` +[ESCU - Monitor Successful Backups - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. +action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs. +action.escu.known_false_positives = none +action.escu.creation_date = 2017-09-12 +action.escu.modification_date = 2017-09-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Monitor Successful Backups +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Monitor Backup Solution"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Monitor Successful Backups - Rule +action.correlationsearch.annotations = {"analytic_story": ["Monitor Backup Solution"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. +action.notable.param.rule_title = Monitor Successful Backups +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `netbackup` "Disk/Partition backup completed successfully." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE + +[ESCU - Monitor Unsuccessful Backups - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. +action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs. +action.escu.known_false_positives = none +action.escu.creation_date = 2017-09-12 +action.escu.modification_date = 2017-09-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Monitor Unsuccessful Backups +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Monitor Backup Solution"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Monitor Unsuccessful Backups - Rule +action.correlationsearch.annotations = {"analytic_story": ["Monitor Backup Solution"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. +action.notable.param.rule_title = Monitor Unsuccessful Backups +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `netbackup` "An error occurred, failed to backup." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE + [ESCU - Monitor Web Traffic For Brand Abuse - Rule] action.escu = 0 action.escu.enabled = 1 @@ -14775,6 +15812,1218 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*" Processes.process = "*ignoreallfailures*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `prevent_automatic_repair_mode_using_bcdedit_filter` +[ESCU - Previously Seen AWS Cross Account Activity - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-06-04 +action.escu.modification_date = 2018-06-04 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS Cross Account Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen AWS Cross Account Activity - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS Cross Account Activity"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.notable.param.rule_title = Previously Seen AWS Cross Account Activity +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | stats count + +[ESCU - Previously Seen AWS Cross Account Activity - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.mappings = {} +action.escu.data_models = ["Authentication"] +action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-08-15 +action.escu.modification_date = 2020-08-15 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] +cron_schedule = 0 1 1 1,4,7,10 * +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen AWS Cross Account Activity - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity + +[ESCU - Previously Seen AWS Cross Account Activity - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.mappings = {} +action.escu.data_models = ["Authentication"] +action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-08-15 +action.escu.modification_date = 2020-08-15 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Update +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen AWS Cross Account Activity - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId | outputlookup previously_seen_aws_cross_account_activity + +[ESCU - Previously Seen AWS Provisioning Activity Sources - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-03-16 +action.escu.modification_date = 2018-03-16 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen AWS Provisioning Activity Sources +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen AWS Provisioning Activity Sources - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. +action.notable.param.rule_title = Previously Seen AWS Provisioning Activity Sources +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv | stats count + +[ESCU - Previously Seen AWS Regions - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-01-08 +action.escu.modification_date = 2018-01-08 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen AWS Regions +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen AWS Regions - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days +action.notable.param.rule_title = Previously Seen AWS Regions +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count + +[ESCU - Previously Seen Cloud API Calls Per User Role - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. +action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-09-03 +action.escu.modification_date = 2020-09-03 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud User Activities"] +cron_schedule = 0 1 1 1,4,7,10 * +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud API Calls Per User Role - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role + +[ESCU - Previously Seen Cloud API Calls Per User Role - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search updates the table of the first and last times seen for every user role and command combination. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search updates the table of the first and last times seen for every user role and command combination. +action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-09-03 +action.escu.modification_date = 2020-09-03 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Update +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud User Activities"] +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud API Calls Per User Role - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | table user, command, firstTimeSeen, lastTimeSeen | inputlookup previously_seen_cloud_api_calls_per_user_role append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role + +[ESCU - Previously Seen Cloud Compute Creations By User - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen users that have launched a cloud compute instance. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search builds a table of previously seen users that have launched a cloud compute instance. +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-08-15 +action.escu.modification_date = 2020-08-15 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Cryptomining"] +cron_schedule = 55 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Creations By User - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count + +[ESCU - Previously Seen Cloud Compute Creations By User - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen users that have launched a cloud compute instance. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search builds a table of previously seen users that have launched a cloud compute instance. +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-08-15 +action.escu.modification_date = 2020-08-15 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Update +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Cryptomining"] +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Creations By User - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), "-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user + +[ESCU - Previously Seen Cloud Compute Images - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen images used to launch cloud compute instances +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated +action.escu.known_false_positives = none +action.escu.creation_date = 2020-10-08 +action.escu.modification_date = 2020-10-08 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Cryptomining"] +cron_schedule = 0 1 1 1,4,7,10 * +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Images - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images + +[ESCU - Previously Seen Cloud Compute Images - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen images used to launch cloud compute instances +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs +action.escu.known_false_positives = none +action.escu.creation_date = 2020-08-12 +action.escu.modification_date = 2020-08-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Update +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Cryptomining"] +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Images - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images + +[ESCU - Previously Seen Cloud Compute Instance Types - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen cloud compute instance types +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search builds a table of previously seen cloud compute instance types +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-9-03 +action.escu.modification_date = 2020-9-03 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Cryptomining"] +cron_schedule = 0 1 1 1,4,7,10 * +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Instance Types - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types + +[ESCU - Previously Seen Cloud Compute Instance Types - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen cloud compute instance types +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search builds a table of previously seen cloud compute instance types +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs +action.escu.known_false_positives = none +action.escu.creation_date = 2020-9-03 +action.escu.modification_date = 2020-9-03 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Update +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Cryptomining"] +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Instance Types - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | inputlookup append=t previously_seen_cloud_compute_instance_types | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types + +[ESCU - Previously Seen Cloud Instance Modifications By User - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen users that have modified a cloud instance. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search builds a table of previously seen users that have modified a cloud instance. +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-07-29 +action.escu.modification_date = 2020-07-29 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] +cron_schedule = 0 1 1 1,4,7,10 * +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Instance Modifications By User - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user + +[ESCU - Previously Seen Cloud Instance Modifications By User - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search updates a table of previously seen Cloud Instance modifications that have been made by a user +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search updates a table of previously seen Cloud Instance modifications that have been made by a user +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-07-29 +action.escu.modification_date = 2020-07-29 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Update +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Instance Modifications By User - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user + +[ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. +action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-08-19 +action.escu.modification_date = 2020-08-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] +cron_schedule = 0 1 1 1,4,7,10 * +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources + +[ESCU - Previously Seen Cloud Provisioning Activity Sources - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. +action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-08-20 +action.escu.modification_date = 2020-08-20 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Update +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Provisioning Activity Sources - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen, City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources + +[ESCU - Previously Seen Cloud Regions - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-09-02 +action.escu.modification_date = 2020-09-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Cryptomining"] +cron_schedule = 0 1 1 1,4,7,10 * +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Regions - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions + +[ESCU - Previously Seen Cloud Regions - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days +action.escu.mappings = {} +action.escu.data_models = ["Change"] +action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-09-02 +action.escu.modification_date = 2020-09-02 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Update +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Cloud Cryptomining"] +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Cloud Regions - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count + +[ESCU - Previously Seen EC2 AMIs - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen AMIs used to launch EC2 instances +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search builds a table of previously seen AMIs used to launch EC2 instances +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-03-12 +action.escu.modification_date = 2018-03-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen EC2 AMIs +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS Cryptomining"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen EC2 AMIs - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search builds a table of previously seen AMIs used to launch EC2 instances +action.notable.param.rule_title = Previously Seen EC2 AMIs +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID | outputlookup previously_seen_ec2_amis.csv | stats count + +[ESCU - Previously Seen EC2 Instance Types - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen EC2 instance types +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search builds a table of previously seen EC2 instance types +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-03-08 +action.escu.modification_date = 2018-03-08 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen EC2 Instance Types +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS Cryptomining"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen EC2 Instance Types - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search builds a table of previously seen EC2 instance types +action.notable.param.rule_title = Previously Seen EC2 Instance Types +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time) as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv | stats count + +[ESCU - Previously Seen EC2 Launches By User - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-03-15 +action.escu.modification_date = 2018-03-15 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen EC2 Launches By User +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen EC2 Launches By User - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.notable.param.rule_title = Previously Seen EC2 Launches By User +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | stats count + +[ESCU - Previously Seen EC2 Modifications By User - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-04-05 +action.escu.modification_date = 2018-04-05 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen EC2 Modifications By User +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Unusual AWS EC2 Modifications"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen EC2 Modifications By User - Rule +action.correlationsearch.annotations = {"analytic_story": ["Unusual AWS EC2 Modifications"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user'] +action.notable.param.rule_description = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.notable.param.rule_title = Previously Seen EC2 Modifications By User +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count + +[ESCU - Previously Seen Running Windows Services - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This collects the services that have been started across your entire enterprise. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This collects the services that have been started across your entire enterprise. +action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-06-23 +action.escu.modification_date = 2020-06-23 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] +cron_schedule = 0 1 1 1,4,7,10 * +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Running Windows Services - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | outputlookup previously_seen_running_windows_services + +[ESCU - Previously Seen Running Windows Services - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. +action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-06-23 +action.escu.modification_date = 2020-06-23 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - Update +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] +cron_schedule = 55 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Running Windows Services - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by service | where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`") | outputlookup previously_seen_running_windows_services + +[ESCU - Previously Seen Users In CloudTrail - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. +action.escu.mappings = {} +action.escu.data_models = ["Authentication"] +action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-05-28 +action.escu.modification_date = 2020-05-28 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Users In CloudTrail - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins + +[ESCU - Previously Seen Users in CloudTrail - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. +action.escu.mappings = {} +action.escu.data_models = ["Authentication"] +action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-05-28 +action.escu.modification_date = 2020-05-28 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Users in CloudTrail - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] +cron_schedule = 0 1 1 1,4,7,10 * +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Users in CloudTrail - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count + +[ESCU - Previously Seen Zoom Child Processes - Initial - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. +action.escu.mappings = {} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. +action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-05-20 +action.escu.modification_date = 2020-05-20 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Initial +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Zoom Child Processes"] +cron_schedule = 0 1 1 1,4,7,10 * +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Zoom Child Processes - Initial - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Zoom Child Processes"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table dest, process_name, firstTimeSeen, lastTimeSeen | outputlookup zoom_first_time_child_process + +[ESCU - Previously Seen Zoom Child Processes - Update - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. +action.escu.mappings = {} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. +action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. +action.escu.known_false_positives = none +action.escu.creation_date = 2020-05-20 +action.escu.modification_date = 2020-05-20 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Update +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Zoom Child Processes"] +cron_schedule = 55 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously Seen Zoom Child Processes - Update - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Zoom Child Processes"]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name, dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") | outputlookup zoom_first_time_child_process + +[ESCU - Previously seen API call per user roles in CloudTrail - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-04-16 +action.escu.modification_date = 2018-04-16 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously seen API call per user roles in CloudTrail +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["AWS User Monitoring"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously seen API call per user roles in CloudTrail - Rule +action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. +action.notable.param.rule_title = Previously seen API call per user roles in CloudTrail +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole | stats earliest(_time) as earliest latest(_time) as latest by userName eventName | outputlookup previously_seen_api_calls_from_user_roles | stats count + +[ESCU - Previously seen S3 bucket access by remote IP - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-06-28 +action.escu.modification_date = 2018-06-28 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously seen S3 bucket access by remote IP +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious AWS S3 Activities"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously seen S3 bucket access by remote IP - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" +action.notable.param.rule_title = Previously seen S3 bucket access by remote IP +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `aws_s3_accesslogs` http_status=200 | stats earliest(_time) as earliest latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip | stats count + +[ESCU - Previously seen command line arguments - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. +action.escu.mappings = {} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. +action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. +action.escu.known_false_positives = none +action.escu.creation_date = 2019-03-01 +action.escu.modification_date = 2019-03-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously seen command line arguments +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously seen command line arguments - Rule +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. +action.notable.param.rule_title = Previously seen command line arguments +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)` + +[ESCU - Previously seen users in CloudTrail - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-04-30 +action.escu.modification_date = 2018-04-30 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Previously seen users in CloudTrail +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious AWS Login Activities"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Previously seen users in CloudTrail - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'src'] +action.notable.param.rule_description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.notable.param.rule_title = Previously seen users in CloudTrail +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail | stats count + [ESCU - Print Spooler Adding A Printer Driver - Rule] action.escu = 0 action.escu.enabled = 1 @@ -19103,6 +21352,46 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file` | `system_processes_run_from_unexpected_locations_filter` +[ESCU - Systems Ready for Spectre-Meltdown Windows Patch - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. +action.escu.how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-01-08 +action.escu.modification_date = 2018-01-08 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Systems Ready for Spectre-Meltdown Windows Patch +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Spectre And Meltdown Vulnerabilities"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Systems Ready for Spectre-Meltdown Windows Patch - Rule +action.correlationsearch.annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. +action.notable.param.rule_title = Systems Ready for Spectre-Meltdown Windows Patch +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry AND (All_Changes.object_path="HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat*") by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object, All_Changes.object_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("All_Changes")` + [ESCU - TOR Traffic - Rule] action.escu = 0 action.escu.enabled = 1 @@ -19596,6 +21885,47 @@ realtime_schedule = 0 is_visible = false search = `stream_http` | eval cs_content_type_length = len(cs_content_type) | where cs_content_type_length > 100 | table endtime src_ip dest_ip cs_content_type_length cs_content_type url | `unusually_long_content_type_length_filter` +[ESCU - Update previously seen users in CloudTrail - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. +action.escu.known_false_positives = none +action.escu.creation_date = 2018-04-30 +action.escu.modification_date = 2018-04-30 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Update previously seen users in CloudTrail +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious AWS Login Activities"] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Update previously seen users in CloudTrail - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'src'] +action.notable.param.rule_description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.notable.param.rule_title = Update previously seen users in CloudTrail +action.notable.param.security_domain = network +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region Country | inputlookup append=t previously_seen_users_console_logins_cloudtrail | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail + [ESCU - W3WP Spawning Shell - Rule] action.escu = 0 action.escu.enabled = 1 @@ -20488,6 +22818,86 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe" "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process" | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_security_account_manager_stopped_filter` +[ESCU - Windows Updates Install Failures - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. +action.escu.how_to_implement = You must be ingesting your Windows Update Logs +action.escu.known_false_positives = none +action.escu.creation_date = 2017-09-14 +action.escu.modification_date = 2017-09-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Updates Install Failures +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = [] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Updates Install Failures - Rule +action.correlationsearch.annotations = {} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. +action.notable.param.rule_title = Windows Updates Install Failures +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure by _time span=1d + +[ESCU - Windows Updates Install Successes - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. +action.escu.mappings = {} +action.escu.data_models = [] +action.escu.eli5 = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. +action.escu.how_to_implement = You must be ingesting your Windows Update Logs +action.escu.known_false_positives = none +action.escu.creation_date = 2017-09-14 +action.escu.modification_date = 2017-09-14 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Windows Updates Install Successes +action.escu.search_type = support +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = [] +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Windows Updates Install Successes - Rule +action.correlationsearch.annotations = {} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. +action.notable.param.rule_title = Windows Updates Install Successes +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed by _time span=1d + [ESCU - Windows connhost exe started forcefully - Rule] action.escu = 0 action.escu.enabled = 1 @@ -21017,1358 +23427,6 @@ search = `google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.Audi ### END ESCU DETECTIONS ### -### ESCU BASELINES ### - -[ESCU - Baseline Of Cloud Infrastructure API Calls Per User] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline Of Cloud Infrastructure API Calls Per User -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -action.escu.creation_date = 2020-09-07 -action.escu.modification_date = 2020-09-07 -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -action.escu.data_models = ["Change"] -cron_schedule = 0 2 * * 0 -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -disabled = true -is_visible = false -search = | tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true - -[ESCU - Baseline Of Cloud Instances Destroyed] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Destroyed -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. -action.escu.creation_date = 2020-08-25 -action.escu.modification_date = 2020-08-25 -action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"] -action.escu.data_models = ["Change"] -cron_schedule = 0 2 * * 0 -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. -action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -disabled = true -is_visible = false -search = | tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true - -[ESCU - Baseline Of Cloud Instances Launched] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Launched -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -action.escu.creation_date = 2020-08-14 -action.escu.modification_date = 2020-08-14 -action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] -action.escu.data_models = ["Change"] -cron_schedule = 0 2 * * 0 -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -disabled = true -is_visible = false -search = | tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true - -[ESCU - Baseline Of Cloud Security Group API Calls Per User] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline Of Cloud Security Group API Calls Per User -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. -action.escu.creation_date = 2020-09-07 -action.escu.modification_date = 2020-09-07 -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -action.escu.data_models = ["Change"] -cron_schedule = 0 2 * * 0 -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. -action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -disabled = true -is_visible = false -search = | tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend | eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true - -[ESCU - Baseline of API Calls per User ARN] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline of API Calls per User ARN -description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.creation_date = 2018-04-09 -action.escu.modification_date = 2018-04-09 -action.escu.analytic_story = ["AWS User Monitoring"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -disabled = true -is_visible = false -search = `cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count - -[ESCU - Baseline of Command Line Length - MLTK] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline of Command Line Length - MLTK -description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. -action.escu.creation_date = 2019-05-08 -action.escu.modification_date = 2019-05-08 -action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. -action.escu.how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel - -[ESCU - Baseline of DNS Query Length - MLTK] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline of DNS Query Length - MLTK -description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. -action.escu.creation_date = 2019-05-08 -action.escu.modification_date = 2019-05-08 -action.escu.analytic_story = ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"] -action.escu.data_models = ["Network_Resolution"] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. -action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel - -[ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. -action.escu.creation_date = 2019-11-14 -action.escu.modification_date = 2019-11-14 -action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ -In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -disabled = true -is_visible = false -search = `cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_launched by _time src_user | fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1 - -[ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. -action.escu.creation_date = 2019-11-14 -action.escu.modification_date = 2019-11-14 -action.escu.analytic_story = ["Suspicious AWS EC2 Activities"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ -In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -disabled = true -is_visible = false -search = `cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_terminated by _time src_user | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1 - -[ESCU - Baseline of Network ACL Activity by ARN] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline of Network ACL Activity by ARN -description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.creation_date = 2018-05-21 -action.escu.modification_date = 2018-05-21 -action.escu.analytic_story = ["AWS Network ACL Activity"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. -disabled = true -is_visible = false -search = `cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats count - -[ESCU - Baseline of S3 Bucket deletion activity by ARN] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline of S3 Bucket deletion activity by ARN -description = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.creation_date = 2018-07-17 -action.escu.modification_date = 2018-07-17 -action.escu.analytic_story = ["Suspicious AWS S3 Activities"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -disabled = true -is_visible = false -search = `cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count - -[ESCU - Baseline of SMB Traffic - MLTK] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline of SMB Traffic - MLTK -description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. -action.escu.creation_date = 2019-05-08 -action.escu.modification_date = 2019-05-08 -action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"] -action.escu.data_models = ["Network_Traffic"] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. -action.escu.how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction count by "HourOfDay,DayOfWeek" into smb_pdfmodel - -[ESCU - Baseline of Security Group Activity by ARN] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline of Security Group Activity by ARN -description = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.creation_date = 2018-04-17 -action.escu.modification_date = 2018-04-17 -action.escu.analytic_story = ["AWS User Monitoring"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. -disabled = true -is_visible = false -search = `cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats count - -[ESCU - Baseline of blocked outbound traffic from AWS] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Baseline of blocked outbound traffic from AWS -description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. -action.escu.creation_date = 2018-05-07 -action.escu.modification_date = 2018-05-07 -action.escu.analytic_story = ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. -disabled = true -is_visible = false -search = `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections | stats count - -[ESCU - Count of Unique IPs Connecting to Ports] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Count of Unique IPs Connecting to Ports -description = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. -action.escu.creation_date = 2017-09-13 -action.escu.modification_date = 2017-09-13 -action.escu.analytic_story = [] -action.escu.data_models = ["Network_Traffic"] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. -action.escu.how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` | sort - count - -[ESCU - Count of assets by category] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Count of assets by category -description = This search shows you every asset category you have and the assets that belong to those categories. -action.escu.creation_date = 2017-09-13 -action.escu.modification_date = 2017-09-13 -action.escu.analytic_story = ["Asset Tracking"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search shows you every asset category you have and the assets that belong to those categories. -action.escu.how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. -disabled = true -is_visible = false -search = | from datamodel Identity_Management.All_Assets | stats count values(nt_host) by category | sort -count - -[ESCU - Create a list of approved AWS service accounts] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Create a list of approved AWS service accounts -description = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. -action.escu.creation_date = 2018-12-03 -action.escu.modification_date = 2018-12-03 -action.escu.analytic_story = ["AWS User Monitoring"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. -disabled = true -is_visible = false -search = `cloudtrail` errorCode=success | rename userName as identity | search NOT [inputlookup identity_lookup_expanded | fields identity] | stats count by identity | table identity | outputlookup aws_service_accounts | stats count - -[ESCU - DNSTwist Domain Names] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - DNSTwist Domain Names -description = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. -action.escu.creation_date = 2018-10-08 -action.escu.modification_date = 2018-10-08 -action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. -action.escu.how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. -disabled = true -is_visible = false -search = | dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse="true" | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count - -[ESCU - Discover DNS records] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Discover DNS records -description = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup -action.escu.creation_date = 2019-02-14 -action.escu.modification_date = 2019-02-14 -action.escu.analytic_story = ["DNS Hijacking"] -action.escu.data_models = ["Network_Resolution"] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup -action.escu.how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation -disabled = true -is_visible = false -search = | inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, "\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query | where query!="unknown" | rex field=query "(?\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer | makemv delim=" " type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records - -[ESCU - Identify Systems Creating Remote Desktop Traffic] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Identify Systems Creating Remote Desktop Traffic -description = This search counts the numbers of times the system has generated remote desktop traffic. -action.escu.creation_date = 2017-09-15 -action.escu.modification_date = 2017-09-15 -action.escu.analytic_story = [] -action.escu.data_models = ["Network_Traffic"] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search counts the numbers of times the system has generated remote desktop traffic. -action.escu.how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.src | `drop_dm_object_name("All_Traffic")` | sort - count - -[ESCU - Identify Systems Receiving Remote Desktop Traffic] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Identify Systems Receiving Remote Desktop Traffic -description = This search counts the numbers of times the system has created remote desktop traffic -action.escu.creation_date = 2017-09-15 -action.escu.modification_date = 2017-09-15 -action.escu.analytic_story = [] -action.escu.data_models = ["Network_Traffic"] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search counts the numbers of times the system has created remote desktop traffic -action.escu.how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name("All_Traffic")` | sort - count - -[ESCU - Identify Systems Using Remote Desktop] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Identify Systems Using Remote Desktop -description = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. -action.escu.creation_date = 2019-04-01 -action.escu.modification_date = 2019-04-01 -action.escu.analytic_story = [] -action.escu.data_models = ["Endpoint"] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. -action.escu.how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name | `drop_dm_object_name(Processes)` | sort - count - -[ESCU - Monitor Successful Backups] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Monitor Successful Backups -description = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. -action.escu.creation_date = 2017-09-12 -action.escu.modification_date = 2017-09-12 -action.escu.analytic_story = ["Monitor Backup Solution"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. -action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs. -disabled = true -is_visible = false -search = `netbackup` "Disk/Partition backup completed successfully." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE - -[ESCU - Monitor Unsuccessful Backups] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Monitor Unsuccessful Backups -description = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. -action.escu.creation_date = 2017-09-12 -action.escu.modification_date = 2017-09-12 -action.escu.analytic_story = ["Monitor Backup Solution"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. -action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs. -disabled = true -is_visible = false -search = `netbackup` "An error occurred, failed to backup." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE - -[ESCU - Previously Seen AWS Cross Account Activity] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity -description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.creation_date = 2018-06-04 -action.escu.modification_date = 2018-06-04 -action.escu.analytic_story = ["AWS Cross Account Activity"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -disabled = true -is_visible = false -search = `cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | stats count - -[ESCU - Previously Seen AWS Cross Account Activity - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Initial -description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.creation_date = 2020-08-15 -action.escu.modification_date = 2020-08-15 -action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] -action.escu.data_models = ["Authentication"] -cron_schedule = 0 1 1 1,4,7,10 * -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity - -[ESCU - Previously Seen AWS Cross Account Activity - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Update -description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.creation_date = 2020-08-15 -action.escu.modification_date = 2020-08-15 -action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] -action.escu.data_models = ["Authentication"] -cron_schedule = 10 0 * * * -enableSched = 1 -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId | outputlookup previously_seen_aws_cross_account_activity - -[ESCU - Previously Seen AWS Provisioning Activity Sources] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen AWS Provisioning Activity Sources -description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. -action.escu.creation_date = 2018-03-16 -action.escu.modification_date = 2018-03-16 -action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -disabled = true -is_visible = false -search = `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv | stats count - -[ESCU - Previously Seen AWS Regions] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen AWS Regions -description = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days -action.escu.creation_date = 2018-01-08 -action.escu.modification_date = 2018-01-08 -action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -disabled = true -is_visible = false -search = `cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count - -[ESCU - Previously Seen Cloud API Calls Per User Role - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Initial -description = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. -action.escu.creation_date = 2020-09-03 -action.escu.modification_date = 2020-09-03 -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. -action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role - -[ESCU - Previously Seen Cloud API Calls Per User Role - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Update -description = This search updates the table of the first and last times seen for every user role and command combination. -action.escu.creation_date = 2020-09-03 -action.escu.modification_date = 2020-09-03 -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -action.escu.data_models = ["Change"] -cron_schedule = 10 0 * * * -enableSched = 1 -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search updates the table of the first and last times seen for every user role and command combination. -action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | table user, command, firstTimeSeen, lastTimeSeen | inputlookup previously_seen_cloud_api_calls_per_user_role append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role - -[ESCU - Previously Seen Cloud Compute Creations By User - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Initial -description = This search builds a table of previously seen users that have launched a cloud compute instance. -action.escu.creation_date = 2020-08-15 -action.escu.modification_date = 2020-08-15 -action.escu.analytic_story = ["Cloud Cryptomining"] -action.escu.data_models = ["Change"] -cron_schedule = 55 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen users that have launched a cloud compute instance. -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count - -[ESCU - Previously Seen Cloud Compute Creations By User - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Update -description = This search builds a table of previously seen users that have launched a cloud compute instance. -action.escu.creation_date = 2020-08-15 -action.escu.modification_date = 2020-08-15 -action.escu.analytic_story = ["Cloud Cryptomining"] -action.escu.data_models = ["Change"] -cron_schedule = 10 0 * * * -enableSched = 1 -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen users that have launched a cloud compute instance. -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), "-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user - -[ESCU - Previously Seen Cloud Compute Images - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Initial -description = This search builds a table of previously seen images used to launch cloud compute instances -action.escu.creation_date = 2020-10-08 -action.escu.modification_date = 2020-10-08 -action.escu.analytic_story = ["Cloud Cryptomining"] -action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images - -[ESCU - Previously Seen Cloud Compute Images - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Update -description = This search builds a table of previously seen images used to launch cloud compute instances -action.escu.creation_date = 2020-08-12 -action.escu.modification_date = 2020-08-12 -action.escu.analytic_story = ["Cloud Cryptomining"] -action.escu.data_models = ["Change"] -cron_schedule = 10 0 * * * -enableSched = 1 -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images - -[ESCU - Previously Seen Cloud Compute Instance Types - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Initial -description = This search builds a table of previously seen cloud compute instance types -action.escu.creation_date = 2020-9-03 -action.escu.modification_date = 2020-9-03 -action.escu.analytic_story = ["Cloud Cryptomining"] -action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen cloud compute instance types -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types - -[ESCU - Previously Seen Cloud Compute Instance Types - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Update -description = This search builds a table of previously seen cloud compute instance types -action.escu.creation_date = 2020-9-03 -action.escu.modification_date = 2020-9-03 -action.escu.analytic_story = ["Cloud Cryptomining"] -action.escu.data_models = ["Change"] -cron_schedule = 10 0 * * * -enableSched = 1 -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen cloud compute instance types -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | inputlookup append=t previously_seen_cloud_compute_instance_types | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types - -[ESCU - Previously Seen Cloud Instance Modifications By User - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Initial -description = This search builds a table of previously seen users that have modified a cloud instance. -action.escu.creation_date = 2020-07-29 -action.escu.modification_date = 2020-07-29 -action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] -action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen users that have modified a cloud instance. -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user - -[ESCU - Previously Seen Cloud Instance Modifications By User - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Update -description = This search updates a table of previously seen Cloud Instance modifications that have been made by a user -action.escu.creation_date = 2020-07-29 -action.escu.modification_date = 2020-07-29 -action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] -action.escu.data_models = ["Change"] -cron_schedule = 10 0 * * * -enableSched = 1 -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search updates a table of previously seen Cloud Instance modifications that have been made by a user -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user - -[ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial -description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. -action.escu.creation_date = 2020-08-19 -action.escu.modification_date = 2020-08-19 -action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] -action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. -action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources - -[ESCU - Previously Seen Cloud Provisioning Activity Sources - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Update -description = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. -action.escu.creation_date = 2020-08-20 -action.escu.modification_date = 2020-08-20 -action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] -action.escu.data_models = ["Change"] -cron_schedule = 10 0 * * * -enableSched = 1 -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. -action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen, City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources - -[ESCU - Previously Seen Cloud Regions - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Initial -description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -action.escu.creation_date = 2020-09-02 -action.escu.modification_date = 2020-09-02 -action.escu.analytic_story = ["Cloud Cryptomining"] -action.escu.data_models = ["Change"] -cron_schedule = 0 1 1 1,4,7,10 * -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions - -[ESCU - Previously Seen Cloud Regions - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Update -description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -action.escu.creation_date = 2020-09-02 -action.escu.modification_date = 2020-09-02 -action.escu.analytic_story = ["Cloud Cryptomining"] -action.escu.data_models = ["Change"] -cron_schedule = 10 0 * * * -enableSched = 1 -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count - -[ESCU - Previously Seen EC2 AMIs] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen EC2 AMIs -description = This search builds a table of previously seen AMIs used to launch EC2 instances -action.escu.creation_date = 2018-03-12 -action.escu.modification_date = 2018-03-12 -action.escu.analytic_story = ["AWS Cryptomining"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen AMIs used to launch EC2 instances -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -disabled = true -is_visible = false -search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID | outputlookup previously_seen_ec2_amis.csv | stats count - -[ESCU - Previously Seen EC2 Instance Types] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen EC2 Instance Types -description = This search builds a table of previously seen EC2 instance types -action.escu.creation_date = 2018-03-08 -action.escu.modification_date = 2018-03-08 -action.escu.analytic_story = ["AWS Cryptomining"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen EC2 instance types -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -disabled = true -is_visible = false -search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time) as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv | stats count - -[ESCU - Previously Seen EC2 Launches By User] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen EC2 Launches By User -description = This search builds a table of previously seen ARNs that have launched a EC2 instance. -action.escu.creation_date = 2018-03-15 -action.escu.modification_date = 2018-03-15 -action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen ARNs that have launched a EC2 instance. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -disabled = true -is_visible = false -search = `cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | stats count - -[ESCU - Previously Seen EC2 Modifications By User] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen EC2 Modifications By User -description = This search builds a table of previously seen ARNs that have launched a EC2 instance. -action.escu.creation_date = 2018-04-05 -action.escu.modification_date = 2018-04-05 -action.escu.analytic_story = ["Unusual AWS EC2 Modifications"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search builds a table of previously seen ARNs that have launched a EC2 instance. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -disabled = true -is_visible = false -search = `cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count - -[ESCU - Previously Seen Running Windows Services - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - Initial -description = This collects the services that have been started across your entire enterprise. -action.escu.creation_date = 2020-06-23 -action.escu.modification_date = 2020-06-23 -action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] -action.escu.data_models = [] -cron_schedule = 0 1 1 1,4,7,10 * -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This collects the services that have been started across your entire enterprise. -action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -disabled = true -is_visible = false -search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | outputlookup previously_seen_running_windows_services - -[ESCU - Previously Seen Running Windows Services - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - Update -description = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. -action.escu.creation_date = 2020-06-23 -action.escu.modification_date = 2020-06-23 -action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] -action.escu.data_models = [] -cron_schedule = 55 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. -action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -disabled = true -is_visible = false -search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by service | where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`") | outputlookup previously_seen_running_windows_services - -[ESCU - Previously Seen Users In CloudTrail - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update -description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -action.escu.creation_date = 2020-05-28 -action.escu.modification_date = 2020-05-28 -action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] -action.escu.data_models = ["Authentication"] -cron_schedule = 10 0 * * * -enableSched = 1 -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins - -[ESCU - Previously Seen Users in CloudTrail - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Users in CloudTrail - Initial -description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. -action.escu.creation_date = 2020-05-28 -action.escu.modification_date = 2020-05-28 -action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] -action.escu.data_models = ["Authentication"] -cron_schedule = 0 1 1 1,4,7,10 * -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -disabled = true -is_visible = false -search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count - -[ESCU - Previously Seen Zoom Child Processes - Initial] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Initial -description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. -action.escu.creation_date = 2020-05-20 -action.escu.modification_date = 2020-05-20 -action.escu.analytic_story = ["Suspicious Zoom Child Processes"] -action.escu.data_models = ["Endpoint"] -cron_schedule = 0 1 1 1,4,7,10 * -enableSched = 1 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. -action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table dest, process_name, firstTimeSeen, lastTimeSeen | outputlookup zoom_first_time_child_process - -[ESCU - Previously Seen Zoom Child Processes - Update] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Update -description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. -action.escu.creation_date = 2020-05-20 -action.escu.modification_date = 2020-05-20 -action.escu.analytic_story = ["Suspicious Zoom Child Processes"] -action.escu.data_models = ["Endpoint"] -cron_schedule = 55 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. -action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name, dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") | outputlookup zoom_first_time_child_process - -[ESCU - Previously seen API call per user roles in CloudTrail] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously seen API call per user roles in CloudTrail -description = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. -action.escu.creation_date = 2018-04-16 -action.escu.modification_date = 2018-04-16 -action.escu.analytic_story = ["AWS User Monitoring"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. -disabled = true -is_visible = false -search = `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole | stats earliest(_time) as earliest latest(_time) as latest by userName eventName | outputlookup previously_seen_api_calls_from_user_roles | stats count - -[ESCU - Previously seen S3 bucket access by remote IP] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously seen S3 bucket access by remote IP -description = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" -action.escu.creation_date = 2018-06-28 -action.escu.modification_date = 2018-06-28 -action.escu.analytic_story = ["Suspicious AWS S3 Activities"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. -disabled = true -is_visible = false -search = `aws_s3_accesslogs` http_status=200 | stats earliest(_time) as earliest latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip | stats count - -[ESCU - Previously seen command line arguments] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously seen command line arguments -description = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. -action.escu.creation_date = 2019-03-01 -action.escu.modification_date = 2019-03-01 -action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity"] -action.escu.data_models = ["Endpoint"] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. -action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)` - -[ESCU - Previously seen users in CloudTrail] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Previously seen users in CloudTrail -description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -action.escu.creation_date = 2018-04-30 -action.escu.modification_date = 2018-04-30 -action.escu.analytic_story = ["Suspicious AWS Login Activities"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. -disabled = true -is_visible = false -search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail | stats count - -[ESCU - Systems Ready for Spectre-Meltdown Windows Patch] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Systems Ready for Spectre-Meltdown Windows Patch -description = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. -action.escu.creation_date = 2018-01-08 -action.escu.modification_date = 2018-01-08 -action.escu.analytic_story = ["Spectre And Meltdown Vulnerabilities"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. -action.escu.how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry AND (All_Changes.object_path="HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat*") by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object, All_Changes.object_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("All_Changes")` - -[ESCU - Update previously seen users in CloudTrail] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Update previously seen users in CloudTrail -description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -action.escu.creation_date = 2018-04-30 -action.escu.modification_date = 2018-04-30 -action.escu.analytic_story = ["Suspicious AWS Login Activities"] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. -disabled = true -is_visible = false -search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region Country | inputlookup append=t previously_seen_users_console_logins_cloudtrail | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail - -[ESCU - Windows Updates Install Failures] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Windows Updates Install Failures -description = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. -action.escu.creation_date = 2017-09-14 -action.escu.modification_date = 2017-09-14 -action.escu.analytic_story = [] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. -action.escu.how_to_implement = You must be ingesting your Windows Update Logs -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure by _time span=1d - -[ESCU - Windows Updates Install Successes] -action.escu = 0 -action.escu.enabled = 1 -action.escu.search_type = support -action.escu.full_search_name = ESCU - Windows Updates Install Successes -description = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. -action.escu.creation_date = 2017-09-14 -action.escu.modification_date = 2017-09-14 -action.escu.analytic_story = [] -action.escu.data_models = [] -cron_schedule = 0 * * * * -enableSched = 1 -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -schedule_window = auto -action.escu.providing_technologies = [] -action.escu.eli5 = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. -action.escu.how_to_implement = You must be ingesting your Windows Update Logs -disabled = true -is_visible = false -search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed by _time span=1d - - - ### ESCU RESPONSE TASKS ### [ESCU - AWS Investigate Security Hub alerts by dest - Response Task] diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 66067e593d..8f520807e7 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-13T23:06:08 UTC +# On Date: 2021-07-20T14:08:27 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -11,6 +11,14 @@ external_type = kvstore # description = A collection that will contain the baseline information for number of AWS API calls per user fields_list = arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls +[attacker_tools] +filename = attacker_tools.csv +default_match = false +case_sensitive_match = false +# description = A list of tools used by attackers +match_type = WILDCARD(attacker_tool_names) +min_matches = 1 + [aws_service_accounts] filename = aws_service_accounts.csv # description = A lookup file that will contain AWS Service accounts diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index ae9e96c293..7c2e3888b5 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-13T23:06:08 UTC +# On Date: 2021-07-20T14:08:27 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -788,7 +788,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -1107,7 +1107,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1213,7 +1213,7 @@ version = 1 references = ["https://github.com/xmrig/xmrig", "https://www.getmonero.org/resources/user-guides/mine-to-pool.html", "https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"] maintainers = [{"company": "Rod Soto Splunk", "email": "-", "name": "Teoderick Contreras"}] spec_version = 3 -searches = ["ESCU - Deleting Of Net Users - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disabling Net User Account - Rule", "ESCU - Download Files Using Telegram - Rule", "ESCU - Enumerate Users Local Group Using Telegram - Rule", "ESCU - Excessive Attempt To Disable Services - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Icacls Deny Command - Rule", "ESCU - Modify ACL permission To Files Or Folder - Rule", "ESCU - Process Kill Base On File Path - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - XMRIG Driver Loaded - Rule"] +searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Deleting Of Net Users - Rule", "ESCU - Disable Windows App Hotkeys - Rule", "ESCU - Disabling Net User Account - Rule", "ESCU - Download Files Using Telegram - Rule", "ESCU - Enumerate Users Local Group Using Telegram - Rule", "ESCU - Excessive Attempt To Disable Services - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Cacls App - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of Taskkill - Rule", "ESCU - Executables Or Script Creation In Suspicious Path - Rule", "ESCU - Hide User Account From Sign-In Screen - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Icacls Deny Command - Rule", "ESCU - Modify ACL permission To Files Or Folder - Rule", "ESCU - Process Kill Base On File Path - Rule", "ESCU - Schtasks Run Task On Demand - Rule", "ESCU - Suspicious Driver Loaded Path - Rule", "ESCU - Suspicious Process File Path - Rule", "ESCU - XMRIG Driver Loaded - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) and hacking tools including Telegram as mean of command and control (C2) to download other files. Adversaries may leverage the resources of co-opted systems in order to solve resource intensive problems which may impact system and/or hosted service availability. One common purpose for Resource Hijacking is to validate transactions of cryptocurrency networks and earn virtual currency. Adversaries may consume enough system resources to negatively impact and/or cause affected machines to become unresponsive. (1) Servers and cloud-based (2) systems are common targets because of the high potential for available resources, but user endpoint systems may also be compromised and used for Resource Hijacking and cryptocurrency mining. narrative = XMRig is a high performance, open source, cross platform RandomX, KawPow, CryptoNight and AstroBWT unified CPU/GPU miner. This monero is seen in the wild on May 2017. @@ -1555,6 +1555,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087.00 known_false_positives = admin or power user may used this series of command. providing_technologies = [] +[savedsearch://ESCU - Add Prohibited Processes to Enterprise Security - Rule] +type = detection +asset_type = +confidence = medium +explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. +how_to_implement = This search should be run on each new install of ESCU. +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - Allow File And Printing Sharing In Firewall - Rule] type = detection asset_type = @@ -1655,6 +1665,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.00 known_false_positives = False positives may be present and filtering will need to occur by parent process or command line argument. It may be required to modify this query to an EDR product for more granular coverage. providing_technologies = [] +[savedsearch://ESCU - Attacker Tools On Endpoint - Rule] +type = detection +asset_type = Endpoint +confidence = medium +explanation = This search looks for execution of commonly used attacker tools on an endpoint. +how_to_implement = To successfully implement this search, you must be ingesting data that records process activity from your hosts to populate the endpoint data model in the processes node. This is typically populated via endpoint detection-and-response product, such as Carbon Black or endpoint data sources, such as Sysmon. The data used for this search is usually generated via logs that report process tracking in your Windows audit settings. +annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1595", "T1003"], "nist": ["ID.AM", "PR.DS"]} +known_false_positives = Some administrator activity can be potentially triggered, please add those users to the filter macro. +providing_technologies = [] + [savedsearch://ESCU - Attempt To Add Certificate To Untrusted Store - Rule] type = detection asset_type = Endpoint @@ -1715,6 +1735,152 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", known_false_positives = Limited false positives, however it may be required to filter based on parent process name or network connection. providing_technologies = [] +[savedsearch://ESCU - Baseline Of Cloud Infrastructure API Calls Per User - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline Of Cloud Instances Destroyed - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. +how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline Of Cloud Instances Launched - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline Of Cloud Security Group API Calls Per User - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. +how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline of API Calls per User ARN - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline of Command Line Length - MLTK - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. +how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline of DNS Query Length - MLTK - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. +how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ +In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ +In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline of Network ACL Activity by ARN - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline of S3 Bucket deletion activity by ARN - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline of SMB Traffic - MLTK - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. +how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline of Security Group Activity by ARN - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Baseline of blocked outbound traffic from AWS - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - Batch File Write to System32 - Rule] type = detection asset_type = Endpoint @@ -1996,6 +2162,26 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} known_false_positives = 3rd party tool may have commandline parameter that can trigger this detection. providing_technologies = [] +[savedsearch://ESCU - Count of Unique IPs Connecting to Ports - Rule] +type = detection +asset_type = +confidence = medium +explanation = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. +how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Count of assets by category - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search shows you every asset category you have and the assets that belong to those categories. +how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - Create Remote Thread into LSASS - Rule] type = detection asset_type = Windows @@ -2016,6 +2202,16 @@ annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": [" known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - Create a list of approved AWS service accounts - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - Create local admin accounts using net exe - Rule] type = detection asset_type = Endpoint @@ -2156,6 +2352,16 @@ annotations = {"cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phase known_false_positives = Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate. providing_technologies = [] +[savedsearch://ESCU - DNSTwist Domain Names - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. +how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - DSQuery Domain Discovery - Rule] type = detection asset_type = @@ -3355,6 +3561,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00 known_false_positives = admin may disable this application for non technical user. providing_technologies = [] +[savedsearch://ESCU - Discover DNS records - Rule] +type = detection +asset_type = +confidence = medium +explanation = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup +how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - Download Files Using Telegram - Rule] type = detection asset_type = @@ -3913,6 +4129,36 @@ annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR. known_false_positives = If the Identity_Management data model is not updated regularly, this search could give you false positive alerts. Please consider this and investigate appropriately. providing_technologies = [] +[savedsearch://ESCU - Identify Systems Creating Remote Desktop Traffic - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search counts the numbers of times the system has generated remote desktop traffic. +how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Identify Systems Receiving Remote Desktop Traffic - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search counts the numbers of times the system has created remote desktop traffic +how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Identify Systems Using Remote Desktop - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. +how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity. +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - Kerberoasting spn request with RC4 encryption - Rule] type = detection asset_type = Endpoint @@ -4263,6 +4509,26 @@ annotations = {"cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Ob known_false_positives = You will encounter noise from legitimate print-monitor registry entries. providing_technologies = [] +[savedsearch://ESCU - Monitor Successful Backups - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. +how_to_implement = To successfully implement this search you must be ingesting your backup logs. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Monitor Unsuccessful Backups - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. +how_to_implement = To successfully implement this search you must be ingesting your backup logs. +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - Monitor Web Traffic For Brand Abuse - Rule] type = detection asset_type = Endpoint @@ -4869,6 +5135,336 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = Administrators may modify the boot configuration ignore failure during testing and debugging. providing_technologies = [] +[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen AWS Provisioning Activity Sources - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen AWS Regions - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. +how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search updates the table of the first and last times seen for every user role and command combination. +how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen users that have launched a cloud compute instance. +how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen users that have launched a cloud compute instance. +how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Compute Images - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen images used to launch cloud compute instances +how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Compute Images - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen images used to launch cloud compute instances +how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen cloud compute instance types +how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen cloud compute instance types +how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen users that have modified a cloud instance. +how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search updates a table of previously seen Cloud Instance modifications that have been made by a user +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. +how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. +how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Regions - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days +how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Cloud Regions - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days +how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen EC2 AMIs - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen AMIs used to launch EC2 instances +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen EC2 Instance Types - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen EC2 instance types +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen EC2 Launches By User - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen ARNs that have launched a EC2 instance. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen EC2 Modifications By User - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search builds a table of previously seen ARNs that have launched a EC2 instance. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Running Windows Services - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This collects the services that have been started across your entire enterprise. +how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Running Windows Services - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. +how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Users In CloudTrail - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Users in CloudTrail - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. +how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Zoom Child Processes - Initial - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. +how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously Seen Zoom Child Processes - Update - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. +how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously seen API call per user roles in CloudTrail - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously seen S3 bucket access by remote IP - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously seen command line arguments - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. +how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Previously seen users in CloudTrail - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - Print Spooler Adding A Printer Driver - Rule] type = detection asset_type = @@ -5925,6 +6521,16 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = This detection may require tuning based on third party applications utilizing native Windows binaries in non-standard paths. providing_technologies = [] +[savedsearch://ESCU - Systems Ready for Spectre-Meltdown Windows Patch - Rule] +type = detection +asset_type = +confidence = medium +explanation = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. +how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - TOR Traffic - Rule] type = detection asset_type = Endpoint @@ -6047,6 +6653,16 @@ annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18", "CIS 12"], "kill_chain_phas known_false_positives = Very few legitimate Content-Type fields will have a length greater than 100 characters. providing_technologies = [] +[savedsearch://ESCU - Update previously seen users in CloudTrail - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - W3WP Spawning Shell - Rule] type = detection asset_type = @@ -6270,6 +6886,26 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = SAM is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. AlthoughNo false positives have been identified. providing_technologies = [] +[savedsearch://ESCU - Windows Updates Install Failures - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. +how_to_implement = You must be ingesting your Windows Update Logs +annotations = {} +known_false_positives = none +providing_technologies = [] + +[savedsearch://ESCU - Windows Updates Install Successes - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. +how_to_implement = You must be ingesting your Windows Update Logs +annotations = {} +known_false_positives = none +providing_technologies = [] + [savedsearch://ESCU - Windows connhost exe started forcefully - Rule] type = detection asset_type = Endpoint @@ -6809,437 +7445,4 @@ latest_time_offset = 0 ### END RESPONSE TASKS ### ### BASELINES ### -[savedsearch://ESCU - Baseline Of Cloud Infrastructure API Calls Per User] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Instances Destroyed] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Instances Launched] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline Of Cloud Security Group API Calls Per User] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of API Calls per User ARN] -type = support -explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of Command Line Length - MLTK] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. -how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of DNS Query Length - MLTK] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. -how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ -In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ -In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of Network ACL Activity by ARN] -type = support -explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of S3 Bucket deletion activity by ARN] -type = support -explanation = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of SMB Traffic - MLTK] -type = support -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. -how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of Security Group Activity by ARN] -type = support -explanation = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Baseline of blocked outbound traffic from AWS] -type = support -explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Count of Unique IPs Connecting to Ports] -type = support -explanation = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. -how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Count of assets by category] -type = support -explanation = This search shows you every asset category you have and the assets that belong to those categories. -how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Create a list of approved AWS service accounts] -type = support -explanation = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - DNSTwist Domain Names] -type = support -explanation = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. -how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Discover DNS records] -type = support -explanation = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup -how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Identify Systems Creating Remote Desktop Traffic] -type = support -explanation = This search counts the numbers of times the system has generated remote desktop traffic. -how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Identify Systems Receiving Remote Desktop Traffic] -type = support -explanation = This search counts the numbers of times the system has created remote desktop traffic -how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Identify Systems Using Remote Desktop] -type = support -explanation = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. -how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Monitor Successful Backups] -type = support -explanation = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. -how_to_implement = To successfully implement this search you must be ingesting your backup logs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Monitor Unsuccessful Backups] -type = support -explanation = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. -how_to_implement = To successfully implement this search you must be ingesting your backup logs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity] -type = support -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Initial] -type = support -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Update] -type = support -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Provisioning Activity Sources] -type = support -explanation = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen AWS Regions] -type = support -explanation = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Initial] -type = support -explanation = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Update] -type = support -explanation = This search updates the table of the first and last times seen for every user role and command combination. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Initial] -type = support -explanation = This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Update] -type = support -explanation = This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Images - Initial] -type = support -explanation = This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Images - Update] -type = support -explanation = This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Initial] -type = support -explanation = This search builds a table of previously seen cloud compute instance types -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Update] -type = support -explanation = This search builds a table of previously seen cloud compute instance types -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Initial] -type = support -explanation = This search builds a table of previously seen users that have modified a cloud instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Update] -type = support -explanation = This search updates a table of previously seen Cloud Instance modifications that have been made by a user -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial] -type = support -explanation = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Update] -type = support -explanation = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Regions - Initial] -type = support -explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Cloud Regions - Update] -type = support -explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen EC2 AMIs] -type = support -explanation = This search builds a table of previously seen AMIs used to launch EC2 instances -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen EC2 Instance Types] -type = support -explanation = This search builds a table of previously seen EC2 instance types -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen EC2 Launches By User] -type = support -explanation = This search builds a table of previously seen ARNs that have launched a EC2 instance. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen EC2 Modifications By User] -type = support -explanation = This search builds a table of previously seen ARNs that have launched a EC2 instance. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Running Windows Services - Initial] -type = support -explanation = This collects the services that have been started across your entire enterprise. -how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Running Windows Services - Update] -type = support -explanation = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. -how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Users In CloudTrail - Update] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Users in CloudTrail - Initial] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Zoom Child Processes - Initial] -type = support -explanation = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. -how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously Seen Zoom Child Processes - Update] -type = support -explanation = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. -how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously seen API call per user roles in CloudTrail] -type = support -explanation = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously seen S3 bucket access by remote IP] -type = support -explanation = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously seen command line arguments] -type = support -explanation = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. -how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Previously seen users in CloudTrail] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Systems Ready for Spectre-Meltdown Windows Patch] -type = support -explanation = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. -how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Update previously seen users in CloudTrail] -type = support -explanation = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Windows Updates Install Failures] -type = support -explanation = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. -how_to_implement = You must be ingesting your Windows Update Logs -known_false_positives = not defined -providing_technologies = none - -[savedsearch://ESCU - Windows Updates Install Successes] -type = support -explanation = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. -how_to_implement = You must be ingesting your Windows Update Logs -known_false_positives = not defined -providing_technologies = none - ### END ESCU BASELINES ### \ No newline at end of file diff --git a/dist/escu/lookups/attacker_tools.csv b/dist/escu/lookups/attacker_tools.csv new file mode 100644 index 0000000000..1a579552b6 --- /dev/null +++ b/dist/escu/lookups/attacker_tools.csv @@ -0,0 +1,26 @@ +attacker_tool_names,description +remcom.exe,This process is an open source replacement to psexec and is not typically seen in an enterprise environment. +pwdump.exe,This process is associated with a tool used to dump password hashes on a Windows system. +pwdump2.exe,This process is associated with a tool used to dump password hashes on a Windows system. +nc.exe,This process is an open source tool used for network communications. +wce.exe,This process is associated with a tool used to dump hashes and execute pass-the-hash and pass-the-ticket attacks. +cain.exe,This process is associated with a tool used to collect user credentials and execute attacks. +nmap.exe,This process is an open source network mapping tool used to identify hosts and listening services on a network. +kidlogger.exe,This process is associated with a tool used to collect keyboard input on a host. +isass.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process. +svch0st.exe,This process name is used by attackers to hide in plain sight and look like a legitimate Windows system process. +at.exe,This process is used to schedule other processes to run. schtasks.exe should be used instead as it provides more flexibility. +getmail.exe,This process is seen to be used by attackers to extract email files from host machines. +ntdll.exe,This process was identified as malicious by DHS Alert TA18-074A. +netpass.exe,This process was identified as malicious by DHS Alert TA18-201A and attackers use this tool to recover all network passwords stored on your system for the current logged-on user. +WebBrowserPassView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers as a password recovery tool that reveals the passwords stored in Web Browsers. +OutlookAddressBookView.exe,This process was identified as malicious by DHS Alert TA18-201A and is used by attackers to steal the details of all recipients stored in the address books of Microsoft Outlook. +mailpv.exe,This process was identified by DHS Alert TA18-201A and attackers use this tool is a password-recovery tool that reveals the passwords and other account details from various email clients. +NLBrute.exe,A RDP brute force tool found in botnets for further expansion and and acquisition of targets. This process was identified in the SamSam Ransomware Campaign and attackers use this tool to brute force RDP instances with a range of commonly used passwords. +selfdel.exe,This executable was delivered in the SamSam Ransomware Campain and the attackers levereged this binary to delete its malicilous activities. +masscan.exe,This executable was delivered in the XMRig Crypto Miner +Massscan_GUI.exe,This executable was delivered in the XMRig Crypto Miner +KPortScan3.exe,This executable was delivered in the XMRig Crypto Miner and is commonly used by attackers to scan the internet +NLAChecker.exe,A scanner tool that checks for Windows hosts for Network Level Authentication. This tool allows attackers to detect Windows Servers with RDP without NLA enabled which facilitates the use of brute force non microsoft rdp tools or exploits +ns.exe,A commonly used tool used by attackers to scan and map file shares +SilverBullet.exe,Malware was discovered in our monitoring of honey pots that abuses this open source software for scanning and connecting to hosts. \ No newline at end of file diff --git a/dist/escu/lookups/mitre_enrichment.csv b/dist/escu/lookups/mitre_enrichment.csv index 0717cbc6ba..b7c4ecb5a6 100644 --- a/dist/escu/lookups/mitre_enrichment.csv +++ b/dist/escu/lookups/mitre_enrichment.csv @@ -1,59 +1,182 @@ mitre_id,technique,tactics,groups -T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,no +T1553.006,Code Signing Policy Modification,Defense Evasion,Turla|APT39 +T1614,System Location Discovery,Discovery,no +T1613,Container and Resource Discovery,Discovery,no +T1552.007,Container API,Credential Access,no +T1612,Build Image on Host,Defense Evasion,no +T1611,Escape to Host,Privilege Escalation,no +T1204.003,Malicious Image,Execution,no +T1053.007,Container Orchestration Job,Execution|Persistence|Privilege Escalation,no +T1610,Deploy Container,Defense Evasion|Execution,no +T1609,Container Administration Command,Execution,no +T1608.005,Link Target,Resource Development,Silent Librarian +T1608.004,Drive-by Target,Resource Development,APT32|Threat Group-3390 +T1608.003,Install Digital Certificate,Resource Development,no +T1608.002,Upload Tool,Resource Development,Threat Group-3390 +T1608.001,Upload Malware,Resource Development,APT32 +T1608,Stage Capabilities,Resource Development,no +T1016.001,Internet Connection Discovery,Discovery,APT29|UNC2452|Turla +T1553.005,Mark-of-the-Web Bypass,Defense Evasion,TA505 +T1555.005,Password Managers,Credential Access,Fox Kitten|Operation Wocao +T1484.002,Domain Trust Modification,Defense Evasion|Privilege Escalation,APT29|UNC2452 +T1484.001,Group Policy Modification,Defense Evasion|Privilege Escalation,Indrik Spider +T1547.014,Active Setup,Persistence|Privilege Escalation,no +T1606.002,SAML Tokens,Credential Access,APT29|UNC2452 +T1606.001,Web Cookies,Credential Access,APT29|UNC2452 +T1606,Forge Web Credentials,Credential Access,no +T1555.004,Windows Credential Manager,Credential Access,Stealth Falcon|OilRig|Turla +T1059.008,Network Device CLI,Execution,no +T1602.002,Network Device Configuration Dump,Collection,no +T1542.005,TFTP Boot,Defense Evasion|Persistence,no +T1542.004,ROMMONkit,Defense Evasion|Persistence,no +T1602.001,SNMP (MIB Dump),Collection,no +T1602,Data from Configuration Repository,Collection,no +T1601.002,Downgrade System Image,Defense Evasion,no +T1601.001,Patch System Image,Defense Evasion,no +T1601,Modify System Image,Defense Evasion,no +T1600.002,Disable Crypto Hardware,Defense Evasion,no +T1600.001,Reduce Key Space,Defense Evasion,no +T1600,Weaken Encryption,Defense Evasion,no +T1556.004,Network Device Authentication,Credential Access|Defense Evasion|Persistence,no +T1599.001,Network Address Translation Traversal,Defense Evasion,no +T1599,Network Boundary Bridging,Defense Evasion,no +T1020.001,Traffic Duplication,Exfiltration,no +T1557.002,ARP Cache Poisoning,Credential Access|Collection,Cleaver +T1588.006,Vulnerabilities,Resource Development,Sandworm Team +T1053.006,Systemd Timers,Execution|Persistence|Privilege Escalation,no +T1562.008,Disable Cloud Logs,Defense Evasion,no +T1547.012,Print Processors,Persistence|Privilege Escalation,no +T1598.003,Spearphishing Link,Reconnaissance,Silent Librarian|Sidewinder|Sandworm Team|APT32|Kimsuky +T1598.002,Spearphishing Attachment,Reconnaissance,Sidewinder +T1598.001,Spearphishing Service,Reconnaissance,no +T1598,Phishing for Information,Reconnaissance,ZIRCONIUM|APT28 +T1597.002,Purchase Technical Data,Reconnaissance,no +T1597.001,Threat Intel Vendors,Reconnaissance,no +T1597,Search Closed Sources,Reconnaissance,no +T1596.005,Scan Databases,Reconnaissance,no +T1596.004,CDNs,Reconnaissance,no +T1596.003,Digital Certificates,Reconnaissance,no +T1596.001,DNS/Passive DNS,Reconnaissance,no +T1596.002,WHOIS,Reconnaissance,no +T1596,Search Open Technical Databases,Reconnaissance,no +T1595.002,Vulnerability Scanning,Reconnaissance,Volatile Cedar|APT28|Sandworm Team +T1595.001,Scanning IP Blocks,Reconnaissance,no +T1595,Active Scanning,Reconnaissance,no +T1594,Search Victim-Owned Websites,Reconnaissance,Silent Librarian|Sandworm Team +T1593.002,Search Engines,Reconnaissance,no +T1593.001,Social Media,Reconnaissance,no +T1593,Search Open Websites/Domains,Reconnaissance,Sandworm Team +T1592.004,Client Configurations,Reconnaissance,HAFNIUM +T1592.003,Firmware,Reconnaissance,no +T1592.002,Software,Reconnaissance,Sandworm Team +T1592.001,Hardware,Reconnaissance,no +T1592,Gather Victim Host Information,Reconnaissance,no +T1591.004,Identify Roles,Reconnaissance,no +T1591.003,Identify Business Tempo,Reconnaissance,no +T1591.001,Determine Physical Locations,Reconnaissance,no +T1591.002,Business Relationships,Reconnaissance,Sandworm Team +T1591,Gather Victim Org Information,Reconnaissance,no +T1590.006,Network Security Appliances,Reconnaissance,no +T1590.005,IP Addresses,Reconnaissance,HAFNIUM +T1590.004,Network Topology,Reconnaissance,no +T1590.003,Network Trust Dependencies,Reconnaissance,no +T1590.002,DNS,Reconnaissance,no +T1590.001,Domain Properties,Reconnaissance,Sandworm Team +T1590,Gather Victim Network Information,Reconnaissance,HAFNIUM +T1589.003,Employee Names,Reconnaissance,Silent Librarian|Sandworm Team +T1589.002,Email Addresses,Reconnaissance,TA551|MuddyWater|HAFNIUM|APT32|Silent Librarian|Sandworm Team +T1589.001,Credentials,Reconnaissance,APT28|Magic Hound|Chimera +T1589,Gather Victim Identity Information,Reconnaissance,APT32 +T1588.005,Exploits,Resource Development,no +T1588.004,Digital Certificates,Resource Development,Lazarus Group|Silent Librarian +T1588.003,Code Signing Certificates,Resource Development,Wizard Spider +T1588.002,Tool,Resource Development,MuddyWater|Silent Librarian|GALLIUM|Sandworm Team +T1588.001,Malware,Resource Development,Turla|APT1 +T1588,Obtain Capabilities,Resource Development,no +T1587.004,Exploits,Resource Development,no +T1587.003,Digital Certificates,Resource Development,APT29|PROMETHIUM +T1587.002,Code Signing Certificates,Resource Development,PROMETHIUM|Patchwork +T1587.001,Malware,Resource Development,APT29|Lazarus Group|UNC2452|Sandworm Team|Turla|FIN7|Night Dragon|Cleaver +T1587,Develop Capabilities,Resource Development,Kimsuky +T1586.002,Email Accounts,Resource Development,Magic Hound|Kimsuky +T1586.001,Social Media Accounts,Resource Development,no +T1586,Compromise Accounts,Resource Development,no +T1585.002,Email Accounts,Resource Development,Magic Hound|Silent Librarian|Sandworm Team|APT1 +T1585.001,Social Media Accounts,Resource Development,Fox Kitten|Sandworm Team|APT32|Cleaver +T1585,Establish Accounts,Resource Development,Fox Kitten|APT17 +T1584.006,Web Services,Resource Development,Turla +T1584.005,Botnet,Resource Development,no +T1584.004,Server,Resource Development,Indrik Spider|Turla|APT16 +T1584.003,Virtual Private Server,Resource Development,Turla +T1584.002,DNS Server,Resource Development,no +T1584.001,Domains,Resource Development,APT29|UNC2452|APT1 +T1583.006,Web Services,Resource Development,ZIRCONIUM|MuddyWater|HAFNIUM|Lazarus Group|Turla|APT32|APT17|APT29 +T1583.005,Botnet,Resource Development,no +T1583.004,Server,Resource Development,GALLIUM|Sandworm Team +T1583.003,Virtual Private Server,Resource Development,HAFNIUM|TEMP.Veles +T1583.002,DNS Server,Resource Development,no +T1584,Compromise Infrastructure,Resource Development,no +T1583.001,Domains,Resource Development,APT29|Mustang Panda|ZIRCONIUM|UNC2452|Lazarus Group|Silent Librarian|menuPass|Sandworm Team|APT32|Kimsuky|APT1|APT28 +T1583,Acquire Infrastructure,Resource Development,no +T1564.007,VBA Stomping,Defense Evasion,no +T1558.004,AS-REP Roasting,Credential Access,no +T1580,Cloud Infrastructure Discovery,Discovery,no +T1218.012,Verclsid,Defense Evasion,no +T1205.001,Port Knocking,Defense Evasion|Persistence|Command And Control,PROMETHIUM T1564.006,Run Virtual Instance,Defense Evasion,no T1564.005,Hidden File System,Defense Evasion,Strider|Equation -T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion,no +T1556.003,Pluggable Authentication Modules,Credential Access|Defense Evasion|Persistence,no T1574.012,COR_PROFILER,Persistence|Privilege Escalation|Defense Evasion,Blue Mockingbird T1562.007,Disable or Modify Cloud Firewall,Defense Evasion,no T1098.004,SSH Authorized Keys,Persistence,no T1480.001,Environmental Keying,Defense Evasion,APT41|Equation -T1059.007,JavaScript/JScript,Execution,APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer +T1059.007,JavaScript,Execution,MuddyWater|Turla|Higaisa|Sidewinder|Evilnum|Kimsuky|FIN6|APT32|FIN7|Cobalt Group|Molerats|TA505|Silence|Leafminer T1578.004,Revert Cloud Instance,Defense Evasion,no T1578.003,Delete Cloud Instance,Defense Evasion,no T1578.001,Create Snapshot,Defense Evasion,no T1578.002,Create Cloud Instance,Defense Evasion,no T1127.001,MSBuild,Defense Evasion,Frankenstein -T1027.005,Indicator Removal from Tools,Defense Evasion,Soft Cell|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda +T1027.005,Indicator Removal from Tools,Defense Evasion,Operation Wocao|GALLIUM|TEMP.Veles|Patchwork|APT3|Turla|OilRig|Deep Panda T1562.006,Indicator Blocking,Defense Evasion,no -T1573.002,Asymmetric Cryptography,Command And Control,Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 -T1573.001,Symmetric Cryptography,Command And Control,Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group +T1573.002,Asymmetric Cryptography,Command And Control,Operation Wocao|Tropic Trooper|Cobalt Group|OilRig|FIN8|FIN6 +T1573.001,Symmetric Cryptography,Command And Control,Mustang Panda|Darkhotel|ZIRCONIUM|Higaisa|Frankenstein|Inception|APT28|APT33|BRONZE BUTLER|Stealth Falcon|Lazarus Group T1573,Encrypted Channel,Command And Control,Tropic Trooper T1027.004,Compile After Delivery,Defense Evasion,Gamaredon Group|Rocke|MuddyWater T1574.004,Dylib Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1546.015,Component Object Model Hijacking,Privilege Escalation|Persistence,APT28 -T1071.004,DNS,Command And Control,APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 -T1071.003,Mail Protocols,Command And Control,APT32|SilverTerrier|APT28 -T1071.002,File Transfer Protocols,Command And Control,APT41|SilverTerrier|Machete|Honeybee -T1071.001,Web Protocols,Command And Control,Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|Machete|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|Cobalt Group|APT19|Threat Group-3390|Rancor|Orangeworm|APT37|Ke3chang|Dark Caracal|Turla|Lazarus Group|BRONZE BUTLER|APT32|OilRig|Magic Hound|Gamaredon Group|Stealth Falcon -T1572,Protocol Tunneling,Command And Control,OilRig|Cobalt Group|FIN6 -T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group -T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,no +T1071.004,DNS,Command And Control,Chimera|APT39|Tropic Trooper|OilRig|Ke3chang|Cobalt Group|APT18|APT41|FIN7 +T1071.003,Mail Protocols,Command And Control,Turla|Kimsuky|APT32|SilverTerrier|APT28 +T1071.002,File Transfer Protocols,Command And Control,Kimsuky|APT41|SilverTerrier|Honeybee +T1071.001,Web Protocols,Command And Control,APT29|Mustang Panda|Windshift|TA551|Higaisa|HAFNIUM|Sidewinder|Chimera|UNC2452|Sandworm Team|TA505|Rocke|APT39|Tropic Trooper|MuddyWater|Wizard Spider|Inception|APT41|SilverTerrier|APT28|WIRTE|APT33|FIN4|Night Dragon|APT18|APT38|APT19|Cobalt Group|Rancor|Orangeworm|Threat Group-3390|Ke3chang|Turla|APT37|Dark Caracal|Lazarus Group|BRONZE BUTLER|APT32|Magic Hound|OilRig|Gamaredon Group|Stealth Falcon +T1572,Protocol Tunneling,Command And Control,Chimera|Fox Kitten|OilRig|Cobalt Group|FIN6 +T1048.003,Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol,Exfiltration,Wizard Spider|FIN6|APT32|APT33|Thrip|FIN8|OilRig|Lazarus Group +T1048.002,Exfiltration Over Asymmetric Encrypted Non-C2 Protocol,Exfiltration,APT29|UNC2452 T1048.001,Exfiltration Over Symmetric Encrypted Non-C2 Protocol,Exfiltration,no -T1001.003,Protocol Impersonation,Command And Control,Lazarus Group -T1001.002,Steganography,Command And Control,Axiom +T1001.003,Protocol Impersonation,Command And Control,Higaisa|Lazarus Group +T1001.002,Steganography,Command And Control,APT29|Axiom T1001.001,Junk Data,Command And Control,APT28 T1132.002,Non-Standard Encoding,Command And Control,no -T1132.001,Standard Encoding,Command And Control,Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork +T1132.001,Standard Encoding,Command And Control,HAFNIUM|TA551|Sandworm Team|Tropic Trooper|MuddyWater|APT33|APT19|Lazarus Group|BRONZE BUTLER|Patchwork T1090.004,Domain Fronting,Command And Control,APT29 -T1090.003,Multi-hop Proxy,Command And Control,Inception|FIN4|APT29 -T1090.002,External Proxy,Command And Control,APT39|Silence|Soft Cell|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 -T1090.001,Internal Proxy,Command And Control,APT39|Strider +T1090.003,Multi-hop Proxy,Command And Control,APT28|Operation Wocao|Inception|FIN4|APT29 +T1090.002,External Proxy,Command And Control,APT39|Silence|GALLIUM|MuddyWater|APT3|FIN5|Lazarus Group|menuPass|APT28 +T1090.001,Internal Proxy,Command And Control,APT29|Higaisa|UNC2452|Operation Wocao|APT39|Strider T1102.003,One-Way Communication,Command And Control,Leviathan -T1102.002,Bidirectional Communication,Command And Control,Sandworm Team|APT39|APT12|Turla|FIN7|APT37|Magic Hound|Carbanak +T1102.002,Bidirectional Communication,Command And Control,ZIRCONIUM|MuddyWater|APT28|APT29|Sandworm Team|APT39|APT12|FIN7|Turla|APT37|Magic Hound|Carbanak T1102.001,Dead Drop Resolver,Command And Control,Rocke|APT41|BRONZE BUTLER|RTM|Patchwork T1571,Non-Standard Port,Command And Control,Sandworm Team|Rocke|DarkVishnya|Silence|APT-C-36|Magic Hound|APT33|APT32|TEMP.Veles|Lazarus Group|FIN7 -T1074.002,Remote Data Staging,Collection,Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 -T1074.001,Local Data Staging,Collection,Machete|Soft Cell|TEMP.Veles|Patchwork|Dragonfly 2.0|Honeybee|Leviathan|APT3|FIN5|menuPass|FIN6|Lazarus Group|Threat Group-3390|APT28 +T1074.002,Remote Data Staging,Collection,APT29|Chimera|UNC2452|Threat Group-3390|menuPass|FIN6|Night Dragon|FIN8 +T1074.001,Local Data Staging,Collection,Mustang Panda|Sidewinder|Chimera|Kimsuky|APT39|Operation Wocao|GALLIUM|TEMP.Veles|Honeybee|Patchwork|Dragonfly 2.0|Leviathan|APT3|FIN5|menuPass|Lazarus Group|Threat Group-3390|APT28 T1078.004,Cloud Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT33 T1564.004,NTFS File Attributes,Defense Evasion,APT32 -T1564.003,Hidden Window,Defense Evasion,Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound -T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Tropic Trooper|FIN10|Stolen Pencil|APT32 -T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,TA505|APT3|Threat Group-1314 +T1564.003,Hidden Window,Defense Evasion,Higaisa|Gorgon Group|Deep Panda|DarkHydrus|CopyKittens|APT19|APT32|APT28|APT3|Magic Hound +T1078.003,Local Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,HAFNIUM|Turla|Operation Wocao|PROMETHIUM|Tropic Trooper|FIN10|Stolen Pencil|APT32 +T1078.002,Domain Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Indrik Spider|Chimera|Operation Wocao|Sandworm Team|Wizard Spider|APT29|TA505|APT3|Threat Group-1314 T1078.001,Default Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,no T1564.002,Hidden Users,Defense Evasion,no -T1574.006,LD_PRELOAD,Persistence|Privilege Escalation|Defense Evasion,Rocke -T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,BRONZE BUTLER|Naikon|APT41|Soft Cell|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 -T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Whitefly|RTM|Threat Group-3390|menuPass +T1574.006,Dynamic Linker Hijacking,Persistence|Privilege Escalation|Defense Evasion,APT41|Rocke +T1574.002,DLL Side-Loading,Persistence|Privilege Escalation|Defense Evasion,Mustang Panda|Higaisa|BlackTech|Sidewinder|Chimera|BRONZE BUTLER|Naikon|APT41|GALLIUM|Tropic Trooper|Patchwork|APT19|APT32|APT3|menuPass|Threat Group-3390 +T1574.001,DLL Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,Evilnum|APT41|Whitefly|RTM|Threat Group-3390|menuPass T1574.008,Path Interception by Search Order Hijacking,Persistence|Privilege Escalation|Defense Evasion,no T1574.007,Path Interception by PATH Environment Variable,Persistence|Privilege Escalation|Defense Evasion,no T1574.009,Path Interception by Unquoted Path,Persistence|Privilege Escalation|Defense Evasion,no @@ -61,174 +184,174 @@ T1574.011,Services Registry Permissions Weakness,Persistence|Privilege Escalatio T1574.005,Executable Installer File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no T1574.010,Services File Permissions Weakness,Persistence|Privilege Escalation|Defense Evasion,no T1574,Hijack Execution Flow,Persistence|Privilege Escalation|Defense Evasion,no -T1069.001,Local Groups,Discovery,Turla|OilRig|admin@338 -T1570,Lateral Tool Transfer,Lateral Movement,APT32|Wizard Spider|Turla|FIN10 +T1069.001,Local Groups,Discovery,Chimera|Operation Wocao|Turla|OilRig|admin@338 +T1570,Lateral Tool Transfer,Lateral Movement,Chimera|GALLIUM|Operation Wocao|APT32|Wizard Spider|Turla|FIN10 T1568.003,DNS Calculation,Command And Control,APT12 -T1204.002,Malicious File,Execution,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|APT19|Dragonfly 2.0|BRONZE BUTLER|Cobalt Group|DarkHydrus|Gorgon Group|Patchwork|OilRig|Dark Caracal|MuddyWater|Lazarus Group|FIN7|APT32|Rancor|APT37|FIN8|APT28|Elderwood|TA459|APT29|Leviathan|menuPass|PLATINUM -T1204.001,Malicious Link,Execution,Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla +T1204.002,Malicious File,Execution,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|Kimsuky|FIN6|PROMETHIUM|APT30|Windshift|APT33|Sandworm Team|Naikon|Whitefly|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Wizard Spider|Mofang|Frankenstein|RTM|Inception|BlackTech|APT-C-36|Machete|admin@338|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|BRONZE BUTLER|FIN7|Dragonfly 2.0|APT19|Dark Caracal|Cobalt Group|Gorgon Group|Patchwork|MuddyWater|DarkHydrus|OilRig|APT32|Rancor|Lazarus Group|APT29|APT28|APT37|FIN8|Elderwood|menuPass|PLATINUM|TA459|Leviathan +T1204.001,Malicious Link,Execution,APT28|APT29|Mustang Panda|Sidewinder|ZIRCONIUM|MuddyWater|Evilnum|Sandworm Team|Wizard Spider|Patchwork|Windshift|APT32|Molerats|Mofang|BlackTech|TA505|OilRig|Machete|Leviathan|FIN8|FIN4|Elderwood|Dragonfly 2.0|Cobalt Group|APT39|Night Dragon|APT33|Turla T1195.003,Compromise Hardware Supply Chain,Initial Access,no -T1195.002,Compromise Software Supply Chain,Initial Access,Sandworm Team|APT41 +T1195.002,Compromise Software Supply Chain,Initial Access,APT29|UNC2452|Cobalt Group|GOLD SOUTHFIELD|Dragonfly|Sandworm Team|APT41 T1195.001,Compromise Software Dependencies and Development Tools,Initial Access,no -T1568.001,Fast Flux DNS,Command And Control,TA505 -T1052.001,Exfiltration over USB,Exfiltration,Tropic Trooper -T1569.002,Service Execution,Execution,Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang +T1568.001,Fast Flux DNS,Command And Control,menuPass|TA505 +T1052.001,Exfiltration over USB,Exfiltration,Mustang Panda|Tropic Trooper +T1569.002,Service Execution,Execution,Chimera|Operation Wocao|Wizard Spider|Blue Mockingbird|APT39|APT41|Silence|FIN6|APT32|Honeybee|Ke3chang T1569.001,Launchctl,Execution,no T1569,System Services,Execution,no -T1568.002,Domain Generation Algorithms,Command And Control,APT41 -T1568,Dynamic Resolution,Command And Control,no +T1568.002,Domain Generation Algorithms,Command And Control,TA551|APT41 +T1568,Dynamic Resolution,Command And Control,APT29|UNC2452 T1011.001,Exfiltration Over Bluetooth,Exfiltration,no -T1567.002,Exfiltration to Cloud Storage,Exfiltration,Leviathan|Turla +T1567.002,Exfiltration to Cloud Storage,Exfiltration,ZIRCONIUM|HAFNIUM|Chimera|Leviathan|Turla T1567.001,Exfiltration to Code Repository,Exfiltration,no -T1059.006,Python,Execution,Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete -T1059.005,Visual Basic,Execution,APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound +T1059.006,Python,Execution,ZIRCONIUM|MuddyWater|Turla|Operation Wocao|Kimsuky|APT29|Rocke|BRONZE BUTLER|APT39|Dragonfly 2.0|Machete +T1059.005,Visual Basic,Execution,Mustang Panda|Windshift|Higaisa|Sidewinder|APT39|Machete|Operation Wocao|Kimsuky|Lazarus Group|APT33|Sandworm Team|Gamaredon Group|Sharpshooter|Molerats|Frankenstein|Inception|APT-C-36|Rancor|Patchwork|MuddyWater|Honeybee|FIN7|APT37|BRONZE BUTLER|APT32|Turla|TA505|Silence|WIRTE|FIN4|Cobalt Group|Gorgon Group|Leviathan|TA459|Magic Hound T1059.004,Unix Shell,Execution,Rocke|APT41 -T1059.003,Windows Command Shell,Execution,TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|Soft Cell|Turla|Silence|APT32|APT39|Darkhotel|MuddyWater|APT18|APT38|Dark Caracal|Gorgon Group|Dragonfly 2.0|Rancor|Ke3chang|APT37|Leviathan|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|Threat Group-3390|menuPass|Gamaredon Group|Suckfly|Patchwork|Threat Group-1314|APT3|admin@338|APT1 +T1059.003,Windows Command Shell,Execution,APT29|Mustang Panda|ZIRCONIUM|TA551|Higaisa|Indrik Spider|Chimera|UNC2452|Fox Kitten|Machete|Operation Wocao|Wizard Spider|FIN6|TA505|Blue Mockingbird|Tropic Trooper|Frankenstein|OilRig|Lazarus Group|Honeybee|Cobalt Group|FIN7|APT41|GALLIUM|Turla|Silence|APT32|Darkhotel|MuddyWater|APT18|APT38|Gorgon Group|Dark Caracal|Rancor|Ke3chang|Dragonfly 2.0|Leviathan|APT37|FIN8|APT28|Magic Hound|Sowbug|BRONZE BUTLER|FIN10|menuPass|Threat Group-3390|Gamaredon Group|Patchwork|Suckfly|Threat Group-1314|APT3|admin@338|APT1 T1059.002,AppleScript,Execution,no -T1059.001,PowerShell,Execution,Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|Soft Cell|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|DarkHydrus|APT28|Thrip|Gorgon Group|Cobalt Group|Dragonfly 2.0|Leviathan|TA459|FIN8|MuddyWater|Magic Hound|OilRig|BRONZE BUTLER|CopyKittens|APT32|FIN7|FIN10|Threat Group-3390|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda -T1567,Exfiltration Over Web Service,Exfiltration,no +T1059.001,PowerShell,Execution,Mustang Panda|Indrik Spider|HAFNIUM|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Sandworm Team|Operation Wocao|Lazarus Group|Chimera|Blue Mockingbird|APT39|DarkVishnya|Molerats|Wizard Spider|Frankenstein|Inception|Silence|APT41|Kimsuky|GALLIUM|TA505|WIRTE|TEMP.Veles|APT33|Gallmaker|Turla|APT19|Dragonfly 2.0|APT28|Thrip|Cobalt Group|DarkHydrus|Gorgon Group|Leviathan|TA459|MuddyWater|FIN8|Magic Hound|CopyKittens|OilRig|BRONZE BUTLER|FIN10|Threat Group-3390|APT32|FIN7|menuPass|Patchwork|Stealth Falcon|FIN6|Poseidon Group|APT3|APT29|Deep Panda +T1567,Exfiltration Over Web Service,Exfiltration,APT28 T1497.003,Time Based Evasion,Defense Evasion|Discovery,no -T1497.002,User Activity Based Checks,Defense Evasion|Discovery,FIN7 -T1497.001,System Checks,Defense Evasion|Discovery,Frankenstein +T1497.002,User Activity Based Checks,Defense Evasion|Discovery,Darkhotel|FIN7 +T1497.001,System Checks,Defense Evasion|Discovery,Darkhotel|Evilnum|Frankenstein T1498.002,Reflection Amplification,Impact,no T1498.001,Direct Network Flood,Impact,no -T1566.003,Spearphishing via Service,Initial Access,Magic Hound|Windshift|FIN6|OilRig|Dark Caracal -T1566.002,Spearphishing Link,Initial Access,Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Turla|APT28|Cobalt Group|Dragonfly 2.0|OilRig|APT33|Elderwood|Leviathan|Magic Hound|Patchwork|APT29|FIN8 -T1566.001,Spearphishing Attachment,Initial Access,Magic Hound|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Turla|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|OilRig|Lazarus Group|APT19|Dragonfly 2.0|BRONZE BUTLER|APT32|FIN8|MuddyWater|APT28|TA459|Leviathan|Patchwork|PLATINUM|Elderwood|APT29|APT37|menuPass -T1566,Phishing,Initial Access,no +T1566.003,Spearphishing via Service,Initial Access,Ajax Security Team|Lazarus Group|Magic Hound|Windshift|FIN6|OilRig|Dark Caracal +T1566.002,Spearphishing Link,Initial Access,Mustang Panda|ZIRCONIUM|MuddyWater|Sidewinder|Evilnum|Sandworm Team|Wizard Spider|APT1|Windshift|Molerats|Mofang|BlackTech|Machete|Kimsuky|TA505|Stolen Pencil|APT39|FIN4|APT32|Night Dragon|Cobalt Group|Turla|APT28|Dragonfly 2.0|OilRig|APT33|APT29|Leviathan|Elderwood|FIN8|Patchwork|Magic Hound +T1566.001,Spearphishing Attachment,Initial Access,Ajax Security Team|Mustang Panda|TA551|Higaisa|Sidewinder|APT1|FIN6|APT30|Windshift|APT33|Sandworm Team|Naikon|Gamaredon Group|Sharpshooter|Molerats|Mofang|Wizard Spider|RTM|Frankenstein|Inception|BlackTech|APT-C-36|APT41|Machete|admin@338|Kimsuky|APT12|TA505|Silence|The White Company|APT39|FIN4|Darkhotel|Gallmaker|Tropic Trooper|Gorgon Group|Rancor|DarkHydrus|Cobalt Group|FIN7|APT19|Lazarus Group|OilRig|APT32|BRONZE BUTLER|Dragonfly 2.0|MuddyWater|APT28|FIN8|TA459|Elderwood|APT29|Leviathan|Patchwork|APT37|menuPass|PLATINUM +T1566,Phishing,Initial Access,GOLD SOUTHFIELD|Dragonfly T1565.003,Runtime Data Manipulation,Impact,APT38 T1565.002,Transmitted Data Manipulation,Impact,APT38 T1565.001,Stored Data Manipulation,Impact,FIN4|APT38 T1565,Data Manipulation,Impact,no -T1564.001,Hidden Files and Directories,Defense Evasion,Rocke|APT32|Tropic Trooper|APT28|Lazarus Group +T1564.001,Hidden Files and Directories,Defense Evasion,Mustang Panda|Rocke|APT32|Tropic Trooper|Lazarus Group|APT28 T1564,Hide Artifacts,Defense Evasion,no T1563.002,RDP Hijacking,Lateral Movement,no T1563.001,SSH Hijacking,Lateral Movement,no T1563,Remote Service Session Hijacking,Lateral Movement,no -T1518.001,Security Software Discovery,Discovery,Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon +T1518.001,Security Software Discovery,Discovery,Windshift|Sidewinder|Operation Wocao|Wizard Spider|Turla|Rocke|Frankenstein|The White Company|Cobalt Group|Darkhotel|MuddyWater|Tropic Trooper|FIN8|Patchwork|Naikon T1069.003,Cloud Groups,Discovery,no -T1069.002,Domain Groups,Discovery,Turla|Wizard Spider|Inception|OilRig|FIN6|Dragonfly 2.0|Ke3chang +T1069.002,Domain Groups,Discovery,Turla|Inception|OilRig|Dragonfly 2.0|Ke3chang T1087.004,Cloud Account,Discovery,no T1087.003,Email Account,Discovery,Sandworm Team|TA505 -T1087.002,Domain Account,Discovery,Turla|Sandworm Team|Dragonfly 2.0|OilRig|BRONZE BUTLER|menuPass|FIN6|Poseidon Group|Ke3chang -T1087.001,Local Account,Discovery,Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 +T1087.002,Domain Account,Discovery,MuddyWater|Fox Kitten|Operation Wocao|Wizard Spider|Chimera|Turla|Sandworm Team|Dragonfly 2.0|BRONZE BUTLER|OilRig|menuPass|FIN6|Poseidon Group|Ke3chang +T1087.001,Local Account,Discovery,Chimera|Fox Kitten|Turla|Poseidon Group|OilRig|Ke3chang|APT32|APT1|Threat Group-3390|APT3|admin@338 T1553.004,Install Root Certificate,Defense Evasion,no -T1562.004,Disable or Modify System Firewall,Defense Evasion,Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak -T1562.003,HISTCONTROL,Defense Evasion,no -T1562.002,Disable Windows Event Logging,Defense Evasion,Threat Group-3390 -T1562.001,Disable or Modify Tools,Defense Evasion,Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda +T1562.004,Disable or Modify System Firewall,Defense Evasion,APT29|UNC2452|Operation Wocao|Rocke|Lazarus Group|Kimsuky|Dragonfly 2.0|Carbanak +T1562.003,Impair Command History Logging,Defense Evasion,no +T1562.002,Disable Windows Event Logging,Defense Evasion,APT29|UNC2452|Threat Group-3390 +T1562.001,Disable or Modify Tools,Defense Evasion,APT29|MuddyWater|UNC2452|Wizard Spider|FIN6|Gamaredon Group|BRONZE BUTLER|Rocke|Kimsuky|Turla|Night Dragon|Gorgon Group|Lazarus Group|Putter Panda T1562,Impair Defenses,Defense Evasion,no T1003.004,LSA Secrets,Credential Access,OilRig|MuddyWater|menuPass|Leafminer|Ke3chang|Dragonfly 2.0|APT33|Threat Group-3390 T1003.005,Cached Domain Credentials,Credential Access,OilRig|MuddyWater|Leafminer|APT33 T1561.002,Disk Structure Wipe,Impact,Sandworm Team|Lazarus Group|APT38|APT37 T1561.001,Disk Content Wipe,Impact,Lazarus Group T1561,Disk Wipe,Impact,no -T1560.003,Archive via Custom Method,Collection,Lazarus Group|Kimsuky|CopyKittens|FIN6 +T1560.003,Archive via Custom Method,Collection,Mustang Panda|Lazarus Group|Kimsuky|CopyKittens|FIN6 T1560.002,Archive via Library,Collection,Lazarus Group|Threat Group-3390 -T1560.001,Archive via Utility,Collection,APT41|Soft Cell|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|APT3|Sowbug|menuPass|APT1|Ke3chang +T1560.001,Archive via Utility,Collection,APT29|Mustang Panda|HAFNIUM|UNC2452|Fox Kitten|Operation Wocao|Chimera|APT41|GALLIUM|Turla|Gallmaker|APT33|APT39|MuddyWater|Magic Hound|FIN8|BRONZE BUTLER|CopyKittens|Sowbug|APT3|menuPass|APT1|Ke3chang T1560,Archive Collected Data,Collection,menuPass|APT32|Honeybee|Patchwork|APT28|Dragonfly 2.0|FIN6|Lazarus Group|Ke3chang T1499.004,Application or System Exploitation,Impact,no T1499.003,Application Exhaustion Flood,Impact,no T1499.002,Service Exhaustion Flood,Impact,no T1499.001,OS Exhaustion Flood,Impact,no -T1491.002,External Defacement,Impact,no +T1491.002,External Defacement,Impact,Sandworm Team T1491.001,Internal Defacement,Impact,Lazarus Group -T1114.003,Email Forwarding Rule,Collection,no -T1114.002,Remote Email Collection,Collection,APT1|FIN4|APT28|Dragonfly 2.0|Ke3chang|Leafminer -T1114.001,Local Email Collection,Collection,Magic Hound|APT1 +T1114.003,Email Forwarding Rule,Collection,Silent Librarian|Kimsuky +T1114.002,Remote Email Collection,Collection,APT29|HAFNIUM|Chimera|UNC2452|APT1|FIN4|Dragonfly 2.0|APT28|Leafminer|Ke3chang +T1114.001,Local Email Collection,Collection,Chimera|Magic Hound|APT1 T1134.005,SID-History Injection,Defense Evasion|Privilege Escalation,no T1134.004,Parent PID Spoofing,Defense Evasion|Privilege Escalation,no T1134.003,Make and Impersonate Token,Defense Evasion|Privilege Escalation,no T1134.002,Create Process with Token,Defense Evasion|Privilege Escalation,Turla|Lazarus Group T1134.001,Token Impersonation/Theft,Defense Evasion|Privilege Escalation,APT28 -T1213.002,Sharepoint,Collection,Ke3chang|APT28 +T1213.002,Sharepoint,Collection,Chimera|Ke3chang|APT28 T1213.001,Confluence,Collection,no -T1555.003,Credentials from Web Browsers,Credential Access,Magic Hound|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats +T1555.003,Credentials from Web Browsers,Credential Access,Ajax Security Team|ZIRCONIUM|FIN6|Sandworm Team|Inception|Stealth Falcon|OilRig|Leafminer|APT33|APT3|Kimsuky|TA505|Stolen Pencil|MuddyWater|APT37|Patchwork|Molerats T1555.002,Securityd Memory,Credential Access,no T1555.001,Keychain,Credential Access,no -T1559.002,Dynamic Data Exchange,Execution,Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 +T1559.002,Dynamic Data Exchange,Execution,Sidewinder|Sharpshooter|TA505|MuddyWater|Gallmaker|Patchwork|Cobalt Group|APT37|APT28|FIN7 T1559.001,Component Object Model,Execution,Gamaredon Group|MuddyWater T1559,Inter-Process Communication,Execution,no T1558.002,Silver Ticket,Credential Access,no T1558.001,Golden Ticket,Credential Access,Ke3chang T1558,Steal or Forge Kerberos Tickets,Credential Access,no -T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,no -T1557,Man-in-the-Middle,Credential Access|Collection,no -T1556.002,Password Filter DLL,Credential Access|Defense Evasion,Strider -T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion,no -T1556,Modify Authentication Process,Credential Access|Defense Evasion,no +T1557.001,LLMNR/NBT-NS Poisoning and SMB Relay,Credential Access|Collection,Wizard Spider +T1557,Man-in-the-Middle,Credential Access|Collection,Kimsuky +T1556.002,Password Filter DLL,Credential Access|Defense Evasion|Persistence,Strider +T1556.001,Domain Controller Authentication,Credential Access|Defense Evasion|Persistence,Chimera +T1556,Modify Authentication Process,Credential Access|Defense Evasion|Persistence,no T1056.004,Credential API Hooking,Collection|Credential Access,PLATINUM T1056.003,Web Portal Capture,Collection|Credential Access,no T1056.002,GUI Input Capture,Collection|Credential Access,FIN4 -T1056.001,Keylogging,Collection|Credential Access,APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|Ke3chang|OilRig|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 -T1555,Credentials from Password Stores,Credential Access,APT39|OilRig|MuddyWater|Leafminer|APT33|Turla|Stealth Falcon +T1056.001,Keylogging,Collection|Credential Access,Ajax Security Team|Operation Wocao|APT32|Sandworm Team|APT39|APT41|Kimsuky|menuPass|Stolen Pencil|FIN4|APT38|OilRig|Ke3chang|PLATINUM|Sowbug|Magic Hound|Group5|Lazarus Group|Threat Group-3390|APT3|Darkhotel|APT28 +T1555,Credentials from Password Stores,Credential Access,APT29|Evilnum|UNC2452|FIN6|APT39|OilRig|MuddyWater|Leafminer|APT33|Stealth Falcon T1552.005,Cloud Instance Metadata API,Credential Access,no T1003.008,/etc/passwd and /etc/shadow,Credential Access,no T1003.007,Proc Filesystem,Credential Access,no -T1003.006,DCSync,Credential Access,no -T1558.003,Kerberoasting,Credential Access,no +T1003.006,DCSync,Credential Access,APT29|UNC2452|Operation Wocao +T1558.003,Kerberoasting,Credential Access,APT29|UNC2452|Operation Wocao|Wizard Spider T1552.006,Group Policy Preferences,Credential Access,APT33 -T1003.003,NTDS,Credential Access,FIN6|Dragonfly 2.0 -T1003.002,Security Account Manager,Credential Access,Threat Group-3390|Ke3chang|Soft Cell|Night Dragon|Dragonfly 2.0|menuPass -T1003.001,LSASS Memory,Credential Access,Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|Soft Cell|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Lazarus Group|Leafminer|Magic Hound|MuddyWater|PLATINUM|FIN8|BRONZE BUTLER|OilRig|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver -T1110.004,Credential Stuffing,Credential Access,no -T1110.003,Password Spraying,Credential Access,APT33|Leafminer|Lazarus Group -T1110.002,Password Cracking,Credential Access,APT41|Dragonfly 2.0|APT3 -T1110.001,Password Guessing,Credential Access,no -T1021.006,Windows Remote Management,Lateral Movement,Threat Group-3390 -T1021.005,VNC,Lateral Movement,GCMAN -T1021.004,SSH,Lateral Movement,Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN +T1003.003,NTDS,Credential Access,Mustang Panda|HAFNIUM|Fox Kitten|menuPass|Wizard Spider|Chimera|FIN6|Dragonfly 2.0 +T1003.002,Security Account Manager,Credential Access,Wizard Spider|Threat Group-3390|Ke3chang|GALLIUM|Night Dragon|Dragonfly 2.0|menuPass +T1003.001,LSASS Memory,Credential Access,HAFNIUM|Fox Kitten|Operation Wocao|Kimsuky|Sandworm Team|Whitefly|Blue Mockingbird|Silence|Threat Group-3390|Leviathan|APT41|GALLIUM|TEMP.Veles|APT33|APT39|Stolen Pencil|APT32|Leafminer|Magic Hound|Lazarus Group|MuddyWater|PLATINUM|FIN8|OilRig|BRONZE BUTLER|FIN6|APT3|APT28|APT1|Ke3chang|Cleaver +T1110.004,Credential Stuffing,Credential Access,Chimera +T1110.003,Password Spraying,Credential Access,Silent Librarian|Chimera|APT28|APT33|Leafminer|Lazarus Group +T1110.002,Password Cracking,Credential Access,FIN6|APT41|Dragonfly 2.0|APT3 +T1110.001,Password Guessing,Credential Access,APT28 +T1021.006,Windows Remote Management,Lateral Movement,APT29|UNC2452|Chimera|Wizard Spider|Threat Group-3390 +T1021.005,VNC,Lateral Movement,Fox Kitten|GCMAN +T1021.004,SSH,Lateral Movement,Fox Kitten|Rocke|TEMP.Veles|Leviathan|APT39|OilRig|menuPass|GCMAN T1021.003,Distributed Component Object Model,Lateral Movement,no -T1021.002,SMB/Windows Admin Shares,Lateral Movement,Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang -T1021.001,Remote Desktop Protocol,Lateral Movement,Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|menuPass|FIN10|Patchwork|FIN6|Lazarus Group|APT1|Axiom +T1021.002,SMB/Windows Admin Shares,Lateral Movement,Fox Kitten|APT41|Operation Wocao|Wizard Spider|Chimera|Blue Mockingbird|APT39|APT32|Orangeworm|FIN8|APT3|Lazarus Group|Threat Group-1314|Turla|Deep Panda|Ke3chang +T1021.001,Remote Desktop Protocol,Lateral Movement,Fox Kitten|Chimera|Blue Mockingbird|Wizard Spider|Silence|APT41|TEMP.Veles|Leviathan|APT39|Stolen Pencil|Cobalt Group|Dragonfly 2.0|FIN8|APT3|OilRig|FIN10|menuPass|Patchwork|FIN6|Lazarus Group|APT1|Axiom T1554,Compromise Client Software Binary,Persistence,no T1036.006,Space after Filename,Defense Evasion,no -T1036.005,Match Legitimate Name or Location,Defense Evasion,Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 -T1036.004,Masquerade Task or Service,Defense Evasion,Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 -T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|Soft Cell|PLATINUM +T1036.005,Match Legitimate Name or Location,Defense Evasion,APT29|Mustang Panda|Sidewinder|Darkhotel|Lazarus Group|Indrik Spider|UNC2452|Fox Kitten|Machete|Chimera|PROMETHIUM|Rocke|Sandworm Team|APT39|Blue Mockingbird|Whitefly|Tropic Trooper|Silence|APT41|menuPass|TEMP.Veles|MuddyWater|BRONZE BUTLER|Sowbug|APT32|Patchwork|Poseidon Group|admin@338|Carbanak|APT1 +T1036.004,Masquerade Task or Service,Defense Evasion,ZIRCONIUM|APT29|Higaisa|UNC2452|Fox Kitten|Kimsuky|Lazarus Group|PROMETHIUM|Wizard Spider|APT-C-36|Carbanak|APT32|FIN6|FIN7 +T1036.003,Rename System Utilities,Defense Evasion,menuPass|APT32|GALLIUM T1036.002,Right-to-Left Override,Defense Evasion,BRONZE BUTLER|BlackTech|Ke3chang|Scarlet Mimic -T1036.001,Invalid Code Signature,Defense Evasion,Windshift +T1036.001,Invalid Code Signature,Defense Evasion,Windshift|APT37 T1553.003,SIP and Trust Provider Hijacking,Defense Evasion,no -T1553.002,Code Signing,Defense Evasion,Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|APT37|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel +T1553.002,Code Signing,Defense Evasion,APT29|GALLIUM|UNC2452|Wizard Spider|Kimsuky|PROMETHIUM|Patchwork|Silence|APT41|FIN6|TA505|FIN7|Honeybee|Leviathan|CopyKittens|Winnti Group|Suckfly|Molerats|Darkhotel T1553.001,Gatekeeper Bypass,Defense Evasion,no T1553,Subvert Trust Controls,Defense Evasion,no -T1027.003,Steganography,Defense Evasion,BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 -T1027.002,Software Packing,Defense Evasion,TA505|Rocke|Soft Cell|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon -T1027.001,Binary Padding,Defense Evasion,Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee +T1027.003,Steganography,Defense Evasion,TA551|BRONZE BUTLER|Tropic Trooper|MuddyWater|APT37 +T1027.002,Software Packing,Defense Evasion,ZIRCONIUM|Lazarus Group|TA505|Rocke|GALLIUM|The White Company|APT39|APT38|Dark Caracal|Elderwood|APT3|Patchwork|APT29|Night Dragon +T1027.001,Binary Padding,Defense Evasion,Mustang Panda|Higaisa|Gamaredon Group|Patchwork|APT32|Leviathan|BRONZE BUTLER|Moafee T1222.002,Linux and Mac File and Directory Permissions Modification,Defense Evasion,Rocke|APT32 -T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,no -T1552.004,Private Keys,Credential Access,Rocke +T1222.001,Windows File and Directory Permissions Modification,Defense Evasion,Wizard Spider +T1552.004,Private Keys,Credential Access,APT29|UNC2452|Operation Wocao|Rocke T1552.003,Bash History,Credential Access,no T1552.002,Credentials in Registry,Credential Access,APT32 -T1552.001,Credentials In Files,Credential Access,Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 +T1552.001,Credentials In Files,Credential Access,Fox Kitten|Leafminer|APT33|OilRig|TA505|Stolen Pencil|MuddyWater|APT3 T1552,Unsecured Credentials,Credential Access,no T1216.001,PubPrn,Defense Evasion,APT32 -T1070.006,Timestomp,Defense Evasion,Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 +T1070.006,Timestomp,Defense Evasion,APT29|UNC2452|Chimera|Kimsuky|Rocke|TEMP.Veles|APT32|Lazarus Group|APT28 T1070.005,Network Share Connection Removal,Defense Evasion,Threat Group-3390 -T1070.004,File Deletion,Defense Evasion,Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|FIN10|APT28|Threat Group-3390|Group5|Lazarus Group|APT18|APT29 +T1070.004,File Deletion,Defense Evasion,APT39|Mustang Panda|Chimera|Evilnum|UNC2452|Operation Wocao|FIN6|Sandworm Team|Rocke|Tropic Trooper|Gamaredon Group|Wizard Spider|APT41|Kimsuky|Silence|The White Company|TEMP.Veles|APT32|APT38|Patchwork|Honeybee|Cobalt Group|Dragonfly 2.0|menuPass|FIN8|OilRig|FIN5|BRONZE BUTLER|Magic Hound|APT3|Threat Group-3390|FIN10|APT28|Group5|Lazarus Group|APT18|APT29 T1070.003,Clear Command History,Defense Evasion,APT41 -T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,no +T1550.004,Web Session Cookie,Defense Evasion|Lateral Movement,APT29|UNC2452 T1550.001,Application Access Token,Defense Evasion|Lateral Movement,APT28 T1550.003,Pass the Ticket,Defense Evasion|Lateral Movement,APT32|BRONZE BUTLER|APT29 -T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Soft Cell|APT32|Night Dragon|APT28|APT1 -T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,no +T1550.002,Pass the Hash,Defense Evasion|Lateral Movement,Chimera|Kimsuky|GALLIUM|APT32|Night Dragon|APT28|APT1 +T1550,Use Alternate Authentication Material,Defense Evasion|Lateral Movement,APT29|UNC2452 T1548.004,Elevated Execution with Prompt,Privilege Escalation|Defense Evasion,no T1548.003,Sudo and Sudo Caching,Privilege Escalation|Defense Evasion,no -T1548.002,Bypass User Access Control,Privilege Escalation|Defense Evasion,APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 +T1548.002,Bypass User Account Control,Privilege Escalation|Defense Evasion,Evilnum|APT37|MuddyWater|Honeybee|Cobalt Group|Threat Group-3390|BRONZE BUTLER|Patchwork|APT29 T1548.001,Setuid and Setgid,Privilege Escalation|Defense Evasion,no T1548,Abuse Elevation Control Mechanism,Privilege Escalation|Defense Evasion,no T1136.003,Cloud Account,Persistence,no T1070.002,Clear Linux or Mac System Logs,Defense Evasion,Rocke -T1070.001,Clear Windows Event Logs,Defense Evasion,APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 -T1136.002,Domain Account,Persistence,Soft Cell -T1136.001,Local Account,Persistence,APT39|APT41|Dragonfly 2.0|Leafminer|APT3 +T1070.001,Clear Windows Event Logs,Defense Evasion,Chimera|Operation Wocao|APT41|APT38|Dragonfly 2.0|APT32|FIN8|FIN5|APT28 +T1136.002,Domain Account,Persistence,HAFNIUM|GALLIUM +T1136.001,Local Account,Persistence,Fox Kitten|APT39|APT41|Dragonfly 2.0|Leafminer|APT3 T1547.011,Plist Modification,Persistence|Privilege Escalation,no T1547.010,Port Monitors,Persistence|Privilege Escalation,no -T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Leviathan|Lazarus Group +T1547.009,Shortcut Modification,Persistence|Privilege Escalation,APT39|Darkhotel|APT29|Gorgon Group|Dragonfly 2.0|Lazarus Group|Leviathan T1547.008,LSASS Driver,Persistence|Privilege Escalation,no T1547.007,Re-opened Applications,Persistence|Privilege Escalation,no T1547.006,Kernel Modules and Extensions,Persistence|Privilege Escalation,no -T1547.005,Security Support Provider,Persistence|Privilege Escalation,no -T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Tropic Trooper|Turla +T1547.005,Security Support Provider,Persistence|Privilege Escalation,Lazarus Group +T1547.004,Winlogon Helper DLL,Persistence|Privilege Escalation,Wizard Spider|Tropic Trooper|Turla T1547.003,Time Providers,Persistence|Privilege Escalation,no T1546.014,Emond,Privilege Escalation|Persistence,no T1546.013,PowerShell Profile,Privilege Escalation|Persistence,Turla @@ -236,38 +359,38 @@ T1546.012,Image File Execution Options Injection,Privilege Escalation|Persistenc T1218.008,Odbcconf,Defense Evasion,Cobalt Group T1546.011,Application Shimming,Privilege Escalation|Persistence,FIN7 T1547.002,Authentication Package,Persistence|Privilege Escalation,no -T1546.010,AppInit DLLs,Privilege Escalation|Persistence,no +T1546.010,AppInit DLLs,Privilege Escalation|Persistence,APT39 T1546.009,AppCert DLLs,Privilege Escalation|Persistence,Honeybee -T1218.007,Msiexec,Defense Evasion,TA505|Rancor -T1546.008,Accessibility Features,Privilege Escalation|Persistence,APT41|APT3|APT29|Deep Panda|Axiom +T1218.007,Msiexec,Defense Evasion,ZIRCONIUM|Molerats|Machete|TA505|Rancor +T1546.008,Accessibility Features,Privilege Escalation|Persistence,Fox Kitten|APT41|APT3|APT29|Deep Panda|Axiom T1546.007,Netsh Helper DLL,Privilege Escalation|Persistence,no T1546.006,LC_LOAD_DYLIB Addition,Privilege Escalation|Persistence,no T1546.005,Trap,Privilege Escalation|Persistence,no -T1546.004,.bash_profile and .bashrc,Privilege Escalation|Persistence,no -T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,APT33|Blue Mockingbird|Turla|Leviathan|APT29 +T1546.004,Unix Shell Configuration Modification,Privilege Escalation|Persistence,no +T1546.003,Windows Management Instrumentation Event Subscription,Privilege Escalation|Persistence,Mustang Panda|UNC2452|APT33|Blue Mockingbird|Turla|Leviathan|APT29 T1546.002,Screensaver,Privilege Escalation|Persistence,no T1546.001,Change Default File Association,Privilege Escalation|Persistence,Kimsuky -T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Machete|Kimsuky|APT33|APT39|APT32|APT18|Turla|Dark Caracal|Cobalt Group|Honeybee|Threat Group-3390|Dragonfly 2.0|Gorgon Group|Ke3chang|APT19|Leviathan|MuddyWater|APT37|BRONZE BUTLER|Magic Hound|APT3|FIN10|FIN7|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel +T1547.001,Registry Run Keys / Startup Folder,Persistence|Privilege Escalation,Windshift|Mustang Panda|ZIRCONIUM|Higaisa|Sidewinder|APT28|Wizard Spider|PROMETHIUM|Rocke|Tropic Trooper|Gamaredon Group|Sharpshooter|Molerats|Silence|RTM|Inception|APT41|Kimsuky|APT33|APT39|APT32|APT18|Turla|APT19|Honeybee|Dark Caracal|Threat Group-3390|Cobalt Group|Ke3chang|Gorgon Group|Dragonfly 2.0|APT37|MuddyWater|Leviathan|APT3|BRONZE BUTLER|Magic Hound|FIN7|FIN10|Patchwork|FIN6|Lazarus Group|Putter Panda|APT29|Darkhotel T1218.002,Control Panel,Defense Evasion,no -T1218.010,Regsvr32,Defense Evasion,Blue Mockingbird|Inception|WIRTE|Cobalt Group|APT19|Leviathan|APT32|Deep Panda +T1218.010,Regsvr32,Defense Evasion,TA551|Blue Mockingbird|Inception|WIRTE|APT19|Cobalt Group|Leviathan|APT32|Deep Panda T1218.009,Regsvcs/Regasm,Defense Evasion,no -T1218.005,Mshta,Defense Evasion,Inception|Kimsuky|APT32|MuddyWater|FIN7 -T1218.004,InstallUtil,Defense Evasion,no +T1218.005,Mshta,Defense Evasion,Mustang Panda|TA551|Sidewinder|Lazarus Group|Inception|Kimsuky|APT32|MuddyWater|FIN7 +T1218.004,InstallUtil,Defense Evasion,Mustang Panda|menuPass T1218.001,Compiled HTML File,Defense Evasion,APT41|Silence|Lazarus Group|Dark Caracal|OilRig T1218.003,CMSTP,Defense Evasion,Cobalt Group|MuddyWater -T1218.011,Rundll32,Defense Evasion,APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 +T1218.011,Rundll32,Defense Evasion,HAFNIUM|TA551|UNC2452|APT41|Gamaredon Group|APT32|Sandworm Team|Blue Mockingbird|TA505|MuddyWater|APT29|APT19|CopyKittens|APT3|Carbanak|APT28 T1547,Boot or Logon Autostart Execution,Persistence|Privilege Escalation,no T1546,Event Triggered Execution,Privilege Escalation|Persistence,no T1098.003,Add Office 365 Global Administrator Role,Persistence,no -T1098.002,Exchange Email Delegate Permissions,Persistence,Magic Hound -T1098.001,Additional Azure Service Principal Credentials,Persistence,no +T1098.002,Exchange Email Delegate Permissions,Persistence,APT29|UNC2452|Magic Hound +T1098.001,Additional Cloud Credentials,Persistence,APT29|UNC2452 T1543.004,Launch Daemon,Persistence|Privilege Escalation,no -T1543.003,Windows Service,Persistence|Privilege Escalation,Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|Honeybee|FIN7|Threat Group-3390|APT19|APT3|Lazarus Group|Carbanak +T1543.003,Windows Service,Persistence|Privilege Escalation,PROMETHIUM|Blue Mockingbird|DarkVishnya|Wizard Spider|APT32|APT41|Kimsuky|Tropic Trooper|Cobalt Group|Ke3chang|FIN7|APT19|Honeybee|Threat Group-3390|APT3|Lazarus Group|Carbanak T1543.002,Systemd Service,Persistence|Privilege Escalation,Rocke T1543.001,Launch Agent,Persistence|Privilege Escalation,no T1037.005,Startup Items,Persistence|Privilege Escalation,no -T1037.004,Rc.common,Persistence|Privilege Escalation,no -T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|menuPass|Gorgon Group|Patchwork +T1037.004,RC Scripts,Persistence|Privilege Escalation,no +T1055.012,Process Hollowing,Defense Evasion|Privilege Escalation,Threat Group-3390|Gorgon Group|menuPass|Patchwork T1055.013,Process Doppelgänging,Defense Evasion|Privilege Escalation,Leafminer T1055.011,Extra Window Memory Injection,Defense Evasion|Privilege Escalation,no T1055.014,VDSO Hijacking,Defense Evasion|Privilege Escalation,no @@ -277,7 +400,7 @@ T1055.005,Thread Local Storage,Defense Evasion|Privilege Escalation,no T1055.004,Asynchronous Procedure Call,Defense Evasion|Privilege Escalation,no T1055.003,Thread Execution Hijacking,Defense Evasion|Privilege Escalation,no T1055.002,Portable Executable Injection,Defense Evasion|Privilege Escalation,Rocke|Gorgon Group -T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda +T1055.001,Dynamic-link Library Injection,Defense Evasion|Privilege Escalation,Wizard Spider|TA505|Turla|Tropic Trooper|Lazarus Group|Putter Panda T1037.003,Network Logon Script,Persistence|Privilege Escalation,no T1543,Create or Modify System Process,Persistence|Privilege Escalation,no T1037.002,Logon Script (Mac),Persistence|Privilege Escalation,no @@ -285,13 +408,13 @@ T1037.001,Logon Script (Windows),Persistence|Privilege Escalation,Cobalt Group|A T1542.003,Bootkit,Persistence|Defense Evasion,APT41|Lazarus Group|APT28 T1542.002,Component Firmware,Persistence|Defense Evasion,Equation T1542.001,System Firmware,Persistence|Defense Evasion,no -T1505.003,Web Shell,Persistence,Tropic Trooper|Soft Cell|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda +T1505.003,Web Shell,Persistence,Sandworm Team|HAFNIUM|Volatile Cedar|Fox Kitten|Operation Wocao|Kimsuky|Tropic Trooper|GALLIUM|Threat Group-3390|TEMP.Veles|Leviathan|APT39|Dragonfly 2.0|APT32|OilRig|Deep Panda T1505.002,Transport Agent,Persistence,no T1505.001,SQL Stored Procedures,Persistence,no T1053.003,Cron,Execution|Persistence|Privilege Escalation,Rocke T1053.004,Launchd,Execution|Persistence|Privilege Escalation,no T1053.001,At (Linux),Execution|Persistence|Privilege Escalation,no -T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|Machete|Soft Cell|Silence|TEMP.Veles|APT33|APT39|Dragonfly 2.0|Patchwork|OilRig|Rancor|Cobalt Group|FIN8|menuPass|FIN10|APT32|FIN7|Stealth Falcon|FIN6|APT3|APT29 +T1053.005,Scheduled Task,Execution|Persistence|Privilege Escalation,Mustang Panda|Higaisa|UNC2452|Fox Kitten|Molerats|Machete|Operation Wocao|Chimera|Gamaredon Group|Blue Mockingbird|MuddyWater|Wizard Spider|Frankenstein|APT-C-36|BRONZE BUTLER|APT41|GALLIUM|Silence|TEMP.Veles|APT33|APT39|Cobalt Group|Rancor|Dragonfly 2.0|OilRig|Patchwork|FIN8|menuPass|FIN10|FIN7|APT32|Stealth Falcon|FIN6|APT3|APT29 T1053.002,At (Windows),Execution|Persistence|Privilege Escalation,BRONZE BUTLER|Threat Group-3390|APT18 T1542,Pre-OS Boot,Defense Evasion|Persistence,no T1137.001,Office Template Macros,Persistence,MuddyWater @@ -301,140 +424,141 @@ T1137.005,Outlook Rules,Persistence,no T1137.006,Add-ins,Persistence,Naikon T1137.002,Office Test,Persistence,APT28 T1531,Account Access Removal,Impact,no -T1539,Steal Web Session Cookie,Credential Access,no +T1539,Steal Web Session Cookie,Credential Access,Evilnum T1529,System Shutdown/Reboot,Impact,Lazarus Group|APT38|APT37 -T1518,Software Discovery,Discovery,BRONZE BUTLER|Tropic Trooper|Inception +T1518,Software Discovery,Discovery,Mustang Panda|Windshift|MuddyWater|Windigo|Sidewinder|Operation Wocao|BRONZE BUTLER|Tropic Trooper|Inception +T1547.013,XDG Autostart Entries,Persistence|Privilege Escalation,no T1534,Internal Spearphishing,Lateral Movement,Gamaredon Group T1528,Steal Application Access Token,Credential Access,APT28 T1535,Unused/Unsupported Cloud Regions,Defense Evasion,no -T1525,Implant Container Image,Persistence,no +T1525,Implant Internal Image,Persistence,no T1538,Cloud Service Dashboard,Discovery,no -T1530,Data from Cloud Storage Object,Collection,no +T1530,Data from Cloud Storage Object,Collection,Fox Kitten T1578,Modify Cloud Compute Infrastructure,Defense Evasion,no T1537,Transfer Data to Cloud Account,Exfiltration,no T1526,Cloud Service Discovery,Discovery,no T1505,Server Software Component,Persistence,no -T1499,Endpoint Denial of Service,Impact,no -T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,no -T1498,Network Denial of Service,Impact,no +T1499,Endpoint Denial of Service,Impact,Sandworm Team +T1497,Virtualization/Sandbox Evasion,Defense Evasion|Discovery,Darkhotel +T1498,Network Denial of Service,Impact,APT28 T1496,Resource Hijacking,Impact,Blue Mockingbird|Rocke|APT41|Lazarus Group T1495,Firmware Corruption,Impact,no T1491,Defacement,Impact,no T1490,Inhibit System Recovery,Impact,no -T1489,Service Stop,Impact,Lazarus Group -T1486,Data Encrypted for Impact,Impact,APT41|TA505|APT38 +T1489,Service Stop,Impact,Wizard Spider|Lazarus Group +T1486,Data Encrypted for Impact,Impact,Indrik Spider|APT41|TA505|APT38 T1485,Data Destruction,Impact,Sandworm Team|Lazarus Group|APT38 -T1484,Group Policy Modification,Defense Evasion|Privilege Escalation,no -T1482,Domain Trust Discovery,Discovery,Wizard Spider +T1484,Domain Policy Modification,Defense Evasion|Privilege Escalation,no +T1482,Domain Trust Discovery,Discovery,APT29|Chimera|UNC2452 T1480,Execution Guardrails,Defense Evasion,no T1222,File and Directory Permissions Modification,Defense Evasion,no +T1220,XSL Script Processing,Defense Evasion,Higaisa|Cobalt Group T1221,Template Injection,Defense Evasion,Gamaredon Group|Frankenstein|Inception|APT28|Tropic Trooper|Dragonfly 2.0|DarkHydrus -T1220,XSL Script Processing,Defense Evasion,Cobalt Group -T1197,BITS Jobs,Defense Evasion|Persistence,Patchwork|APT41|Leviathan -T1217,Browser Bookmark Discovery,Discovery,no -T1213,Data from Information Repositories,Collection,Turla -T1189,Drive-by Compromise,Initial Access,Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|BRONZE BUTLER|Leafminer|Dark Caracal|APT19|APT32|Lazarus Group|Threat Group-3390|Elderwood|APT37|Patchwork|PLATINUM -T1203,Exploitation for Client Execution,Execution,Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|Lazarus Group|BRONZE BUTLER|Cobalt Group|APT37|Patchwork|Leviathan|Elderwood|TA459|APT29 +T1189,Drive-by Compromise,Initial Access,Machete|Windigo|Dragonfly|PROMETHIUM|Turla|Windshift|RTM|Darkhotel|APT38|Dragonfly 2.0|Leafminer|Lazarus Group|BRONZE BUTLER|APT19|APT32|Threat Group-3390|Dark Caracal|Elderwood|APT37|Patchwork|PLATINUM +T1190,Exploit Public-Facing Application,Initial Access,Volatile Cedar|UNC2452|Fox Kitten|Operation Wocao|APT28|APT29|GOLD SOUTHFIELD|Blue Mockingbird|Rocke|APT39|BlackTech|APT41|GALLIUM|Night Dragon|Axiom +T1210,Exploitation of Remote Services,Lateral Movement,Fox Kitten|menuPass|Wizard Spider|Threat Group-3390|APT28 +T1217,Browser Bookmark Discovery,Discovery,Chimera|Fox Kitten +T1213,Data from Information Repositories,Collection,Fox Kitten|FIN6|Turla +T1197,BITS Jobs,Defense Evasion|Persistence,APT39|Patchwork|APT41|Leviathan +T1219,Remote Access Software,Command And Control,Mustang Panda|MuddyWater|Evilnum|GOLD SOUTHFIELD|Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak +T1195,Supply Chain Compromise,Initial Access,no +T1204,User Execution,Execution,no T1212,Exploitation for Credential Access,Credential Access,no T1211,Exploitation for Defense Evasion,Defense Evasion,APT28 -T1190,Exploit Public-Facing Application,Initial Access,Blue Mockingbird|Rocke|APT39|BlackTech|APT41|Soft Cell|Night Dragon|Axiom -T1210,Exploitation of Remote Services,Lateral Movement,Threat Group-3390|APT28 -T1202,Indirect Command Execution,Defense Evasion,no T1200,Hardware Additions,Initial Access,DarkVishnya -T1201,Password Policy Discovery,Discovery,Turla|OilRig -T1219,Remote Access Software,Command And Control,Sandworm Team|DarkVishnya|RTM|Kimsuky|Night Dragon|Thrip|Cobalt Group|Carbanak +T1202,Indirect Command Execution,Defense Evasion,no +T1201,Password Policy Discovery,Discovery,Chimera|Turla|OilRig T1207,Rogue Domain Controller,Defense Evasion,no -T1199,Trusted Relationship,Initial Access,APT28|menuPass -T1218,Signed Binary Proxy Execution,Defense Evasion,no -T1204,User Execution,Execution,no +T1203,Exploitation for Client Execution,Execution,Mustang Panda|Darkhotel|Higaisa|HAFNIUM|Sidewinder|Sandworm Team|MuddyWater|Frankenstein|Inception|BlackTech|APT41|admin@338|Threat Group-3390|APT12|The White Company|APT33|APT32|APT28|Tropic Trooper|BRONZE BUTLER|Lazarus Group|Cobalt Group|APT37|Patchwork|APT29|TA459|Leviathan|Elderwood T1216,Signed Script Proxy Execution,Defense Evasion,no -T1195,Supply Chain Compromise,Initial Access,Elderwood +T1199,Trusted Relationship,Initial Access,Sandworm Team|GOLD SOUTHFIELD|APT28|menuPass +T1218,Signed Binary Proxy Execution,Defense Evasion,no T1205,Traffic Signaling,Defense Evasion|Persistence|Command And Control,no T1176,Browser Extensions,Persistence,Kimsuky|Stolen Pencil T1175,Component Object Model and Distributed COM,Lateral Movement|Execution,no T1187,Forced Authentication,Credential Access,DarkHydrus|Dragonfly 2.0 T1185,Man in the Browser,Collection,no -T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,Blue Mockingbird -T1136,Create Account,Persistence,no -T1140,Deobfuscate/Decode Files or Information,Defense Evasion,Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|menuPass|Honeybee|Threat Group-3390|APT19|Gorgon Group|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER T1149,LC_MAIN Hijacking,Defense Evasion,no -T1135,Network Share Discovery,Discovery,APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug +T1134,Access Token Manipulation,Defense Evasion|Privilege Escalation,FIN6|Blue Mockingbird +T1136,Create Account,Persistence,no T1137,Office Application Startup,Persistence,Gamaredon Group|APT32 +T1140,Deobfuscate/Decode Files or Information,Defense Evasion,APT39|APT29|ZIRCONIUM|Higaisa|UNC2452|Rocke|Sandworm Team|Gamaredon Group|Molerats|Frankenstein|Turla|WIRTE|Darkhotel|Tropic Trooper|Gorgon Group|menuPass|Honeybee|Threat Group-3390|APT19|Leviathan|MuddyWater|APT28|OilRig|BRONZE BUTLER +T1135,Network Share Discovery,Discovery,Chimera|Operation Wocao|Wizard Spider|APT32|APT39|DarkVishnya|APT41|Tropic Trooper|APT1|Dragonfly 2.0|Sowbug T1153,Source,Execution,no -T1133,External Remote Services,Persistence|Initial Access,Sandworm Team|APT41|Soft Cell|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 +T1133,External Remote Services,Persistence|Initial Access,APT29|UNC2452|Operation Wocao|Wizard Spider|Kimsuky|GOLD SOUTHFIELD|Chimera|Sandworm Team|APT41|GALLIUM|TEMP.Veles|Night Dragon|OilRig|Dragonfly 2.0|Ke3chang|FIN5|Threat Group-3390|APT18 T1132,Data Encoding,Command And Control,no T1129,Shared Modules,Execution,no T1127,Trusted Developer Utilities Proxy Execution,Defense Evasion,no T1125,Video Capture,Collection,Silence|FIN7 -T1124,System Time Discovery,Discovery,The White Company|Lazarus Group|BRONZE BUTLER|Turla +T1124,System Time Discovery,Discovery,Darkhotel|ZIRCONIUM|Higaisa|Sidewinder|Chimera|Operation Wocao|The White Company|Lazarus Group|BRONZE BUTLER|Turla T1123,Audio Capture,Collection,APT37 -T1120,Peripheral Device Discovery,Discovery,Turla|APT37|Gamaredon Group|Equation|APT28 -T1119,Automated Collection,Collection,Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 -T1115,Clipboard Data,Collection,APT39|APT38 -T1114,Email Collection,Collection,no -T1113,Screen Capture,Collection,Gamaredon Group|APT39|Silence|MuddyWater|Dragonfly 2.0|OilRig|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 -T1112,Modify Registry,Defense Evasion,Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Honeybee|Patchwork|Gorgon Group|FIN8 -T1111,Two-Factor Authentication Interception,Credential Access,no -T1110,Brute Force,Credential Access,DarkVishnya|APT39|OilRig|FIN5|Turla +T1120,Peripheral Device Discovery,Discovery,Operation Wocao|Turla|APT37|Gamaredon Group|Equation|APT28 +T1119,Automated Collection,Collection,Mustang Panda|Sidewinder|Chimera|menuPass|Operation Wocao|Gamaredon Group|Tropic Trooper|Frankenstein|APT1|APT28|Patchwork|OilRig|FIN5|Threat Group-3390|FIN6 +T1115,Clipboard Data,Collection,Operation Wocao|APT39|APT38 +T1114,Email Collection,Collection,Silent Librarian +T1113,Screen Capture,Collection,GOLD SOUTHFIELD|Gamaredon Group|APT39|Silence|MuddyWater|OilRig|Dragonfly 2.0|Dark Caracal|FIN7|BRONZE BUTLER|Magic Hound|Group5|APT28 +T1112,Modify Registry,Defense Evasion,Operation Wocao|Kimsuky|Lazarus Group|Gamaredon Group|Blue Mockingbird|Wizard Spider|Silence|APT41|Turla|APT32|APT38|Dragonfly 2.0|APT19|Threat Group-3390|Patchwork|Gorgon Group|Honeybee|FIN8 +T1111,Two-Factor Authentication Interception,Credential Access,Chimera|Operation Wocao +T1110,Brute Force,Credential Access,APT28|Fox Kitten|DarkVishnya|APT39|OilRig|FIN5|Turla T1108,Redundant Access,Defense Evasion|Persistence,no -T1106,Native API,Execution,Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|Gorgon Group|APT37 -T1105,Ingress Tool Transfer,Command And Control,Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|Soft Cell|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Turla|Gorgon Group|OilRig|Dragonfly 2.0|APT37|FIN8|PLATINUM|Leviathan|Elderwood|Magic Hound|APT3|APT32|BRONZE BUTLER|menuPass|FIN7|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 +T1106,Native API,Execution,Higaisa|menuPass|Operation Wocao|Chimera|Gamaredon Group|Tropic Trooper|Sharpshooter|Turla|Silence|APT37|Gorgon Group +T1105,Ingress Tool Transfer,Command And Control,HAFNIUM|APT29|Ajax Security Team|Mustang Panda|Windshift|Darkhotel|ZIRCONIUM|TA551|Volatile Cedar|Indrik Spider|Evilnum|Sidewinder|UNC2452|Fox Kitten|Kimsuky|Operation Wocao|Chimera|Sandworm Team|Whitefly|Rocke|APT39|Tropic Trooper|Sharpshooter|Molerats|Frankenstein|Silence|APT-C-36|APT41|GALLIUM|TA505|WIRTE|APT33|MuddyWater|APT18|APT38|Rancor|Cobalt Group|Gorgon Group|Turla|OilRig|Dragonfly 2.0|APT37|Leviathan|FIN8|PLATINUM|Elderwood|APT3|Magic Hound|APT32|BRONZE BUTLER|FIN7|menuPass|Gamaredon Group|Patchwork|Lazarus Group|Threat Group-3390|APT28 T1104,Multi-Stage Channels,Command And Control,APT41|MuddyWater|APT3 -T1102,Web Service,Command And Control,Gamaredon Group|Rocke|Inception|FIN6 +T1102,Web Service,Command And Control,Fox Kitten|Turla|APT32|Gamaredon Group|Rocke|Inception|FIN6 T1098,Account Manipulation,Persistence,APT3|Dragonfly 2.0|Lazarus Group -T1095,Non-Application Layer Protocol,Command And Control,APT29|PLATINUM|APT3 +T1095,Non-Application Layer Protocol,Command And Control,HAFNIUM|Operation Wocao|FIN6|APT29|PLATINUM|APT3 T1092,Communication Through Removable Media,Command And Control,APT28 -T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Tropic Trooper|Darkhotel|APT28 -T1090,Proxy,Command And Control,Sandworm Team|Blue Mockingbird|Wizard Spider|APT41|Turla -T1087,Account Discovery,Discovery,no -T1083,File and Directory Discovery,Discovery,Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Leafminer|Honeybee|Dark Caracal|Dragonfly 2.0|Magic Hound|Sowbug|BRONZE BUTLER|APT3|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang -T1082,System Information Discovery,Discovery,Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|Honeybee|APT19|APT37|APT32|Magic Hound|OilRig|APT3|Sowbug|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang -T1080,Taint Shared Content,Lateral Movement,BRONZE BUTLER|Darkhotel -T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,Sandworm Team|Wizard Spider|Silence|APT41|Soft Cell|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|Leviathan|APT33|OilRig|FIN5|menuPass|APT28|FIN10|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak +T1091,Replication Through Removable Media,Lateral Movement|Initial Access,Mustang Panda|Tropic Trooper|Darkhotel|APT28 +T1090,Proxy,Command And Control,Windigo|Fox Kitten|Operation Wocao|Sandworm Team|Blue Mockingbird|APT41|Turla +T1087,Account Discovery,Discovery,APT29|UNC2452 +T1083,File and Directory Discovery,Discovery,APT29|Mustang Panda|Darkhotel|Windigo|Sidewinder|Chimera|UNC2452|Fox Kitten|menuPass|APT39|Sandworm Team|Operation Wocao|Gamaredon Group|Tropic Trooper|Inception|APT41|Kimsuky|APT32|MuddyWater|APT18|Dragonfly 2.0|Leafminer|Honeybee|Dark Caracal|Magic Hound|APT3|BRONZE BUTLER|Sowbug|APT28|Patchwork|Lazarus Group|Dust Storm|admin@338|Turla|Ke3chang +T1082,System Information Discovery,Discovery,APT29|Mustang Panda|Windshift|ZIRCONIUM|Higaisa|Windigo|Sidewinder|UNC2452|Chimera|Operation Wocao|Wizard Spider|Rocke|Sandworm Team|Blue Mockingbird|Tropic Trooper|Frankenstein|Inception|Kimsuky|Darkhotel|MuddyWater|APT18|APT37|APT19|Honeybee|APT32|Magic Hound|Sowbug|OilRig|APT3|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|admin@338|Turla|Ke3chang +T1080,Taint Shared Content,Lateral Movement,Gamaredon Group|BRONZE BUTLER|Darkhotel +T1078,Valid Accounts,Defense Evasion|Persistence|Privilege Escalation|Initial Access,APT29|Silent Librarian|UNC2452|Fox Kitten|Operation Wocao|Chimera|Sandworm Team|Wizard Spider|Silence|APT41|GALLIUM|TEMP.Veles|APT39|FIN4|Night Dragon|Dragonfly 2.0|FIN8|APT33|Leviathan|OilRig|FIN5|menuPass|FIN10|APT28|Suckfly|FIN6|Threat Group-3390|APT18|PittyTiger|Carbanak T1074,Data Staged,Collection,Wizard Spider T1072,Software Deployment Tools,Execution|Lateral Movement,Silence|APT32|Threat Group-1314 T1071,Application Layer Protocol,Command And Control,Rocke|Magic Hound|Dragonfly 2.0 -T1070,Indicator Removal on Host,Defense Evasion,no -T1069,Permission Groups Discovery,Discovery,TA505|APT3 -T1068,Exploitation for Privilege Escalation,Privilege Escalation,Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 +T1070,Indicator Removal on Host,Defense Evasion,APT29|UNC2452 +T1069,Permission Groups Discovery,Discovery,APT29|UNC2452|TA505|APT3 +T1068,Exploitation for Privilege Escalation,Privilege Escalation,ZIRCONIUM|Turla|Whitefly|APT33|Cobalt Group|PLATINUM|FIN8|APT32|Threat Group-3390|FIN6|APT28 T1064,Scripting,Defense Evasion|Execution,no T1062,Hypervisor,Persistence,no T1061,Graphical User Interface,Execution,no -T1059,Command and Scripting Interpreter,Execution,APT32|Molerats|Whitefly|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang -T1057,Process Discovery,Discovery,Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang -T1056,Input Capture,Collection|Credential Access,no -T1055,Process Injection,Defense Evasion|Privilege Escalation,APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM +T1059,Command and Scripting Interpreter,Execution,Windigo|Fox Kitten|APT32|Whitefly|APT39|Dragonfly 2.0|APT19|FIN7|OilRig|FIN5|Stealth Falcon|FIN6|Ke3chang +T1057,Process Discovery,Discovery,APT29|Mustang Panda|Windshift|Higaisa|Sidewinder|Chimera|UNC2452|Operation Wocao|Rocke|Frankenstein|Inception|Darkhotel|MuddyWater|APT1|APT38|Tropic Trooper|APT37|Honeybee|OilRig|APT3|Magic Hound|APT28|Winnti Group|Stealth Falcon|Poseidon Group|Lazarus Group|Molerats|Turla|Deep Panda|Ke3chang +T1056,Input Capture,Collection|Credential Access,APT39 +T1055,Process Injection,Defense Evasion|Privilege Escalation,Operation Wocao|APT32|Sharpshooter|Silence|APT41|Kimsuky|Turla|Cobalt Group|APT37|Honeybee|PLATINUM T1053,Scheduled Task/Job,Execution|Persistence|Privilege Escalation,no T1052,Exfiltration Over Physical Medium,Exfiltration,no T1051,Shared Webroot,Lateral Movement,no -T1049,System Network Connections Discovery,Discovery,Tropic Trooper|APT41|APT38|Soft Cell|APT32|APT1|OilRig|APT3|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang +T1049,System Network Connections Discovery,Discovery,Mustang Panda|MuddyWater|Chimera|Sandworm Team|Operation Wocao|Tropic Trooper|APT41|APT38|GALLIUM|APT32|APT1|APT3|OilRig|menuPass|Threat Group-3390|Poseidon Group|admin@338|Turla|Ke3chang T1048,Exfiltration Over Alternative Protocol,Exfiltration,no -T1047,Windows Management Instrumentation,Execution,Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|Soft Cell|APT32|MuddyWater|OilRig|Threat Group-3390|FIN8|Leviathan|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda -T1046,Network Service Scanning,Discovery,Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|Leafminer|OilRig|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 -T1043,Commonly Used Port,Command And Control,Machete|OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|Dragonfly 2.0|FIN7|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 -T1041,Exfiltration Over C2 Channel,Exfiltration,Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|Soft Cell|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang -T1040,Network Sniffing,Credential Access|Discovery,Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 -T1039,Data from Network Shared Drive,Collection,Sowbug|BRONZE BUTLER|menuPass +T1047,Windows Management Instrumentation,Execution,Mustang Panda|Windshift|UNC2452|Operation Wocao|Chimera|Blue Mockingbird|Wizard Spider|Frankenstein|APT41|FIN6|GALLIUM|APT32|MuddyWater|OilRig|Threat Group-3390|Leviathan|FIN8|menuPass|Stealth Falcon|Lazarus Group|APT29|Deep Panda +T1046,Network Service Scanning,Discovery,Chimera|Fox Kitten|Operation Wocao|Rocke|DarkVishnya|APT41|Tropic Trooper|APT39|APT32|OilRig|Leafminer|Cobalt Group|menuPass|Suckfly|FIN6|Threat Group-3390 +T1043,Commonly Used Port,Command And Control,OilRig|APT28|TEMP.Veles|Night Dragon|APT29|APT18|APT19|FIN7|Dragonfly 2.0|FIN8|APT37|Magic Hound|APT3|Lazarus Group|Threat Group-3390 +T1041,Exfiltration Over C2 Channel,Exfiltration,ZIRCONIUM|Higaisa|Chimera|APT39|Operation Wocao|Sandworm Team|MuddyWater|Wizard Spider|Frankenstein|Kimsuky|GALLIUM|APT32|APT3|Gamaredon Group|Stealth Falcon|Lazarus Group|Ke3chang +T1040,Network Sniffing,Credential Access|Discovery,Kimsuky|Sandworm Team|DarkVishnya|APT33|Stolen Pencil|APT28 +T1039,Data from Network Shared Drive,Collection,Chimera|Fox Kitten|Gamaredon Group|Sowbug|BRONZE BUTLER|menuPass T1037,Boot or Logon Initialization Scripts,Persistence|Privilege Escalation,Rocke -T1036,Masquerading,Defense Evasion,Windshift|APT32|BRONZE BUTLER|menuPass|Dragonfly 2.0 +T1036,Masquerading,Defense Evasion,APT29|Mustang Panda|ZIRCONIUM|TA551|UNC2452|Windshift|APT32|BRONZE BUTLER|menuPass|PLATINUM|Dragonfly 2.0 T1034,Path Interception,Persistence|Privilege Escalation,no -T1033,System Owner/User Discovery,Discovery,Frankenstein|APT41|Soft Cell|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 +T1033,System Owner/User Discovery,Discovery,Windshift|ZIRCONIUM|Sidewinder|Chimera|Sandworm Team|Operation Wocao|Wizard Spider|Frankenstein|APT41|GALLIUM|Tropic Trooper|APT39|MuddyWater|APT32|APT37|APT19|Dragonfly 2.0|OilRig|Magic Hound|FIN10|Gamaredon Group|Patchwork|Stealth Falcon|Lazarus Group|APT3 T1030,Data Transfer Size Limits,Exfiltration,Threat Group-3390 -T1029,Scheduled Transfer,Exfiltration,no -T1027,Obfuscated Files or Information,Defense Evasion,Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|Machete|Soft Cell|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Cobalt Group|Patchwork|Leafminer|APT37|Threat Group-3390|Honeybee|Dark Caracal|menuPass|APT19|BlackOasis|FIN8|Leviathan|Elderwood|MuddyWater|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 +T1029,Scheduled Transfer,Exfiltration,Higaisa +T1027,Obfuscated Files or Information,Defense Evasion,APT39|Mustang Panda|Windshift|TA551|Higaisa|Sidewinder|UNC2452|Fox Kitten|GOLD SOUTHFIELD|Operation Wocao|Kimsuky|FIN6|Chimera|Gamaredon Group|Rocke|Sandworm Team|Blue Mockingbird|Whitefly|Molerats|Wizard Spider|Mofang|Frankenstein|Inception|APT-C-36|APT41|GALLIUM|Turla|TA505|Silence|APT33|Night Dragon|Darkhotel|Gallmaker|APT29|APT18|Tropic Trooper|Patchwork|APT37|Honeybee|menuPass|Leafminer|Cobalt Group|Threat Group-3390|Dark Caracal|APT19|FIN8|BlackOasis|MuddyWater|Elderwood|Leviathan|FIN7|Magic Hound|OilRig|APT3|APT32|Group5|Dust Storm|Lazarus Group|Putter Panda|APT28 T1026,Multiband Communication,Command And Control,Lazarus Group -T1025,Data from Removable Media,Collection,Machete|Turla|Gamaredon Group|APT28 +T1025,Data from Removable Media,Collection,Turla|Gamaredon Group|APT28 T1021,Remote Services,Lateral Movement,no -T1020,Automated Exfiltration,Exfiltration,Tropic Trooper|Frankenstein|Honeybee -T1018,Remote System Discovery,Discovery,Sandworm Team|Rocke|Wizard Spider|Silence|Soft Cell|APT39|APT32|Deep Panda|Threat Group-3390|Dragonfly 2.0|Leafminer|Ke3chang|FIN8|APT3|FIN5|BRONZE BUTLER|menuPass|FIN6|Turla -T1016,System Network Configuration Discovery,Discovery,Sandworm Team|Tropic Trooper|Frankenstein|APT41|Soft Cell|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|Magic Hound|OilRig|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang +T1020,Automated Exfiltration,Exfiltration,Sidewinder|Gamaredon Group|Tropic Trooper|Frankenstein|Honeybee +T1018,Remote System Discovery,Discovery,APT29|UNC2452|Chimera|Fox Kitten|Operation Wocao|Sandworm Team|Rocke|Wizard Spider|Silence|GALLIUM|APT39|APT32|Dragonfly 2.0|Deep Panda|Threat Group-3390|Leafminer|Ke3chang|FIN8|FIN5|APT3|BRONZE BUTLER|menuPass|FIN6|Turla +T1016,System Network Configuration Discovery,Discovery,ZIRCONIUM|Mustang Panda|Higaisa|Sidewinder|Chimera|Operation Wocao|Wizard Spider|Sandworm Team|Tropic Trooper|Frankenstein|APT41|GALLIUM|APT32|Darkhotel|MuddyWater|APT1|APT19|Dragonfly 2.0|OilRig|Magic Hound|menuPass|Threat Group-3390|Stealth Falcon|Lazarus Group|APT3|Naikon|admin@338|Turla|Ke3chang T1014,Rootkit,Defense Evasion,Rocke|APT41|APT28|Winnti Group -T1012,Query Registry,Discovery,APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla +T1012,Query Registry,Discovery,ZIRCONIUM|Chimera|Fox Kitten|APT39|Operation Wocao|APT32|Dragonfly 2.0|Threat Group-3390|OilRig|Stealth Falcon|Lazarus Group|Turla T1011,Exfiltration Over Other Network Medium,Exfiltration,no T1010,Application Window Discovery,Discovery,Lazarus Group -T1008,Fallback Channels,Command And Control,APT41|OilRig|Lazarus Group -T1007,System Service Discovery,Discovery,BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang +T1008,Fallback Channels,Command And Control,Carbanak|APT41|OilRig|Lazarus Group +T1007,System Service Discovery,Discovery,Chimera|Operation Wocao|BRONZE BUTLER|APT1|OilRig|Poseidon Group|admin@338|Turla|Ke3chang T1006,Direct Volume Access,Defense Evasion,no -T1005,Data from Local System,Collection,Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|Soft Cell|Turla|menuPass|Dark Caracal|Dragonfly 2.0|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang +T1005,Data from Local System,Collection,APT29|Windigo|UNC2452|Fox Kitten|Sandworm Team|Operation Wocao|FIN6|Gamaredon Group|APT39|Frankenstein|Inception|Kimsuky|GALLIUM|Turla|menuPass|Dragonfly 2.0|Dark Caracal|Honeybee|APT37|APT28|APT3|BRONZE BUTLER|Patchwork|Stealth Falcon|Lazarus Group|Dust Storm|Threat Group-3390|APT1|Ke3chang T1003,OS Credential Dumping,Credential Access,APT39|Frankenstein|APT32|APT28|Leviathan|Sowbug|Suckfly|Poseidon Group|Axiom -T1001,Data Obfuscation,Command And Control,Axiom +T1001,Data Obfuscation,Command And Control,Operation Wocao|Axiom From 1fca39be77f23ea0c015b6ed2020ac0d076d795a Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 20 Jul 2021 16:41:53 +0200 Subject: [PATCH 07/21] updated generate --- detections/experimental/cloud/gcp_detect_gcploit_framework.yml | 1 + spec/detections.spec.json | 1 + 2 files changed, 2 insertions(+) diff --git a/detections/experimental/cloud/gcp_detect_gcploit_framework.yml b/detections/experimental/cloud/gcp_detect_gcploit_framework.yml index 1e1f89c240..2c013ad8f8 100644 --- a/detections/experimental/cloud/gcp_detect_gcploit_framework.yml +++ b/detections/experimental/cloud/gcp_detect_gcploit_framework.yml @@ -4,6 +4,7 @@ version: 1 date: '2020-10-08' author: Rod Soto, Splunk type: TTP +datamodel: [] description: This search provides detection of GCPloit exploitation framework. This framework can be used to escalate privileges and move laterally from compromised high privilege accounts. diff --git a/spec/detections.spec.json b/spec/detections.spec.json index f3450d5fc4..14e2026fcf 100644 --- a/spec/detections.spec.json +++ b/spec/detections.spec.json @@ -185,6 +185,7 @@ "id", "version", "date", + "datamodel", "description", "type", "author", From 084824e2b78d7c6ea99dfb7e1cd4318c72148fd6 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Tue, 20 Jul 2021 16:48:35 +0200 Subject: [PATCH 08/21] update detections with type --- bin/validate.py | 4 ++-- detections/endpoint/extract_sam_from_registry.yml | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index d72c6015c5..6093f80f54 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -92,8 +92,8 @@ def validate_objects(REPO_PATH, objects, verbose): def validate_fields(object): errors = [] - # if object['type'] not in ['TTP', 'Anomaly', 'Hunting', 'Baseline', 'Investigation', 'Correlation']: - # errors.append('ERROR: invalid type [TTP, Anomaly, Hunting, Baseline, Investigation, Correlation] for object: %s' % object['name']) + if object['type'] not in ['TTP', 'Anomaly', 'Hunting', 'Baseline', 'Investigation', 'Correlation']: + errors.append('ERROR: invalid type [TTP, Anomaly, Hunting, Baseline, Investigation, Correlation] for object: %s' % object['name']) if 'tags' in object: diff --git a/detections/endpoint/extract_sam_from_registry.yml b/detections/endpoint/extract_sam_from_registry.yml index cd9101f63c..69a71656a5 100644 --- a/detections/endpoint/extract_sam_from_registry.yml +++ b/detections/endpoint/extract_sam_from_registry.yml @@ -3,7 +3,7 @@ id: 8bbb7d58-b360-11eb-ba21-acde48001122 version: 1 date: '2021-05-12' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: - Endpoint description: The following analytic identifies the use of `reg.exe` exporting Windows From d633c925132748a5152c45054a6d6bec45c1c20e Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 21 Jul 2021 09:24:07 +0200 Subject: [PATCH 09/21] bug fix --- .../malicious_powershell_process___execution_policy_bypass.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 3b70b9ee22..285cf5331b 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -4,6 +4,7 @@ version: 4 date: '2020-07-21' author: Rico Valdez, Mauricio Velazco, Splunk type: TTP +datamodel: - Endpoint description: This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed From 76bbbe46092e281f0e63e2ef8735c611b19b2110 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 21 Jul 2021 11:31:40 +0200 Subject: [PATCH 10/21] add deployments to baselines --- bin/validate.py | 3 + .../baseline_of_api_calls_per_user_arn.yml | 2 + ...e_of_blocked_outbound_traffic_from_aws.yml | 2 + ..._aws_instances_launched_by_user___mltk.yml | 2 + ...ws_instances_terminated_by_user___mltk.yml | 2 + ...aseline_of_network_acl_activity_by_arn.yml | 2 + ..._of_s3_bucket_deletion_activity_by_arn.yml | 2 + ...line_of_security_group_activity_by_arn.yml | 2 + ..._list_of_approved_aws_service_accounts.yml | 2 + ..._api_call_per_user_roles_in_cloudtrail.yml | 2 + ...iously_seen_aws_cross_account_activity.yml | 2 + ...seen_aws_provisioning_activity_sources.yml | 2 + .../cloud/previously_seen_aws_regions.yml | 2 + detections/cloud/previously_seen_ec2_amis.yml | 2 + .../previously_seen_ec2_instance_types.yml | 2 + .../previously_seen_ec2_launches_by_user.yml | 2 + ...viously_seen_ec2_modifications_by_user.yml | 2 + ...sly_seen_s3_bucket_access_by_remote_ip.yml | 2 + .../previously_seen_users_in_cloudtrail.yml | 2 + ...te_previously_seen_users_in_cloudtrail.yml | 2 + ...bited_processes_to_enterprise_security.yml | 2 + ...baseline_of_command_line_length___mltk.yml | 2 + .../endpoint/count_of_assets_by_category.yml | 2 + .../identify_systems_using_remote_desktop.yml | 2 + .../endpoint/monitor_successful_backups.yml | 2 + .../endpoint/monitor_unsuccessful_backups.yml | 2 + ...previously_seen_command_line_arguments.yml | 2 + ...ady_for_spectre_meltdown_windows_patch.yml | 2 + .../windows_updates_install_failures.yml | 2 + .../windows_updates_install_successes.yml | 2 + .../baseline_of_dns_query_length___mltk.yml | 2 + .../baseline_of_smb_traffic___mltk.yml | 2 + ...ount_of_unique_ips_connecting_to_ports.yml | 2 + detections/network/discover_dns_records.yml | 2 + detections/network/dnstwist_domain_names.yml | 2 + ...ystems_creating_remote_desktop_traffic.yml | 2 + ...stems_receiving_remote_desktop_traffic.yml | 2 + dist/escu/default/analytic_stories.conf | 2 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 6616 +++++------------ dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 5 +- 43 files changed, 1907 insertions(+), 4797 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index ffebe0e7d9..13a7a34f7a 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -186,6 +186,9 @@ def validate_detection_search(object, macros): if not object['type'] == "Baseline": if not '_filter' in object['search']: errors.append("ERROR: Missing filter for detection: " + object['name']) + else: + if not 'deployments' in object['tags']: + errors.append("ERROR: Baseline need a ccorresponsing deployments: " + object['name']) filter_macro = re.search("([a-z0-9_]*_filter)", object['search']) diff --git a/detections/cloud/baseline_of_api_calls_per_user_arn.yml b/detections/cloud/baseline_of_api_calls_per_user_arn.yml index afbf3db46f..013c101f0a 100644 --- a/detections/cloud/baseline_of_api_calls_per_user_arn.yml +++ b/detections/cloud/baseline_of_api_calls_per_user_arn.yml @@ -24,6 +24,8 @@ tags: - AWS User Monitoring detections: - Detect Spike in AWS API Activity + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml b/detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml index c9076612d3..db3717d0db 100644 --- a/detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml +++ b/detections/cloud/baseline_of_blocked_outbound_traffic_from_aws.yml @@ -30,6 +30,8 @@ tags: - Suspicious AWS Traffic detections: - Detect Spike in blocked Outbound Traffic from your AWS + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml b/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml index ddc8c6bfe5..06f09aac78 100644 --- a/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml +++ b/detections/cloud/baseline_of_excessive_aws_instances_launched_by_user___mltk.yml @@ -35,6 +35,8 @@ tags: - Suspicious AWS EC2 Activities detections: - Abnormally High AWS Instances Launched by User - MLTK + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml b/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml index 5e5f375eb9..5663770ddd 100644 --- a/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml +++ b/detections/cloud/baseline_of_excessive_aws_instances_terminated_by_user___mltk.yml @@ -35,6 +35,8 @@ tags: - Suspicious AWS EC2 Activities detections: - Abnormally High AWS Instances Terminated by User - MLTK + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/baseline_of_network_acl_activity_by_arn.yml b/detections/cloud/baseline_of_network_acl_activity_by_arn.yml index c81a98ef2c..26756f0084 100644 --- a/detections/cloud/baseline_of_network_acl_activity_by_arn.yml +++ b/detections/cloud/baseline_of_network_acl_activity_by_arn.yml @@ -25,6 +25,8 @@ tags: - AWS Network ACL Activity detections: - Detect Spike in Network ACL Activity + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml b/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml index 033488e995..a9b03f331a 100644 --- a/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml +++ b/detections/cloud/baseline_of_s3_bucket_deletion_activity_by_arn.yml @@ -24,6 +24,8 @@ tags: - Suspicious AWS S3 Activities detections: - Detect Spike in S3 Bucket deletion + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/baseline_of_security_group_activity_by_arn.yml b/detections/cloud/baseline_of_security_group_activity_by_arn.yml index 227a8b72ec..45659a2ca1 100644 --- a/detections/cloud/baseline_of_security_group_activity_by_arn.yml +++ b/detections/cloud/baseline_of_security_group_activity_by_arn.yml @@ -25,6 +25,8 @@ tags: - AWS User Monitoring detections: - Detect Spike in Security Group Activity + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml b/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml index af4226cacb..0f04d79404 100644 --- a/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml +++ b/detections/cloud/create_a_list_of_approved_aws_service_accounts.yml @@ -23,6 +23,8 @@ tags: - AWS User Monitoring detections: - Detect AWS API Activities From Unapproved Accounts + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml b/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml index 770b305ae9..9f044cfe8e 100644 --- a/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml +++ b/detections/cloud/previously_seen_api_call_per_user_roles_in_cloudtrail.yml @@ -24,6 +24,8 @@ tags: - AWS User Monitoring detections: - Detect new API calls from user roles + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/previously_seen_aws_cross_account_activity.yml b/detections/cloud/previously_seen_aws_cross_account_activity.yml index 4214f2cade..6d7c41e31c 100644 --- a/detections/cloud/previously_seen_aws_cross_account_activity.yml +++ b/detections/cloud/previously_seen_aws_cross_account_activity.yml @@ -24,6 +24,8 @@ tags: - AWS Cross Account Activity detections: - AWS Cross Account Activity From Previously Unseen Account + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml b/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml index 08b0334bd3..c50c525af2 100644 --- a/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml +++ b/detections/cloud/previously_seen_aws_provisioning_activity_sources.yml @@ -25,6 +25,8 @@ tags: - AWS Cloud Provisioning From Previously Unseen City - AWS Cloud Provisioning From Previously Unseen Country - AWS Cloud Provisioning From Previously Unseen Region + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/previously_seen_aws_regions.yml b/detections/cloud/previously_seen_aws_regions.yml index 7b33b338a7..dab12a6d86 100644 --- a/detections/cloud/previously_seen_aws_regions.yml +++ b/detections/cloud/previously_seen_aws_regions.yml @@ -22,6 +22,8 @@ tags: - Suspicious AWS EC2 Activities detections: - EC2 Instance Started In Previously Unseen Region + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/previously_seen_ec2_amis.yml b/detections/cloud/previously_seen_ec2_amis.yml index 6f8fff93e7..2661789201 100644 --- a/detections/cloud/previously_seen_ec2_amis.yml +++ b/detections/cloud/previously_seen_ec2_amis.yml @@ -20,6 +20,8 @@ tags: - AWS Cryptomining detections: - EC2 Instance Started With Previously Unseen AMI + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/previously_seen_ec2_instance_types.yml b/detections/cloud/previously_seen_ec2_instance_types.yml index 508004f369..c582f661fb 100644 --- a/detections/cloud/previously_seen_ec2_instance_types.yml +++ b/detections/cloud/previously_seen_ec2_instance_types.yml @@ -20,6 +20,8 @@ tags: - AWS Cryptomining detections: - EC2 Instance Started With Previously Unseen Instance Type + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/previously_seen_ec2_launches_by_user.yml b/detections/cloud/previously_seen_ec2_launches_by_user.yml index c6c38626f3..e2350c9b82 100644 --- a/detections/cloud/previously_seen_ec2_launches_by_user.yml +++ b/detections/cloud/previously_seen_ec2_launches_by_user.yml @@ -21,6 +21,8 @@ tags: - Suspicious AWS EC2 Activities detections: - EC2 Instance Started With Previously Unseen User + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/previously_seen_ec2_modifications_by_user.yml b/detections/cloud/previously_seen_ec2_modifications_by_user.yml index b5dd318e51..2c9c8ae30c 100644 --- a/detections/cloud/previously_seen_ec2_modifications_by_user.yml +++ b/detections/cloud/previously_seen_ec2_modifications_by_user.yml @@ -20,6 +20,8 @@ tags: - Unusual AWS EC2 Modifications detections: - EC2 Instance Modified With Previously Unseen User + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml b/detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml index 0cdf91a2a1..4e027f91f8 100644 --- a/detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml +++ b/detections/cloud/previously_seen_s3_bucket_access_by_remote_ip.yml @@ -23,6 +23,8 @@ tags: - Suspicious AWS S3 Activities detections: - Detect S3 access from a new IP + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/previously_seen_users_in_cloudtrail.yml b/detections/cloud/previously_seen_users_in_cloudtrail.yml index 3b6c389848..8b60535ccd 100644 --- a/detections/cloud/previously_seen_users_in_cloudtrail.yml +++ b/detections/cloud/previously_seen_users_in_cloudtrail.yml @@ -28,6 +28,8 @@ tags: - Detect AWS Console Login by User from New Region - Detect AWS Console Login by User from New City - Detect new user AWS Console Login + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/cloud/update_previously_seen_users_in_cloudtrail.yml b/detections/cloud/update_previously_seen_users_in_cloudtrail.yml index 703754631e..856dbee2f9 100644 --- a/detections/cloud/update_previously_seen_users_in_cloudtrail.yml +++ b/detections/cloud/update_previously_seen_users_in_cloudtrail.yml @@ -30,6 +30,8 @@ tags: - Detect AWS Console Login by User from New Region - Detect AWS Console Login by User from New City - Detect new user AWS Console Login + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/deprecated/add_prohibited_processes_to_enterprise_security.yml b/detections/deprecated/add_prohibited_processes_to_enterprise_security.yml index b4a2986cdc..bcfa1b6a86 100644 --- a/detections/deprecated/add_prohibited_processes_to_enterprise_security.yml +++ b/detections/deprecated/add_prohibited_processes_to_enterprise_security.yml @@ -22,6 +22,8 @@ tags: - SamSam Ransomware detections: - Prohibited Software On Endpoint + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/baseline_of_command_line_length___mltk.yml b/detections/endpoint/baseline_of_command_line_length___mltk.yml index 6977e800b2..a2f0d25907 100644 --- a/detections/endpoint/baseline_of_command_line_length___mltk.yml +++ b/detections/endpoint/baseline_of_command_line_length___mltk.yml @@ -37,6 +37,8 @@ tags: detections: - Detect Prohibited Applications Spawning cmd.exe - Unusually Long Command Line - MLTK + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/count_of_assets_by_category.yml b/detections/endpoint/count_of_assets_by_category.yml index 5ea968fa31..a175cfe253 100644 --- a/detections/endpoint/count_of_assets_by_category.yml +++ b/detections/endpoint/count_of_assets_by_category.yml @@ -21,6 +21,8 @@ tags: - Asset Tracking detections: - Detect Unauthorized Assets by MAC address + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/identify_systems_using_remote_desktop.yml b/detections/endpoint/identify_systems_using_remote_desktop.yml index 0b8f0f974e..7fb92f4a0d 100644 --- a/detections/endpoint/identify_systems_using_remote_desktop.yml +++ b/detections/endpoint/identify_systems_using_remote_desktop.yml @@ -20,6 +20,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + deployments: + - Daily Cache Updates required_fields: - _time - Processes.process_name diff --git a/detections/endpoint/monitor_successful_backups.yml b/detections/endpoint/monitor_successful_backups.yml index 68d32b36e8..158a83df4b 100644 --- a/detections/endpoint/monitor_successful_backups.yml +++ b/detections/endpoint/monitor_successful_backups.yml @@ -24,6 +24,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + deployments: + - Daily Cache Updates required_fields: - _time security_domain: endpoint \ No newline at end of file diff --git a/detections/endpoint/monitor_unsuccessful_backups.yml b/detections/endpoint/monitor_unsuccessful_backups.yml index e3c7901a6f..77306bb7b3 100644 --- a/detections/endpoint/monitor_unsuccessful_backups.yml +++ b/detections/endpoint/monitor_unsuccessful_backups.yml @@ -19,6 +19,8 @@ tags: - Monitor Backup Solution detections: - Unsuccessful Netbackup backups + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/previously_seen_command_line_arguments.yml b/detections/endpoint/previously_seen_command_line_arguments.yml index 329d32879a..1ae345f1e9 100644 --- a/detections/endpoint/previously_seen_command_line_arguments.yml +++ b/detections/endpoint/previously_seen_command_line_arguments.yml @@ -33,6 +33,8 @@ tags: - Detect Prohibited Applications Spawning cmd.exe - Processes launching netsh - First time seen command line argument + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/systems_ready_for_spectre_meltdown_windows_patch.yml b/detections/endpoint/systems_ready_for_spectre_meltdown_windows_patch.yml index 974c11d66d..d4cb2ecb1f 100644 --- a/detections/endpoint/systems_ready_for_spectre_meltdown_windows_patch.yml +++ b/detections/endpoint/systems_ready_for_spectre_meltdown_windows_patch.yml @@ -26,6 +26,8 @@ tags: - Spectre And Meltdown Vulnerabilities detections: - Spectre and Meltdown Vulnerable Systems + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/endpoint/windows_updates_install_failures.yml b/detections/endpoint/windows_updates_install_failures.yml index 7a6b08393e..4afd64ac90 100644 --- a/detections/endpoint/windows_updates_install_failures.yml +++ b/detections/endpoint/windows_updates_install_failures.yml @@ -19,6 +19,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + deployments: + - Daily Cache Updates required_fields: - _time - Updates.vendor_product diff --git a/detections/endpoint/windows_updates_install_successes.yml b/detections/endpoint/windows_updates_install_successes.yml index 2c1d4d7739..2809d2cc2d 100644 --- a/detections/endpoint/windows_updates_install_successes.yml +++ b/detections/endpoint/windows_updates_install_successes.yml @@ -19,6 +19,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + deployments: + - Daily Cache Updates required_fields: - _time - Updates.vendor_product diff --git a/detections/network/baseline_of_dns_query_length___mltk.yml b/detections/network/baseline_of_dns_query_length___mltk.yml index fd64262cec..c0545205b9 100644 --- a/detections/network/baseline_of_dns_query_length___mltk.yml +++ b/detections/network/baseline_of_dns_query_length___mltk.yml @@ -32,6 +32,8 @@ tags: - Suspicious DNS Traffic detections: - DNS Query Length Outliers - MLTK + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/network/baseline_of_smb_traffic___mltk.yml b/detections/network/baseline_of_smb_traffic___mltk.yml index 7294e1a00d..c57d7c7ca8 100644 --- a/detections/network/baseline_of_smb_traffic___mltk.yml +++ b/detections/network/baseline_of_smb_traffic___mltk.yml @@ -43,6 +43,8 @@ tags: detections: - Processes launching netsh - SMB Traffic Spike - MLTK + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/network/count_of_unique_ips_connecting_to_ports.yml b/detections/network/count_of_unique_ips_connecting_to_ports.yml index dbd99e65ce..dc1114a9f4 100644 --- a/detections/network/count_of_unique_ips_connecting_to_ports.yml +++ b/detections/network/count_of_unique_ips_connecting_to_ports.yml @@ -20,6 +20,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + deployments: + - Daily Cache Updates required_fields: - _time - All_Traffic.dest_port diff --git a/detections/network/discover_dns_records.yml b/detections/network/discover_dns_records.yml index b6395fb2a5..1bdceda87f 100644 --- a/detections/network/discover_dns_records.yml +++ b/detections/network/discover_dns_records.yml @@ -29,6 +29,8 @@ tags: - DNS Hijacking detections: - DNS record changed + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/network/dnstwist_domain_names.yml b/detections/network/dnstwist_domain_names.yml index c213db75ac..ef588ff3bb 100644 --- a/detections/network/dnstwist_domain_names.yml +++ b/detections/network/dnstwist_domain_names.yml @@ -23,6 +23,8 @@ tags: - Monitor Email For Brand Abuse - Monitor DNS For Brand Abuse - Monitor Web Traffic For Brand Abuse + deployments: + - Daily Cache Updates product: - Splunk Enterprise - Splunk Enterprise Security diff --git a/detections/network/identify_systems_creating_remote_desktop_traffic.yml b/detections/network/identify_systems_creating_remote_desktop_traffic.yml index 0ed6b55665..591d29c9c8 100644 --- a/detections/network/identify_systems_creating_remote_desktop_traffic.yml +++ b/detections/network/identify_systems_creating_remote_desktop_traffic.yml @@ -20,6 +20,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + deployments: + - Daily Cache Updates required_fields: - _time - All_Traffic.dest_port diff --git a/detections/network/identify_systems_receiving_remote_desktop_traffic.yml b/detections/network/identify_systems_receiving_remote_desktop_traffic.yml index 5daf1758ac..036499b340 100644 --- a/detections/network/identify_systems_receiving_remote_desktop_traffic.yml +++ b/detections/network/identify_systems_receiving_remote_desktop_traffic.yml @@ -21,6 +21,8 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud + deployments: + - Daily Cache Updates required_fields: - _time - All_Traffic.dest_port diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 203d6215e1..b879113292 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T14:08:27 UTC +# On Date: 2021-07-21T07:45:07 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index cc0d24aca2..9d278c1a6c 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T14:08:27 UTC +# On Date: 2021-07-21T07:45:06 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 2a811b0cc9..485d8f5b8d 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T14:08:27 UTC +# On Date: 2021-07-21T07:45:07 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index fa6035ed0a..ecf25d610a 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T14:08:27 UTC +# On Date: 2021-07-21T07:45:06 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1925,8 +1925,6 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"] -<<<<<<< HEAD -======= action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system @@ -1934,17 +1932,12 @@ action.risk.param._risk_score = 64 action.risk.param._risk_message = An attacker tool $process_name$,listed in attacker_tools.csv is executed on host $dest$ by User $user$. This process $process_name$ is known to do- $description$ action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Attacker Tools On Endpoint - Rule -<<<<<<< HEAD -action.correlationsearch.annotations = {"analytic_story": ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1595", "T1003"], "nist": ["ID.AM", "PR.DS"]} -======= action.correlationsearch.annotations = {"analytic_story": ["Monitor for Unauthorized Software", "XMRig", "SamSam Ransomware", "Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exploitation", "Stage:Recon", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1036.005", "T1595", "T1003"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process", "Attacker"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2267,7 +2260,6 @@ action.escu.full_search_name = ESCU - Baseline Of Cloud Infrastructure API Calls action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud User Activities"] cron_schedule = 0 2 * * 0 dispatch.earliest_time = -90d@d @@ -2275,22 +2267,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline Of Cloud Infrastructure API Calls Per User - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} -======= -action.escu.analytic_story = ["SamSam Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Batch File Write to System32 - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2320,7 +2296,6 @@ action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Destroyed action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"] cron_schedule = 0 2 * * 0 dispatch.earliest_time = -90d@d @@ -2328,22 +2303,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline Of Cloud Instances Destroyed - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"]} -======= -action.escu.analytic_story = ["Cobalt Strike"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - CMD Echo Pipe - Escalation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2373,7 +2332,6 @@ action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Launched action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] cron_schedule = 0 2 * * 0 dispatch.earliest_time = -90d@d @@ -2381,22 +2339,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline Of Cloud Instances Launched - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]} -======= -action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] -action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "ImageLoaded", "threat_object_type": "other"}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2425,7 +2367,6 @@ action.escu.full_search_name = ESCU - Baseline Of Cloud Security Group API Calls action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud User Activities"] cron_schedule = 0 2 * * 0 dispatch.earliest_time = -90d@d @@ -2433,22 +2374,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline Of Cloud Security Group API Calls Per User - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} -======= -action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - CertUtil Download With URLCache and Split Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command and Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -2477,29 +2402,13 @@ action.escu.full_search_name = ESCU - Baseline of API Calls per User ARN action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS User Monitoring"] -======= -action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Baseline of API Calls per User ARN - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} -======= -action.correlationsearch.label = ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command and Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. @@ -2533,29 +2442,13 @@ action.escu.full_search_name = ESCU - Baseline of Command Line Length - MLTK action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"] -======= -action.escu.analytic_story = ["Deobfuscate-Decode Files or Information"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 40 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Baseline of Command Line Length - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"]} -======= -action.correlationsearch.label = ESCU - CertUtil With Decode Argument - Rule -action.correlationsearch.annotations = {"analytic_story": ["Deobfuscate-Decode Files or Information"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -2577,7 +2470,6 @@ search = | tstats `security_content_summariesonly` count min(_time) as start_tim [ESCU - Baseline of DNS Query Length - MLTK - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. action.escu.mappings = {} action.escu.data_models = ["Network_Resolution"] @@ -2586,38 +2478,16 @@ action.escu.how_to_implement = To successfully implement this search, you will n action.escu.known_false_positives = none action.escu.creation_date = 2019-05-08 action.escu.modification_date = 2019-05-08 -======= -description = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. -action.escu.mappings = {"kill_chain_phases": ["Installation"]} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. -action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -action.escu.known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. -action.escu.creation_date = 2021-01-26 -action.escu.modification_date = 2021-01-26 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Baseline of DNS Query Length - MLTK action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"] -======= -action.escu.analytic_story = ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Baseline of DNS Query Length - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"]} schedule_window = auto @@ -2625,16 +2495,6 @@ action.notable = 1 action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. action.notable.param.rule_title = Baseline of DNS Query Length - MLTK action.notable.param.security_domain = network -======= -action.correlationsearch.label = ESCU - Certutil exe certificate extraction - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Installation"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} -schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. -action.notable.param.rule_title = Certutil exe certificate extraction -action.notable.param.security_domain = endpoint ->>>>>>> develop action.notable.param.severity = high alert.digest_mode = 1 disabled = true @@ -2645,11 +2505,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel -======= -search = | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter` ->>>>>>> develop [ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK - Rule] action.escu = 0 @@ -2697,7 +2553,6 @@ search = `cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_ru [ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. action.escu.mappings = {} action.escu.data_models = [] @@ -2708,38 +2563,16 @@ More information on the algorithm used in the search can be found at `https://do action.escu.known_false_positives = none action.escu.creation_date = 2019-11-14 action.escu.modification_date = 2019-11-14 -======= -description = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. -action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -action.escu.known_false_positives = administrator may execute this app to manage disk -action.escu.creation_date = 2021-06-10 -action.escu.modification_date = 2021-06-10 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS EC2 Activities"] -======= -action.escu.analytic_story = ["Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"]} schedule_window = auto @@ -2748,16 +2581,6 @@ action.notable.param.nes_fields = ['user'] action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. action.notable.param.rule_title = Baseline of Excessive AWS Instances Terminated by User - MLTK action.notable.param.security_domain = network -======= -action.correlationsearch.label = ESCU - Clear Unallocated Sector Using Cipher App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Impact"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} -schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. -action.notable.param.rule_title = Clear Unallocated Sector Using Cipher App -action.notable.param.security_domain = endpoint ->>>>>>> develop action.notable.param.severity = high alert.digest_mode = 1 disabled = true @@ -2813,7 +2636,6 @@ search = `cloudtrail` `network_acl_events` | spath output=arn path=userIdentity. [ESCU - Baseline of S3 Bucket deletion activity by ARN - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. action.escu.mappings = {} action.escu.data_models = [] @@ -2822,44 +2644,18 @@ action.escu.how_to_implement = You must install the AWS App for Splunk (version action.escu.known_false_positives = none action.escu.creation_date = 2018-07-17 action.escu.modification_date = 2018-07-17 -======= -description = The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files in network shares and if it is "temp.dat", it will try to read from some stream pipe or file start encrypting files within the infected local machines. This technique can be also identified as an anti-sandbox technique to make its code non-responsive since it is waiting for some parameter to execute properly. -action.escu.mappings = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"]} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files in network shares and if it is "temp.dat", it will try to read from some stream pipe or file start encrypting files within the infected local machines. This technique can be also identified as an anti-sandbox technique to make its code non-responsive since it is waiting for some parameter to execute properly. -action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -action.escu.known_false_positives = Operators can execute third party tools using these parameters. -action.escu.creation_date = 2021-03-17 -action.escu.modification_date = 2021-03-17 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Baseline of S3 Bucket deletion activity by ARN action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS S3 Activities"] -======= -action.escu.analytic_story = ["Clop Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 100 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Baseline of S3 Bucket deletion activity by ARN - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"]} -======= -action.correlationsearch.label = ESCU - Clop Common Exec Parameter - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 100, "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. @@ -2875,11 +2671,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = `cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count -======= -search = | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter` ->>>>>>> develop [ESCU - Baseline of SMB Traffic - MLTK - Rule] action.escu = 0 @@ -2897,29 +2689,13 @@ action.escu.full_search_name = ESCU - Baseline of SMB Traffic - MLTK action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"] -======= -action.escu.analytic_story = ["Clop Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 100 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Baseline of SMB Traffic - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"]} -======= -action.correlationsearch.label = ESCU - Clop Ransomware Known Service Name - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 100, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1543"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src'] @@ -2954,29 +2730,13 @@ action.escu.full_search_name = ESCU - Baseline of Security Group Activity by ARN action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS User Monitoring"] -======= -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 -action.risk.param._risk_message = User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Baseline of Security Group Activity by ARN - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} -======= -action.correlationsearch.label = ESCU - Cloud API Calls From Previously Unseen User Roles - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. @@ -2997,7 +2757,6 @@ search = `cloudtrail` `security_group_api_calls` | spath output=arn path=userIde [ESCU - Baseline of blocked outbound traffic from AWS - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. action.escu.mappings = {} action.escu.data_models = [] @@ -3006,44 +2765,18 @@ action.escu.how_to_implement = You must install the AWS App for Splunk (version action.escu.known_false_positives = none action.escu.creation_date = 2018-05-07 action.escu.modification_date = 2018-05-07 -======= -description = This search looks for cloud compute instances created by users who have not created them before. -action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search looks for cloud compute instances created by users who have not created them before. -action.escu.how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users. -action.escu.known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior. -action.escu.creation_date = 2021-07-13 -action.escu.modification_date = 2021-07-13 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Baseline of blocked outbound traffic from AWS action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"] -======= -action.escu.analytic_story = ["Cloud Cryptomining"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 18 -action.risk.param._risk_message = User $user$ is creating a new instance $dest$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Baseline of blocked outbound traffic from AWS - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"]} -======= -action.correlationsearch.label = ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1078.004"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. @@ -3077,29 +2810,20 @@ action.escu.full_search_name = ESCU - Batch File Write to System32 - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["SamSam Ransomware"] -======= -action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = User $user$ is creating an instance $dest$ in a new region for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Batch File Write to System32 - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204.002"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 12"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "user"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1204.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3134,29 +2858,20 @@ action.escu.full_search_name = ESCU - CMD Echo Pipe - Escalation - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cobalt Strike"] -======= -action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 36 -action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an image that has not been previously seen. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] +action.risk.param._risk_score = 64 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - CMD Echo Pipe - Escalation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"]} -======= -action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1059.003", "T1543.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3191,29 +2906,20 @@ action.escu.full_search_name = ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] -======= -action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Computer action.risk.param._risk_object_type = system -action.risk.param._risk_score = 30 -action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "ImageLoaded", "threat_object_type": "other"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} -======= -action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. @@ -3247,29 +2953,20 @@ action.escu.full_search_name = ESCU - CertUtil Download With URLCache and Split action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] -======= -action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = User $user$ is modifying an instance $dest$ for the first time. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - CertUtil Download With URLCache and Split Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} -======= -action.correlationsearch.label = ESCU - Cloud Instance Modified By Previously Unseen User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078.004"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command and Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3305,12 +3002,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ingress Tool Transfer", "DarkSide Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - CertUtil Download With VerifyCtl and Split Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} +action.correlationsearch.annotations = {"analytic_story": ["Ingress Tool Transfer", "DarkSide Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Command and Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3345,29 +3049,20 @@ action.escu.full_search_name = ESCU - CertUtil With Decode Argument - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Deobfuscate-Decode Files or Information"] -======= -action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 18 -action.risk.param._risk_message = User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] +action.risk.param._risk_score = 40 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 40}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - CertUtil With Decode Argument - Rule -action.correlationsearch.annotations = {"analytic_story": ["Deobfuscate-Decode Files or Information"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"]} -======= -action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Deobfuscate-Decode Files or Information"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3393,7 +3088,7 @@ description = This search looks for arguments to certutil.exe indicating the man action.escu.mappings = {"kill_chain_phases": ["Installation"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. -action.escu.how_to_implement = +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = Unless there are specific use cases, manipulating or exporting certificates using certutil is uncommon. Extraction of certificate has been observed during attacks such as Golden SAML and other campaigns targeting Federated services. action.escu.creation_date = 2021-01-26 action.escu.modification_date = 2021-01-26 @@ -3402,32 +3097,23 @@ action.escu.full_search_name = ESCU - Certutil exe certificate extraction - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"] -======= -action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = object +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 63 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Certutil exe certificate extraction - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Installation"]} -======= -action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Cloud Federated Credential Abuse"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Installation"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['user'] +action.notable.param.nes_fields = ['user', 'dest'] action.notable.param.rule_description = This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. action.notable.param.rule_title = Certutil exe certificate extraction action.notable.param.security_domain = endpoint @@ -3441,7 +3127,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name Processes.process Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter` [ESCU - Child Processes of Spoolsv exe - Rule] action.escu = 0 @@ -3459,29 +3145,13 @@ action.escu.full_search_name = ESCU - Child Processes of Spoolsv exe - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Privilege Escalation"] -======= -action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] -action.risk = 1 -action.risk.param._risk_object = object_id -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object_id", "risk_object_type": "system", "risk_score": 42}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Child Processes of Spoolsv exe - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 5", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["PR.AC", "PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object_id", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3503,11 +3173,11 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces [ESCU - Clear Unallocated Sector Using Cipher App - Rule] action.escu = 0 action.escu.enabled = 1 -description = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. +description = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.eli5 = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = administrator may execute this app to manage disk action.escu.creation_date = 2021-06-10 action.escu.modification_date = 2021-06-10 @@ -3516,33 +3186,24 @@ action.escu.full_search_name = ESCU - Clear Unallocated Sector Using Cipher App action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware"] -======= -action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = object +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Clear Unallocated Sector Using Cipher App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"]} -======= -action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Impact"], "impact": 100, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.004"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = this search is to detect execution of cipher.exe to clear the unallocated sectors of a specific disk. This technique was seen in some ransomwareto make it impossible to forensically recover deleted files. +action.notable.param.rule_description = this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. action.notable.param.rule_title = Clear Unallocated Sector Using Cipher App action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -3575,29 +3236,13 @@ action.escu.full_search_name = ESCU - Clients Connecting to Multiple DNS Servers action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"] -======= -action.escu.analytic_story = ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"] -action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 -action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Clients Connecting to Multiple DNS Servers - Rule action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking", "Command and Control", "Suspicious DNS Traffic", "Host Redirection"], "cis20": ["CIS 9", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "PR.DS"]} -======= -action.correlationsearch.label = ESCU - Cobalt Strike Named Pipes - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Parent Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -3623,7 +3268,7 @@ description = The following analytics are designed to identifies some CLOP ranso action.escu.mappings = {"kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"]} action.escu.data_models = ["Endpoint"] action.escu.eli5 = The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files in network shares and if it is "temp.dat", it will try to read from some stream pipe or file start encrypting files within the infected local machines. This technique can be also identified as an anti-sandbox technique to make its code non-responsive since it is waiting for some parameter to execute properly. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. action.escu.known_false_positives = Operators can execute third party tools using these parameters. action.escu.creation_date = 2021-03-17 action.escu.modification_date = 2021-03-17 @@ -3632,29 +3277,20 @@ action.escu.full_search_name = ESCU - Clop Common Exec Parameter - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Clop Ransomware"] -======= -action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 -action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param._risk_score = 100 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Clop Common Exec Parameter - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"]} -======= -action.correlationsearch.label = ESCU - Common Ransomware Extensions - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 100, "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1204"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -3671,7 +3307,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.parent_process_name Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter` +search = | tstats `security_content_summariesonly` values(Processes.process) as cmdline values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter` [ESCU - Clop Ransomware Known Service Name - Rule] action.escu = 0 @@ -3689,29 +3325,20 @@ action.escu.full_search_name = ESCU - Clop Ransomware Known Service Name - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Clop Ransomware"] -======= -action.escu.analytic_story = ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 -action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param._risk_score = 100 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 100}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 100}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Clop Ransomware Known Service Name - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1543"]} -======= -action.correlationsearch.label = ESCU - Common Ransomware Notes - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 100, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1543"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This detection is to identify the common service name created by the CLOP ransomware as part of its persistence and high privilege code execution in the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API in creating this service entry. @@ -3745,35 +3372,20 @@ action.escu.full_search_name = ESCU - Cloud API Calls From Previously Unseen Use action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud User Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 25 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 36 +action.risk.param._risk_message = User $user$ of type AssumedRole attempting to execute new API calls $command$ that have not been seen before +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cloud API Calls From Previously Unseen User Roles - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Conti Common Exec parameter - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 60, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "user"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -3795,42 +3407,27 @@ action.escu.data_models = ["Change"] action.escu.eli5 = This search looks for cloud compute instances created by users who have not created them before. action.escu.how_to_implement = You must be ingesting the appropriate cloud-infrastructure logs Run the "Previously Seen Cloud Compute Creations By User" support search to create of baseline of previously seen users. action.escu.known_false_positives = It's possible that a user will start to create compute instances for the first time, for any number of reasons. Verify with the user launching instances that this is the intended behavior. -action.escu.creation_date = 2020-08-21 -action.escu.modification_date = 2020-08-21 +action.escu.creation_date = 2021-07-13 +action.escu.modification_date = 2021-07-13 action.escu.confidence = high action.escu.full_search_name = ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Credential Dumping"] -action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 -action.risk.param._risk_message = A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. -action.risk.param._risk = [{"threat_object_field": "TargetImage", "threat_object_type": "other"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}] ->>>>>>> develop +action.risk.param._risk_score = 18 +action.risk.param._risk_message = User $user$ is creating a new instance $dest$ for the first time +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Create Remote Thread into LSASS - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "TargetImage", "role": ["Other"], "type": "Other"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Recon", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1078.004"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -3846,7 +3443,6 @@ search = | tstats `security_content_summariesonly` count earliest(_time) as firs [ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created. action.escu.mappings = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = ["Change"] @@ -3855,50 +3451,25 @@ action.escu.how_to_implement = You must be ingesting your cloud infrastructure l action.escu.known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate. action.escu.creation_date = 2020-09-02 action.escu.modification_date = 2020-09-02 -======= -description = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. -action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"]} -action.escu.data_models = [] -action.escu.eli5 = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. -action.escu.known_false_positives = unknown -action.escu.creation_date = 2021-03-12 -action.escu.modification_date = 2021-03-12 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Clop Ransomware"] -action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A service $Service_File_Name$ was created from a non-standard path using $Service_Name$, potentially leading to a privilege escalation. -action.risk.param._risk = [{"threat_object_field": "Service_File_Name", "threat_object_type": "other"}, {"threat_object_field": "Service_Name", "threat_object_type": "other"}] ->>>>>>> develop +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = User $user$ is creating an instance $dest$ in a new region for the first time +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} -======= -action.correlationsearch.label = ESCU - Create Service In Suspicious File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"], "observable": [{"name": "Service_File_Name", "role": ["Other"], "type": "Other"}, {"name": "Service_Name", "role": ["Other"], "type": "Other"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 12"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "user"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -3927,35 +3498,20 @@ action.escu.full_search_name = ESCU - Cloud Compute Instance Created With Previo action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["DHS Report TA18-074A"] -action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 30 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_score = 36 +action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an image that has not been previously seen. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Create local admin accounts using net exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -3984,35 +3540,20 @@ action.escu.full_search_name = ESCU - Cloud Compute Instance Created With Previo action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Hidden Cobra Malware"] -action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_score = 30 +action.risk.param._risk_message = User $user$ is creating an instance $dest$ with an instance type $instance_type$ that has not been previously seen. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Create or delete windows shares using net exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "nist": ["ID.AM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -4041,35 +3582,20 @@ action.escu.full_search_name = ESCU - Cloud Instance Modified By Previously Unse action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 10 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Credential Dumping"] -action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_score = 42 +action.risk.param._risk_message = User $user$ is modifying an instance $dest$ for the first time. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cloud Instance Modified By Previously Unseen User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Creation of Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078.004"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -4098,29 +3624,13 @@ action.escu.full_search_name = ESCU - Cloud Network Access Control List Deleted action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Network ACL Activity"] -======= -action.escu.analytic_story = ["Credential Dumping"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Cloud Network Access Control List Deleted - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Network ACL Activity"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} -======= -action.correlationsearch.label = ESCU - Creation of Shadow Copy with wmic and powershell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src'] @@ -4142,7 +3652,6 @@ search = `cloudtrail` eventName=DeleteNetworkAcl|rename userIdentity.arn as arn [ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something. action.escu.mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} action.escu.data_models = ["Change"] @@ -4152,58 +3661,26 @@ action.escu.known_false_positives = This is a strictly behavioral search, so we This search will fire any time a new IP address is seen in the **GeoIP** database for any kind of provisioning activity. If you typically do all provisioning from tools inside of your country, there should be few false positives. If you are located in countries where the free version of **MaxMind GeoIP** that ships by default with Splunk has weak resolution (particularly small countries in less economically powerful regions), this may be much less valuable to you. action.escu.creation_date = 2020-10-09 action.escu.modification_date = 2020-10-09 -======= -description = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. -action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} -action.escu.data_models = [] -action.escu.eli5 = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. -action.escu.how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. -action.escu.known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. -action.escu.creation_date = 2020-02-03 -action.escu.modification_date = 2020-02-03 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 10 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Credential Dumping"] -action.risk = 1 -action.risk.param._risk_object = Computer +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetFilename", "threat_object_type": "file name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_score = 18 +action.risk.param._risk_message = User $user$ is starting or creating an instance $dest$ for the first time in City $City$ from IP address $src$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto -======= -action.correlationsearch.label = ESCU - Creation of lsass Dump with Taskmgr - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetFilename", "role": ["Victim"], "type": "File Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} -schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. -action.notable.param.rule_title = Creation of lsass Dump with Taskmgr -action.notable.param.security_domain = endpoint -action.notable.param.severity = high ->>>>>>> develop alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4232,35 +3709,20 @@ action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previousl action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 5 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Credential Dumping"] -action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = object action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_score = 42 +action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in Country $Country$ from IP address $src$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -4290,35 +3752,20 @@ action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previousl action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 5 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Credential Dumping"] -action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = object_id action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_score = 42 +action.risk.param._risk_message = User $user$ is starting or creating an instance $object_id$ for the first time from IP address $src$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object_id", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Credential Dumping via Symlink to Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object_id", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -4348,35 +3795,20 @@ action.escu.full_search_name = ESCU - Cloud Provisioning Activity From Previousl action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 5 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Cobalt Strike"] -action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = object action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_score = 42 +action.risk.param._risk_message = User $user$ is starting or creating an instance $object$ for the first time in region $Region$ from IP address $src$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "src", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "src", "threat_object_type": "ip address"}, {"risk_object_field": "object", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - DLLHost with no Command Line Arguments with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"], "cis20": ["CIS 1"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "mitre_attack": ["T1078"], "nist": ["ID.AM"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "src", "role": ["Attacker"], "type": "IP Address"}, {"name": "object", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -4407,29 +3839,20 @@ action.escu.full_search_name = ESCU - Cobalt Strike Named Pipes - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"] -======= -action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Computer action.risk.param._risk_object_type = system action.risk.param._risk_score = 72 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_message = An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Cobalt Strike Named Pipes - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - DNS Exfiltration Using Nslookup App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike", "Trickbot", "DarkSide Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1055"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Parent Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -4470,12 +3893,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Common Ransomware Extensions - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4510,29 +3940,20 @@ action.escu.full_search_name = ESCU - Common Ransomware Notes - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"] -======= -action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"] action.risk = 1 -action.risk.param._risk_object = host +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ -action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "query", "threat_object_type": "dnsquery"}] +action.risk.param._risk_score = 90 +action.risk.param._risk_message = A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Common Ransomware Notes - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - DNS Query Length With High Standard Deviation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "query", "role": ["Attacker"], "type": "dnsquery"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ransomware", "Ryuk Ransomware", "Clop Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1485"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4568,12 +3989,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Conti Common Exec parameter - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4648,29 +4076,13 @@ action.escu.full_search_name = ESCU - Count of assets by category action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Asset Tracking"] -======= -action.escu.analytic_story = ["Domain Trust Discovery"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Count of assets by category - Rule action.correlationsearch.annotations = {"analytic_story": ["Asset Tracking"]} -======= -action.correlationsearch.label = ESCU - DSQuery Domain Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Domain Trust Discovery"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search shows you every asset category you have and the assets that belong to those categories. @@ -4704,29 +4116,20 @@ action.escu.full_search_name = ESCU - Create Remote Thread into LSASS - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Credential Dumping"] -======= -action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"] action.risk = 1 -action.risk.param._risk_object = ComputerName +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system action.risk.param._risk_score = 81 -action.risk.param._risk_message = An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$. -action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}] +action.risk.param._risk_message = A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. +action.risk.param._risk = [{"threat_object_field": "TargetImage", "threat_object_type": "other"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Create Remote Thread into LSASS - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Delete ShadowCopy With PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "TargetImage", "role": ["Other"], "type": "Other"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -4749,7 +4152,7 @@ search = `sysmon` EventID=8 TargetImage=*lsass.exe | stats count min(_time) as f action.escu = 0 action.escu.enabled = 1 description = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. -action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.001", "T1569.002"]} +action.escu.mappings = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"]} action.escu.data_models = [] action.escu.eli5 = This detection is to identify a creation of "user mode service" where the service file path is located in non-common service folder in windows. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the Service name, Service File Name Service Start type, and Service Type from your endpoints. @@ -4761,29 +4164,20 @@ action.escu.full_search_name = ESCU - Create Service In Suspicious File Path - R action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Clop Ransomware"] -======= -action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A service $Service_File_Name$ was created from a non-standard path using $Service_Name$, potentially leading to a privilege escalation. +action.risk.param._risk = [{"threat_object_field": "Service_File_Name", "threat_object_type": "other"}, {"threat_object_field": "Service_Name", "threat_object_type": "other"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Create Service In Suspicious File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.001", "T1569.002"]} -======= -action.correlationsearch.label = ESCU - Deleting Of Net Users - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"], "observable": [{"name": "Service_File_Name", "role": ["Other"], "type": "Other"}, {"name": "Service_Name", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -4818,29 +4212,13 @@ action.escu.full_search_name = ESCU - Create a list of approved AWS service acco action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS User Monitoring"] -======= -action.escu.analytic_story = ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Create a list of approved AWS service accounts - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} -======= -action.correlationsearch.label = ESCU - Deleting Shadow Copies - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8", "CIS 10"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. @@ -4875,12 +4253,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 30 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 30}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create local admin accounts using net exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1136.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4916,12 +4301,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Hidden Cobra Malware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create or delete windows shares using net exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4957,12 +4349,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Creation of Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -4997,29 +4396,20 @@ action.escu.full_search_name = ESCU - Creation of Shadow Copy with wmic and powe action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Credential Dumping"] -======= -action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 -action.risk.param._risk_message = User $user$ is logging into the AWS console for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Creation of Shadow Copy with wmic and powershell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect AWS Console Login by New User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5041,10 +4431,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Creation of lsass Dump with Taskmgr - Rule] action.escu = 0 action.escu.enabled = 1 -description = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +description = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. action.escu.mappings = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} action.escu.data_models = [] -action.escu.eli5 = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +action.escu.eli5 = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. action.escu.how_to_implement = This search requires Sysmon Logs and a Sysmon configuration, which includes EventCode 11 for detecting file create of lsass.dmp. This search uses an input macro named `sysmon`. We strongly recommend that you specify your environment-specific configurations (index, source, sourcetype, etc.) for Windows Sysmon logs. Replace the macro definition with configurations for your Splunk environment. The search also uses a post-filter macro designed to filter out known false positives. action.escu.known_false_positives = Administrators can create memory dumps for debugging purposes, but memory dumps of the LSASS process would be unusual. action.escu.creation_date = 2020-02-03 @@ -5054,33 +4444,24 @@ action.escu.full_search_name = ESCU - Creation of lsass Dump with Taskmgr - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Credential Dumping"] -======= -action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 18 -action.risk.param._risk_message = User $user$ is logging into the AWS console from City $City$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetFilename", "threat_object_type": "file name"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Creation of lsass Dump with Taskmgr - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New City - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 6", "CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetFilename", "role": ["Victim"], "type": "File Name"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = Detect the hands on keyboard behavior of Windows Task Manager creating a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. +action.notable.param.rule_description = Detect the hands on keyboard behavior of Windows Task Manager creating a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. action.notable.param.rule_title = Creation of lsass Dump with Taskmgr action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -5111,29 +4492,20 @@ action.escu.full_search_name = ESCU - Credential Dumping via Copy Command from S action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Credential Dumping"] -======= -action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 -action.risk.param._risk_message = User $user$ is logging into the AWS console from Country $Country$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New Country - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5168,29 +4540,20 @@ action.escu.full_search_name = ESCU - Credential Dumping via Symlink to Shadow C action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Credential Dumping"] -======= -action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 -action.risk.param._risk_message = User $user$ is logging into the AWS console from Region $Region$ for the first time -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Credential Dumping via Symlink to Shadow Copy - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New Region - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "cis20": ["CIS 8", "CIS 16"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5225,29 +4588,20 @@ action.escu.full_search_name = ESCU - DLLHost with no Command Line Arguments wit action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cobalt Strike"] -======= -action.escu.analytic_story = ["Lateral Movement"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system action.risk.param._risk_score = 49 -action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}] +action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - DLLHost with no Command Line Arguments with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} -======= -action.correlationsearch.label = ESCU - Detect Activity Related to Pass the Hash Attacks - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -5282,29 +4636,20 @@ action.escu.full_search_name = ESCU - DNS Exfiltration Using Nslookup App - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"] -======= -action.escu.analytic_story = ["Discovery Techniques"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 72 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ performing activity related to DNS exfiltration. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - DNS Exfiltration Using Nslookup App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} -======= -action.correlationsearch.label = ESCU - Detect AzureHound Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5345,29 +4690,13 @@ action.escu.full_search_name = ESCU - DNS Query Length Outliers - MLTK - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"] -======= -action.escu.analytic_story = ["Discovery Techniques"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - DNS Query Length Outliers - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1071.004"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect AzureHound File Modifications - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -5403,12 +4732,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"] +action.risk = 1 +action.risk.param._risk_object = host +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A dns query $query$ with 2 time standard deviation of name len of the dns query in host $host$ +action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "query", "threat_object_type": "dnsquery"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNS Query Length With High Standard Deviation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "query", "role": ["Attacker"], "type": "dnsquery"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. @@ -5528,29 +4864,13 @@ action.escu.full_search_name = ESCU - DNSTwist Domain Names action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"] -======= -action.escu.analytic_story = ["Detect Zerologon Attack"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - DNSTwist Domain Names - Rule action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring", "Suspicious Emails"]} -======= -action.correlationsearch.label = ESCU - Detect Computer Changed with Anonymous Account - Rule -action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. @@ -5594,29 +4914,20 @@ action.escu.full_search_name = ESCU - DSQuery Domain Discovery - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Domain Trust Discovery"] -======= -action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack"] action.risk = 1 -action.risk.param._risk_object = Computer +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. -action.risk.param._risk = [{"threat_object_field": "source_image", "threat_object_type": "other"}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetImage", "threat_object_type": "other"}] +action.risk.param._risk_score = 72 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified performing domain discovery on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - DSQuery Domain Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Domain Trust Discovery"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"]} -======= -action.correlationsearch.label = ESCU - Detect Credential Dumping through LSASS access - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"], "observable": [{"name": "source_image", "role": ["Victim"], "type": "Other"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetImage", "role": ["Victim"], "type": "Other"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Domain Trust Discovery"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5657,12 +4968,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$. +action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Delete ShadowCopy With PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to execute a hex encoded command to delete shadow copy. This hex encoded command was able to be decrypted by PowerShell log. @@ -5683,7 +5001,6 @@ search = `powershell` EventCode=4104 Message= "*ShadowCopy*" (Message = "*Delete [ESCU - Deleting Of Net Users - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]} action.escu.data_models = ["Endpoint"] @@ -5692,59 +5009,30 @@ action.escu.how_to_implement = To successfully implement this search, you need t action.escu.known_false_positives = System administrators or scripts may delete user accounts via this technique. Filter as needed. action.escu.creation_date = 2021-05-04 action.escu.modification_date = 2021-05-04 -======= -description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ -This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ -During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} -action.escu.data_models = [] -action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ -This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ -During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -action.escu.known_false_positives = False positives may only pertain to it not being related to Empire, but another framework. Filter as needed if any applications use the same pattern. -action.escu.creation_date = 2021-06-09 -action.escu.modification_date = 2021-06-09 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Deleting Of Net Users - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["XMRig"] -======= -action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = ComputerName +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 -action.risk.param._risk_message = The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$. -action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}] +action.risk.param._risk_score = 25 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deleting Of Net Users - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] action.notable.param.rule_description = This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some user or deleting adversaries tracks created during its lateral movement additional systems. During triage, review parallel processes for additional behavior. Identify any other user accounts created before or after. action.notable.param.rule_title = Deleting Of Net Users -======= -action.correlationsearch.label = ESCU - Detect Empire with PowerShell Script Block Logging - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} -schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ -This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ -During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.notable.param.rule_title = Detect Empire with PowerShell Script Block Logging ->>>>>>> develop action.notable.param.security_domain = endpoint action.notable.param.severity = high alert.digest_mode = 1 @@ -5774,29 +5062,20 @@ action.escu.full_search_name = ESCU - Deleting Shadow Copies - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"] -======= -action.escu.analytic_story = ["Account Monitoring and Controls"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 36 -action.risk.param._risk_message = Multiple accounts have been locked out. Review $dest$ and results related to $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] +action.risk.param._risk_score = 81 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deleting Shadow Copies - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Detect Excessive Account Lockouts From Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078.002"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "SamSam Ransomware", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 8", "CIS 10"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -5837,7 +5116,6 @@ action.escu.full_search_name = ESCU - Detect API activity from users without MFA action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 action.risk.param._risk_object = @@ -5845,27 +5123,13 @@ action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Account Monitoring and Controls"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 -action.risk.param._risk_message = Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"threat_object_field": "result", "threat_object_type": "other"}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Detect API activity from users without MFA - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "nist": ["DE.DP", "PR.AC"]} -======= -action.correlationsearch.label = ESCU - Detect Excessive User Account Lockouts - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078.003"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "result", "role": ["Victim"], "type": "Other"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -5900,7 +5164,6 @@ action.escu.full_search_name = ESCU - Detect ARP Poisoning - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Router and Infrastructure Security"] cron_schedule = 59 * * * * dispatch.earliest_time = -70m@m @@ -5908,22 +5171,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect ARP Poisoning - Rule action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} -======= -action.escu.analytic_story = ["HAFNIUM Group"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 -action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Detect Exchange Web Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exploitation"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src_interface', 'firstTime', 'lastTime', 'count'] @@ -6014,18 +5261,18 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user action.risk.param._risk_score = 30 -action.risk.param._risk_message = -action.risk.param._risk = [] +action.risk.param._risk_message = User $user$ is logging into the AWS console for the first time +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30, "threat_object_field": "user", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AWS Console Login by New User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -6054,35 +5301,20 @@ action.escu.full_search_name = ESCU - Detect AWS Console Login by User from New action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 5 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] -action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 18 +action.risk.param._risk_message = User $user$ is logging into the AWS console from City $City$ for the first time +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "user", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New City - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} -======= -action.correlationsearch.label = ESCU - Detect HTML Help Renamed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -6111,35 +5343,20 @@ action.escu.full_search_name = ESCU - Detect AWS Console Login by User from New action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 5 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 42 +action.risk.param._risk_message = User $user$ is logging into the AWS console from Country $Country$ for the first time +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New Country - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} -======= -action.correlationsearch.label = ESCU - Detect HTML Help Spawn Child Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -6168,35 +5385,20 @@ action.escu.full_search_name = ESCU - Detect AWS Console Login by User from New action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 5 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 -action.risk.param._risk_message = An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 36 +action.risk.param._risk_message = User $user$ is logging into the AWS console from Region $Region$ for the first time +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36, "threat_object_field": "user", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect AWS Console Login by User from New Region - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} -======= -action.correlationsearch.label = ESCU - Detect HTML Help URL in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities", "Suspicious Cloud Authentication Activities"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -6225,29 +5427,20 @@ action.escu.full_search_name = ESCU - Detect Activity Related to Pass the Hash A action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Lateral Movement"] -======= -action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 -action.risk.param._risk_message = $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Activity Related to Pass the Hash Attacks - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1550.002"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6283,12 +5476,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AzureHound Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 80, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6324,12 +5524,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect AzureHound File Modifications - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6404,29 +5611,13 @@ action.escu.full_search_name = ESCU - Detect Baron Samedit CVE-2021-3156 Segfaul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Baron Samedit CVE-2021-3156"] -======= -action.escu.analytic_story = ["Suspicious MSHTA Activity"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 Segfault - Rule action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect MSHTA Url in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit @@ -6460,29 +5651,13 @@ action.escu.full_search_name = ESCU - Detect Baron Samedit CVE-2021-3156 via OSQ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Baron Samedit CVE-2021-3156"] -======= -action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"] -action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 -action.risk.param._risk_message = A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "ImageLoaded", "threat_object_type": "parent process"}, {"threat_object_field": "Image", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Baron Samedit CVE-2021-3156 via OSQuery - Rule action.correlationsearch.annotations = {"analytic_story": ["Baron Samedit CVE-2021-3156"], "cis20": ["CIS 8", "CIS 12", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1068"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Mimikatz Using Loaded Images - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Parent Process"}, {"name": "Image", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects the heap-based buffer overflow of sudoedit @@ -6517,12 +5692,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Detect Zerologon Attack"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "EventCode", "threat_object_type": "other"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Computer Changed with Anonymous Account - Rule -action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 6", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1210"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "EventCode", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -6557,29 +5739,20 @@ action.escu.full_search_name = ESCU - Detect Credential Dumping through LSASS ac action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack"] -======= -action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = ComputerName +action.risk.param._risk_object = Computer action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 -action.risk.param._risk_message = The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$. -action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 90}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. +action.risk.param._risk = [{"threat_object_field": "source_image", "threat_object_type": "other"}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "TargetImage", "threat_object_type": "other"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Credential Dumping through LSASS access - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"], "observable": [{"name": "source_image", "role": ["Victim"], "type": "Other"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "TargetImage", "role": ["Victim"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6618,29 +5791,13 @@ action.escu.full_search_name = ESCU - Detect DNS requests to Phishing Sites leve action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Common Phishing Frameworks"] -======= -action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Detect DNS requests to Phishing Sites leveraging EvilGinx2 - Rule action.correlationsearch.annotations = {"analytic_story": ["Common Phishing Frameworks"], "cis20": ["CIS 8", "CIS 7"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1566.003"], "nist": ["ID.AM", "PR.DS", "PR.IP", "DE.AE", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect New Local Admin account - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -6662,12 +5819,12 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Detect Empire with PowerShell Script Block Logging - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} action.escu.data_models = [] -action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. @@ -6680,15 +5837,22 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$. +action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 81}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Empire with PowerShell Script Block Logging - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable on critical endpoints or all. \ This analytic identifies the common PowerShell stager used by PowerShell-Empire. Each stager that may use PowerShell all uses the same pattern. The initial HTTP will be base64 encoded and use `system.net.webclient`. Note that some obfuscation may evade the analytic. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.notable.param.rule_title = Detect Empire with PowerShell Script Block Logging @@ -6726,12 +5890,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Account Monitoring and Controls"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 36 +action.risk.param._risk_message = Multiple accounts have been locked out. Review $dest$ and results related to $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Excessive Account Lockouts From Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078.002"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -6753,7 +5924,6 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Detect Excessive User Account Lockouts - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = This search detects user accounts that have been locked out a relatively high number of times in a short period. action.escu.mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.003"], "nist": ["PR.IP"]} action.escu.data_models = ["Change"] @@ -6762,44 +5932,25 @@ action.escu.how_to_implement = ou must ingest your Windows security event logs i action.escu.known_false_positives = It is possible that a legitimate user is experiencing an issue causing multiple account login failures leading to lockouts. action.escu.creation_date = 2020-07-21 action.escu.modification_date = 2020-07-21 -======= -description = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} -action.escu.data_models = [] -action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. -action.escu.how_to_implement = -action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -action.escu.creation_date = 2021-07-19 -action.escu.modification_date = 2021-07-19 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Detect Excessive User Account Lockouts - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Account Monitoring and Controls"] -======= -action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = userName +action.risk.param._risk_object = user action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 -action.risk.param._risk_message = User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ -action.risk.param._risk = [{"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] +action.risk.param._risk_score = 36 +action.risk.param._risk_message = Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}, {"threat_object_field": "result", "threat_object_type": "other"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Excessive User Account Lockouts - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.003"], "nist": ["PR.IP"]} -======= -action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 60, "mitre_attack": ["T1078.003"], "nist": ["PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "result", "role": ["Victim"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -6816,11 +5967,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Change.All_Changes where nodename=All_Changes.Account_Management All_Changes.result="lockout" by All_Changes.user All_Changes.result |`drop_dm_object_name("All_Changes")` |`drop_dm_object_name("Account_Management")`| `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | search count > 5 | `detect_excessive_user_account_lockouts_filter` -======= -search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` ->>>>>>> develop [ESCU - Detect Exchange Web Shell - Rule] action.escu = 0 @@ -6828,47 +5975,30 @@ action.escu.enabled = 1 description = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} action.escu.data_models = [] -<<<<<<< HEAD action.escu.eli5 = The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group. Paths include: `\HttpProxy\owa\auth\`, `\inetpub\wwwroot\aspnet_client\`, and `\HttpProxy\OAB\`. Upon triage, the suspicious .aspx file will likely look obvious on the surface. inspect the contents for script code inside. Identify additional log sources, IIS included, to review source and other potential exploitation. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node and `Filesystem` node. action.escu.known_false_positives = The query is structured in a way that `action` (read, create) is not defined. Review the results of this query, filter, and tune as necessary. It may be necessary to generate this query specific to your endpoint product. action.escu.creation_date = 2021-03-09 action.escu.modification_date = 2021-03-09 -======= -action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. -action.escu.how_to_implement = You must install the AWS App for Splunk. -action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -action.escu.creation_date = 2021-07-19 -action.escu.modification_date = 2021-07-19 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Detect Exchange Web Shell - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["HAFNIUM Group"] -======= -action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = userName -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 -action.risk.param._risk_message = User $user$ has created an open/public bucket $bucketName$ with the following permissions $permission$ -action.risk.param._risk = [{"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Exchange Web Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} -======= -action.correlationsearch.label = ESCU - Detect New Open S3 buckets - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exploitation"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_name", "role": ["Victim"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -6885,11 +6015,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = | tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes where Processes.process_name=System by _time span=1h Processes.process_id Processes.process_name Processes.dest | `drop_dm_object_name(Processes)` | join process_guid, _time [| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Filesystem where Filesystem.file_path IN ("*\\HttpProxy\\owa\\auth\\*", "*\\inetpub\\wwwroot\\aspnet_client\\*", "*\\HttpProxy\\OAB\\*") Filesystem.file_name="*.aspx" by _time span=1h Filesystem.dest Filesystem.file_create_time Filesystem.file_name Filesystem.file_path | `drop_dm_object_name(Filesystem)` | fields _time dest file_create_time file_name file_path process_name process_path process] | dedup file_create_time | table dest file_create_time, file_name, file_path, process_name | `detect_exchange_web_shell_filter` -======= -search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` ->>>>>>> develop [ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule] action.escu = 0 @@ -6987,29 +6113,20 @@ action.escu.full_search_name = ESCU - Detect HTML Help Renamed - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] -======= -action.escu.analytic_story = ["Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Computer action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect HTML Help Renamed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Path Interception By Creation Of program exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -7045,12 +6162,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect HTML Help Spawn Child Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7085,29 +6209,20 @@ action.escu.full_search_name = ESCU - Detect HTML Help URL in Command Line - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] -======= -action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"] action.risk = 1 -action.risk.param._risk_object = Computer +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect HTML Help URL in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Prohibited Applications Spawning cmd exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7142,39 +6257,25 @@ action.escu.full_search_name = ESCU - Detect HTML Help Using InfoTech Storage Ha action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Compiled HTML Activity"] -======= -action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 72 +action.risk.param._risk_message = $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Compiled HTML Activity"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] action.notable.param.rule_description = The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage Handlers. itss.dll will load upon execution. Three InfoTech Storage handlers are supported - ms-its, its, mk:@MSITStore. ITSS may be used to launch a specific html/htm file from within a CHM file. CHM files may contain nearly any file type embedded. Upon a successful execution, the following script engines may be used for execution - JScript, VBScript, VBScript.Encode, JScript.Encode, JScript.Compact. Analyst may identify vbscript.dll or jscript.dll loading into hh.exe upon execution. The "htm" and "html" file extensions were the only extensions observed to be supported for the execution of Shortcut commands or WSH script code. During investigation, identify script content origination. hh.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. action.notable.param.rule_title = Detect HTML Help Using InfoTech Storage Handlers -======= -action.correlationsearch.label = ESCU - Detect PsExec With accepteula Flag - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} -schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line. -action.notable.param.rule_title = Detect PsExec With accepteula Flag ->>>>>>> develop action.notable.param.security_domain = endpoint action.notable.param.severity = high alert.digest_mode = 1 @@ -7186,11 +6287,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=hh.exe Processes.process IN ("*its:*", "*mk:@MSITStore:*") by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_html_help_using_infotech_storage_handlers_filter` -======= -search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter` ->>>>>>> develop [ESCU - Detect IPv6 Network Infrastructure Threats - Rule] action.escu = 0 @@ -7208,29 +6305,13 @@ action.escu.full_search_name = ESCU - Detect IPv6 Network Infrastructure Threats action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Router and Infrastructure Security"] -======= -action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect IPv6 Network Infrastructure Threats - Rule action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} -======= -action.correlationsearch.label = ESCU - Detect RClone Command-Line Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = By enabling IPv6 First Hop Security as a Layer 2 Security measure on the organization's network devices, we will be able to detect various attacks such as packet forging in the Infrastructure. @@ -7304,29 +6385,13 @@ action.escu.full_search_name = ESCU - Detect Long DNS TXT Record Response - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious DNS Traffic", "Command and Control"] -======= -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Detect Long DNS TXT Record Response - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control"], "mitre_attack": ["T1048.003"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Regasm Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -7361,29 +6426,20 @@ action.escu.full_search_name = ESCU - Detect MSHTA Url in Command Line - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious MSHTA Activity"] -======= -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] action.risk = 1 -action.risk.param._risk_object = Computer +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect MSHTA Url in Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Regasm with Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7418,29 +6474,20 @@ action.escu.full_search_name = ESCU - Detect Mimikatz Using Loaded Images - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"] -======= -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Computer action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 64 +action.risk.param._risk_message = A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "ImageLoaded", "threat_object_type": "parent process"}, {"threat_object_field": "Image", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Mimikatz Using Loaded Images - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Regasm with no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Detect Zerologon Attack", "Cloud Federated Credential Abuse", "DarkSide Ransomware"], "cis20": ["CIS 6", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.AE", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Other"], "type": "Parent Process"}, {"name": "Image", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -7475,29 +6522,13 @@ action.escu.full_search_name = ESCU - Detect Mimikatz Via PowerShell And EventCo action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Federated Credential Abuse"] -======= -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Detect Mimikatz Via PowerShell And EventCode 4703 - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Federated Credential Abuse"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["PR.IP", "PR.AC", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Regsvcs Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for PowerShell requesting privileges consistent with credential dumping. Deprecated, looks like things changed from a logging perspective. @@ -7535,29 +6566,20 @@ action.escu.full_search_name = ESCU - Detect Mimikatz With PowerShell Script Blo action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Malicious PowerShell"] -======= -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] action.risk = 1 -action.risk.param._risk_object = Computer +action.risk.param._risk_object = ComputerName action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 90 +action.risk.param._risk_message = The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$. +action.risk.param._risk = [{"risk_object_field": "User", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 90}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"]} -======= -action.correlationsearch.label = ESCU - Detect Regsvcs with Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003"], "observable": [{"name": "User", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -7593,29 +6615,20 @@ action.escu.full_search_name = ESCU - Detect New Local Admin account - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"] -======= -action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 42 +action.risk.param._risk_message = A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect New Local Admin account - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Regsvcs with No Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 16"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1136.001"], "nist": ["PR.AC", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -7650,29 +6663,13 @@ action.escu.full_search_name = ESCU - Detect New Login Attempts to Routers - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Router and Infrastructure Security"] -======= -action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Cobalt Strike"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect New Login Attempts to Routers - Rule action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "PR.AC", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Detect Regsvr32 Application Control Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike"], "cis20": ["CIS 8", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -7707,29 +6704,13 @@ action.escu.full_search_name = ESCU - Detect New Open GCP Storage Buckets - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious GCP Storage Activities"] -======= -action.escu.analytic_story = ["Collection and Staging"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 27 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect New Open GCP Storage Buckets - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious GCP Storage Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Renamed 7-Zip - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'src'] @@ -7757,42 +6738,27 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket over the aws cli. action.escu.how_to_implement = action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -action.escu.creation_date = 2021-01-12 -action.escu.modification_date = 2021-01-12 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 27 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_object = userName +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 48 +action.risk.param._risk_message = User $user$ has created an open/public bucket $bucketName$ using AWS CLI with the following permissions - $requestParameters.accessControlList.x-amz-grant-read$ $requestParameters.accessControlList.x-amz-grant-read-acp$ $requestParameters.accessControlList.x-amz-grant-write$ $requestParameters.accessControlList.x-amz-grant-write-acp$ $requestParameters.accessControlList.x-amz-grant-full-control$ +action.risk.param._risk = [{"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect New Open S3 Buckets over AWS CLI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Renamed PSExec - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -7803,7 +6769,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` +search = `cloudtrail` eventSource="s3.amazonaws.com" eventName=PutBucketAcl OR requestParameters.accessControlList.x-amz-grant-read-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-write-acp IN ("*AuthenticatedUsers","*AllUsers") OR requestParameters.accessControlList.x-amz-grant-full-control IN ("*AuthenticatedUsers","*AllUsers") | rename requestParameters.bucketName AS bucketName | fillnull | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent bucketName requestParameters.accessControlList.x-amz-grant-read requestParameters.accessControlList.x-amz-grant-read-acp requestParameters.accessControlList.x-amz-grant-write requestParameters.accessControlList.x-amz-grant-write-acp requestParameters.accessControlList.x-amz-grant-full-control | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_over_aws_cli_filter` [ESCU - Detect New Open S3 buckets - Rule] action.escu = 0 @@ -7814,42 +6780,27 @@ action.escu.data_models = [] action.escu.eli5 = This search looks for AWS CloudTrail events where a user has created an open/public S3 bucket. action.escu.how_to_implement = You must install the AWS App for Splunk. action.escu.known_false_positives = While this search has no known false positives, it is possible that an AWS admin has legitimately created a public bucket for a specific purpose. That said, AWS strongly advises against granting full control to the "All Users" group. -action.escu.creation_date = 2021-01-12 -action.escu.modification_date = 2021-01-12 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - Detect New Open S3 buckets - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 27 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop +action.risk.param._risk_object = userName +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 48 +action.risk.param._risk_message = User $user$ has created an open/public bucket $bucketName$ with the following permissions $permission$ +action.risk.param._risk = [{"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"risk_object_field": "userName", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "userName", "threat_object_type": "user"}, {"threat_object_field": "bucketName", "threat_object_type": "other"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect New Open S3 buckets - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Renamed RClone - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "userName", "role": ["Attacker"], "type": "User"}, {"name": "bucketName", "role": ["Victim"], "type": "Other"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -7860,7 +6811,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` +search = `cloudtrail` eventSource=s3.amazonaws.com eventName=PutBucketAcl | rex field=_raw "(?{.+})" | spath input=json_field output=grantees path=requestParameters.AccessControlPolicy.AccessControlList.Grant{} | search grantees=* | mvexpand grantees | spath input=grantees output=uri path=Grantee.URI | spath input=grantees output=permission path=Permission | search uri IN ("http://acs.amazonaws.com/groups/global/AllUsers","http://acs.amazonaws.com/groups/global/AuthenticatedUsers") | search permission IN ("READ","READ_ACP","WRITE","WRITE_ACP","FULL_CONTROL") | rename requestParameters.bucketName AS bucketName | stats count min(_time) as firstTime max(_time) as lastTime by userIdentity.userName userIdentity.principalId userAgent uri permission bucketName | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_new_open_s3_buckets_filter` [ESCU - Detect Outbound SMB Traffic - Rule] action.escu = 0 @@ -7878,29 +6829,13 @@ action.escu.full_search_name = ESCU - Detect Outbound SMB Traffic - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Hidden Cobra Malware", "DHS Report TA18-074A", "NOBELIUM Group"] -======= -action.escu.analytic_story = ["Collection and Staging"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 27 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Outbound SMB Traffic - Rule action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware", "DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1071.002"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Renamed WinRAR - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for outbound SMB connections made by hosts within your network to the Internet. SMB traffic is used for Windows file-sharing activity. One of the techniques often used by attackers involves retrieving the credential hash using an SMB request made to a compromised server controlled by the threat actor. @@ -7975,29 +6910,20 @@ action.escu.full_search_name = ESCU - Detect Path Interception By Creation Of pr action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Persistence Techniques"] -======= -action.escu.analytic_story = ["Suspicious Rundll32 Activity"] action.risk = 1 -action.risk.param._risk_object = Computer +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Path Interception By Creation Of program exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1574.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8014,11 +6940,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name=services.exe by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | rex field=process "^.*?\\\\(?[^\\\\]*\.(?:exe|bat|com|ps1))" | eval process_name = lower(process_name) | eval service_process = lower(service_process) | where process_name != service_process | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_path_interception_by_creation_of_program_exe_filter` -======= -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter` ->>>>>>> develop [ESCU - Detect Port Security Violation - Rule] action.escu = 0 @@ -8036,29 +6958,13 @@ action.escu.full_search_name = ESCU - Detect Port Security Violation - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Router and Infrastructure Security"] -======= -action.escu.analytic_story = ["Suspicious Rundll32 Activity"] -action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Port Security Violation - Rule action.correlationsearch.annotations = {"analytic_story": ["Router and Infrastructure Security"], "cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Reconnaissance", "Delivery", "Exploitation", "Actions on Objectives"], "mitre_attack": ["T1200", "T1498", "T1557.002"], "nist": ["ID.AM", "PR.DS"]} -======= -action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = By enabling Port Security on a Cisco switch you can restrict input to an interface by limiting and identifying MAC addresses of the workstations that are allowed to access the port. When you assign secure MAC addresses to a secure port, the port does not forward packets with source addresses outside the group of defined addresses. If you limit the number of secure MAC addresses to one and assign a single secure MAC address, the workstation attached to that port is assured the full bandwidth of the port. If a port is configured as a secure port and the maximum number of secure MAC addresses is reached, when the MAC address of a workstation attempting to access the port is different from any of the identified secure MAC addresses, a security violation occurs. @@ -8074,11 +6980,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = `cisco_networks` (facility="PM" mnemonic="ERR_DISABLE" disable_cause="psecure-violation") OR (facility="PORT_SECURITY" mnemonic="PSECURE_VIOLATION" OR mnemonic="PSECURE_VIOLATION_VLAN") | eval src_interface=src_int_prefix_long+src_int_suffix | stats min(_time) AS firstTime max(_time) AS lastTime values(disable_cause) AS disable_cause values(src_mac) AS src_mac values(src_vlan) AS src_vlan values(action) AS action count by host src_interface | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_port_security_violation_filter` -======= -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter` ->>>>>>> develop [ESCU - Detect Prohibited Applications Spawning cmd exe - Rule] action.escu = 0 @@ -8096,29 +6998,20 @@ action.escu.full_search_name = ESCU - Detect Prohibited Applications Spawning cm action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"] -======= -action.escu.analytic_story = ["Suspicious Rundll32 Activity"] action.risk = 1 action.risk.param._risk_object = Computer action.risk.param._risk_object_type = system action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Prohibited Applications Spawning cmd exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Suspicious Zoom Child Processes", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8135,11 +7028,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = | tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe by Processes.parent_process_name Processes.process_name Processes.dest Processes.user| `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` |search [`prohibited_apps_launching_cmd`] | `detect_prohibited_applications_spawning_cmd_exe_filter` -======= -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter` ->>>>>>> develop [ESCU - Detect PsExec With accepteula Flag - Rule] action.escu = 0 @@ -8157,32 +7046,23 @@ action.escu.full_search_name = ESCU - Detect PsExec With accepteula Flag - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"] -======= -action.escu.analytic_story = ["Suspicious MSHTA Activity", "NOBELIUM Group"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = Suspicious rundll32.exe inline HTA execution on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param._risk_score = 35 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect PsExec With accepteula Flag - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Rundll32 Inline HTA Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 -action.notable.param.nes_fields = ['dest'] +action.notable.param.nes_fields = ['user', 'dest'] action.notable.param.rule_description = This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. This tool is widely used for launching interactive command prompts on remote systems. Threat actors leverage this extensively for executing code on compromised systems. If an attacker is running PsExec for the first time, they will be prompted to accept the end-user license agreement (EULA), which can be passed as the argument `accepteula` within the command line. action.notable.param.rule_title = Detect PsExec With accepteula Flag action.notable.param.security_domain = endpoint @@ -8196,7 +7076,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name Processes.dest Processes.parent_process_name | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter` +search = | tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process=*psexec* Processes.process=*accepteula* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter` [ESCU - Detect RClone Command-Line Usage - Rule] action.escu = 0 @@ -8215,12 +7095,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 35}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect RClone Command-Line Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8296,29 +7183,20 @@ action.escu.full_search_name = ESCU - Detect Regasm Spawning a Process - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] -======= -action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 24 -action.risk.param._risk_message = Possible SharpHound command-Line arguments identified on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param._risk_score = 64 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Regasm Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect SharpHound Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8353,29 +7231,20 @@ action.escu.full_search_name = ESCU - Detect Regasm with Network Connection - Ru action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] -======= -action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 24 -action.risk.param._risk_message = Potential SharpHound file modifications identified on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 24}] +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Regasm with Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect SharpHound File Modifications - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8410,29 +7279,20 @@ action.escu.full_search_name = ESCU - Detect Regasm with no Command Line Argumen action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] -======= -action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 24 -action.risk.param._risk_message = Potential SharpHound binary identified on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Regasm with no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect SharpHound Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8468,12 +7328,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8509,12 +7376,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs with Network Connection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8550,12 +7424,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvcs Regasm Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The process $process_name$ was spawned by $parent_image$ without any command-line arguments on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "parent_image", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvcs with No Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvcs Regasm Activity"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_image", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8593,12 +7474,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Regsvr32 Activity", "Cobalt Strike"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Regsvr32 Application Control Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity", "Cobalt Strike"], "cis20": ["CIS 8", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8635,12 +7523,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Collection and Staging"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 27 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed 7-Zip - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8676,12 +7571,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 27 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed PSExec - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"]} +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "DHS Report TA18-074A", "HAFNIUM Group", "DarkSide Ransomware", "Lateral Movement"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Lateral Movement", "Execution"], "mitre_attack": ["T1569.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8717,12 +7619,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DarkSide Ransomware", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 27 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed RClone - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"]} +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1020"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8758,12 +7667,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Collection and Staging"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 27 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 27}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 27}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Renamed WinRAR - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Collection"], "impact": 30, "kill_chain_phases": ["Exploitation", "Exfiltration"], "mitre_attack": ["T1560.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -8840,12 +7756,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - advpack - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8862,7 +7785,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter` [ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule] action.escu = 0 @@ -8881,12 +7804,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - setupapi - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8903,7 +7833,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter` [ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule] action.escu = 0 @@ -8921,29 +7851,20 @@ action.escu.full_search_name = ESCU - Detect Rundll32 Application Control Bypass action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Rundll32 Activity"] -======= -action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Computer action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = cmd.exe launching script interpreters on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Rundll32 Application Control Bypass - syssetup - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule -action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -8960,7 +7881,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter` [ESCU - Detect Rundll32 Inline HTA Execution - Rule] action.escu = 0 @@ -8978,29 +7899,20 @@ action.escu.full_search_name = ESCU - Detect Rundll32 Inline HTA Execution - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious MSHTA Activity", "NOBELIUM Group"] -======= -action.escu.analytic_story = ["Suspicious WMI Use"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = Possible malicious WMI Subscription created on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Suspicious rundll32.exe inline HTA execution on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Rundll32 Inline HTA Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Detect WMI Event Subscription Persistence - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity", "NOBELIUM Group"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9123,12 +8035,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 24 +action.risk.param._risk_message = Possible SharpHound command-Line arguments identified on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect SharpHound Command-Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9164,12 +8083,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 24 +action.risk.param._risk_message = Potential SharpHound file modifications identified on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 24}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Detect SharpHound File Modifications - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9204,29 +8130,20 @@ action.escu.full_search_name = ESCU - Detect SharpHound Usage - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Discovery Techniques", "Ransomware"] -======= -action.escu.analytic_story = ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"] action.risk = 1 -action.risk.param._risk_object = host +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A dns query $query$ from your infra connecting to suspicious domain in host $host$ -action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "query", "threat_object_type": "dnsquery"}] +action.risk.param._risk_score = 24 +action.risk.param._risk_message = Potential SharpHound binary identified on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect SharpHound Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"]} -======= -action.correlationsearch.label = ESCU - Detect hosts connecting to dynamic domain providers - Rule -action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "confidence": 80, "context": ["source:endpoint", {"stage": "Initial Access"}], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "query", "role": ["Attacker"], "type": "dnsquery"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques", "Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087.002", "T1087.001", "T1482", "T1069.002", "T1069.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -9308,7 +8225,6 @@ action.escu.full_search_name = ESCU - Detect Spike in AWS API Activity - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 action.risk.param._risk_object = @@ -9316,27 +8232,13 @@ action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Suspicious MSHTA Activity"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Detect Spike in AWS API Activity - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} -======= -action.correlationsearch.label = ESCU - Detect mshta inline hta execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -9371,7 +8273,6 @@ action.escu.full_search_name = ESCU - Detect Spike in AWS Security Hub Alerts fo action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS Security Hub Alerts"] action.risk = 1 action.risk.param._risk_object = @@ -9379,27 +8280,13 @@ action.risk.param._risk_object_type = action.risk.param._risk_score = 20 action.risk.param._risk_message = action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Suspicious MSHTA Activity"] -action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Security Hub Alerts"], "cis20": ["CIS 13"], "nist": ["DE.DP", "DE.AE"]} -======= -action.correlationsearch.label = ESCU - Detect mshta renamed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -9517,7 +8404,6 @@ action.escu.full_search_name = ESCU - Detect Spike in S3 Bucket deletion - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS S3 Activities"] action.risk = 1 action.risk.param._risk_object = @@ -9525,27 +8411,13 @@ action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Unusual Processes"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 32 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 32}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Spike in S3 Bucket deletion - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"], "cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.DP", "DE.CM", "PR.AC"]} -======= -action.correlationsearch.label = ESCU - Detect processes used for System Network Configuration Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 40, "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -9796,29 +8668,20 @@ action.escu.full_search_name = ESCU - Detect Use of cmd exe to Launch Script Int action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"] -======= -action.escu.analytic_story = ["Ransomware"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 24 -action.risk.param._risk_message = WevtUtil.exe used to disable Event Logging on $dest -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param._risk_score = 35 +action.risk.param._risk_message = cmd.exe launching script interpreters on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule -action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Disable Logs Using WevtUtil - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Command-Line Executions"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -9840,7 +8703,6 @@ search = | tstats `security_content_summariesonly` count values(Processes.proces [ESCU - Detect WMI Event Subscription Persistence - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ All event subscriptions have three components \ 1. Filter - WQL Query for the events we want. EventID equals 19 \ @@ -9859,40 +8721,25 @@ action.escu.how_to_implement = To successfully implement this search, you need t action.escu.known_false_positives = It is possible some applications will create a consumer and may be required to be filtered. For tuning, add any additional LOLBin's for further depth of coverage. action.escu.creation_date = 2021-06-16 action.escu.modification_date = 2021-06-16 -======= -description = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. -action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. -action.escu.known_false_positives = admin may disable this application for non technical user. -action.escu.creation_date = 2021-03-31 -action.escu.modification_date = 2021-03-31 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Detect WMI Event Subscription Persistence - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious WMI Use"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 40 -action.risk.param._risk_message = Disabled Registry Tools -action.risk.param._risk = [] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Possible malicious WMI Subscription created on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect WMI Event Subscription Persistence - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1546.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies the use of WMI Event Subscription to establish persistence or perform privilege escalation. WMI can be used to install event filters, providers, consumers, and bindings that execute code when a defined event occurs. WMI subscription execution is proxied by the WMI Provider Host process (WmiPrvSe.exe) and thus may result in elevated SYSTEM privileges. This analytic is restricted by commonly added process execution and a path. If the volume is low enough, remove the values and flag on any new subscriptions.\ @@ -9902,15 +8749,6 @@ All event subscriptions have three components \ 1. Binding - Registers a filter to a consumer. EventID equals 21 \ Monitor for the creation of new WMI EventFilter, EventConsumer, and FilterToConsumerBinding. It may be pertinent to review all 3 to identify the flow of execution. In addition, EventCode 4104 may assist with any other PowerShell script usage that registered the subscription. action.notable.param.rule_title = Detect WMI Event Subscription Persistence -======= -action.correlationsearch.label = ESCU - Disable Registry Tool - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} -schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. -action.notable.param.rule_title = Disable Registry Tool ->>>>>>> develop action.notable.param.security_domain = endpoint action.notable.param.severity = high alert.digest_mode = 1 @@ -9927,19 +8765,11 @@ search = `sysmon` EventID=20 | stats count min(_time) as firstTime max(_time) as [ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = This search detects SIGRed via Splunk Stream. action.escu.mappings = {"cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} action.escu.data_models = [] action.escu.eli5 = This search detects SIGRed via Splunk Stream. action.escu.how_to_implement = You must be ingesting Splunk Stream DNS and Splunk Stream TCP. We are detecting SIG and KEY records via stream:dns and TCP payload over 65KB in size via stream:tcp. Replace the macro definitions ('stream:dns' and 'stream:tcp') with configurations for your Splunk environment. -======= -description = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. -action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. ->>>>>>> develop action.escu.known_false_positives = unknown action.escu.creation_date = 2020-07-28 action.escu.modification_date = 2020-07-28 @@ -9948,23 +8778,11 @@ action.escu.full_search_name = ESCU - Detect Windows DNS SIGRed via Splunk Strea action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows DNS SIGRed CVE-2020-1350"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 40 -action.risk.param._risk_message = Disabled 'Show Hidden Files' -action.risk.param._risk = [] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 12"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} schedule_window = auto @@ -9972,16 +8790,6 @@ action.notable = 1 action.notable.param.rule_description = This search detects SIGRed via Splunk Stream. action.notable.param.rule_title = Detect Windows DNS SIGRed via Splunk Stream action.notable.param.security_domain = network -======= -action.correlationsearch.label = ESCU - Disable Show Hidden Files - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} -schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. -action.notable.param.rule_title = Disable Show Hidden Files -action.notable.param.security_domain = endpoint ->>>>>>> develop action.notable.param.severity = high alert.digest_mode = 1 disabled = true @@ -10010,29 +8818,13 @@ action.escu.full_search_name = ESCU - Detect Windows DNS SIGRed via Zeek - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows DNS SIGRed CVE-2020-1350"] -======= -action.escu.analytic_story = ["XMRig"] -action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 40 -action.risk.param._risk_message = Disabled 'Windows App Hotkeys' -action.risk.param._risk = [] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Windows DNS SIGRed via Zeek - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows DNS SIGRed CVE-2020-1350"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Disable Windows App Hotkeys - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects SIGRed via Zeek DNS and Zeek Conn data. @@ -10066,29 +8858,13 @@ action.escu.full_search_name = ESCU - Detect Zerologon via Zeek - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Detect Zerologon Attack"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 40 -action.risk.param._risk_message = Windows Defender real time behavior monitoring disabled on $dest -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect Zerologon via Zeek - Rule action.correlationsearch.annotations = {"analytic_story": ["Detect Zerologon Attack"], "cis20": ["CIS 8", "CIS 11"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Disable Windows Behavior Monitoring - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects attempts to run exploits for the Zerologon CVE-2020-1472 vulnerability via Zeek RPC @@ -10122,29 +8898,13 @@ action.escu.full_search_name = ESCU - Detect attackers scanning for vulnerable J action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["JBoss Vulnerability", "SamSam Ransomware"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 -action.risk.param._risk_message = The Windows Smartscreen was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule action.correlationsearch.annotations = {"analytic_story": ["JBoss Vulnerability", "SamSam Ransomware"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1082"]} -======= -action.correlationsearch.label = ESCU - Disable Windows SmartScreen Protection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -10185,29 +8945,20 @@ action.escu.full_search_name = ESCU - Detect hosts connecting to dynamic domain action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = host action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 -action.risk.param._risk_message = The Windows command prompt was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A dns query $query$ from your infra connecting to suspicious domain in host $host$ +action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "query", "threat_object_type": "dnsquery"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect hosts connecting to dynamic domain providers - Rule -action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Disabling CMD Application - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Prohibited Traffic Allowed or Protocol Mismatch", "DNS Hijacking", "Suspicious DNS Traffic", "Dynamic DNS", "Command and Control"], "cis20": ["CIS 8", "CIS 12", "CIS 13"], "confidence": 80, "context": ["source:endpoint", {"stage": "Initial Access"}], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1189"], "nist": ["PR.DS", "PR.PT", "DE.AE", "DE.CM"], "observable": [{"name": "host", "role": ["Victim"], "type": "Hostname"}, {"name": "query", "role": ["Attacker"], "type": "dnsquery"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to circumvent firewall blocks, block lists as well as frustrate a network defenders analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. @@ -10241,29 +8992,13 @@ action.escu.full_search_name = ESCU - Detect malicious requests to exploit JBoss action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["JBoss Vulnerability", "SamSam Ransomware"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 -action.risk.param._risk_message = The Windows Control Panel was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect malicious requests to exploit JBoss servers - Rule action.correlationsearch.annotations = {"analytic_story": ["JBoss Vulnerability", "SamSam Ransomware"], "cis20": ["CIS 12", "CIS 4", "CIS 18"], "kill_chain_phases": ["Delivery"], "nist": ["ID.RA", "PR.PT", "PR.IP", "DE.AE", "PR.MA", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Disabling ControlPanel - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -10298,29 +9033,20 @@ action.escu.full_search_name = ESCU - Detect mshta inline hta execution - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious MSHTA Activity"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 -action.risk.param._risk_message = The Windows Firewall was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk_score = 90 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect mshta inline hta execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Disabling Firewall with Netsh - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10355,29 +9081,20 @@ action.escu.full_search_name = ESCU - Detect mshta renamed - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious MSHTA Activity"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Computer action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 -action.risk.param._risk_message = The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect mshta renamed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Disabling FolderOptions Windows Feature - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -10412,7 +9129,6 @@ action.escu.full_search_name = ESCU - Detect new API calls from user roles - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS User Monitoring"] action.risk = 1 action.risk.param._risk_object = @@ -10420,27 +9136,13 @@ action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] -======= -action.escu.analytic_story = ["XMRig"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Detect new API calls from user roles - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Disabling Net User Account - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -10475,29 +9177,13 @@ action.escu.full_search_name = ESCU - Detect new user AWS Console Login - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS Login Activities"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 25 -action.risk.param._risk_message = The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Detect new user AWS Console Login - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.DP", "DE.AE"]} -======= -action.correlationsearch.label = ESCU - Disabling NoRun Windows App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -10532,29 +9218,20 @@ action.escu.full_search_name = ESCU - Detect processes used for System Network C action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Unusual Processes"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 32 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 32}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detect processes used for System Network Configuration Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"]} -======= -action.correlationsearch.label = ESCU - Disabling Remote User Account Control - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 2"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 40, "kill_chain_phases": ["Installation", "Command and Control", "Actions on Objectives"], "mitre_attack": ["T1016"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10591,29 +9268,13 @@ action.escu.full_search_name = ESCU - Detect web traffic to dynamic domain provi action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Dynamic DNS"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = The Windows registry was modified to disable system restore on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Detect web traffic to dynamic domain providers - Rule action.correlationsearch.annotations = {"analytic_story": ["Dynamic DNS"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1071.001"], "nist": ["PR.IP", "DE.DP"]} -======= -action.correlationsearch.label = ESCU - Disabling SystemRestore In Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -10648,29 +9309,13 @@ action.escu.full_search_name = ESCU - Detection of DNS Tunnels - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Data Protection", "Suspicious DNS Traffic", "Command and Control"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = The Windows Task Manager was disabled on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Detection of DNS Tunnels - Rule action.correlationsearch.annotations = {"analytic_story": ["Data Protection", "Suspicious DNS Traffic", "Command and Control"], "cis20": ["CIS 13"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1048.003"], "nist": ["PR.PT", "PR.DS"]} -======= -action.correlationsearch.label = ESCU - Disabling Task Manager - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src'] @@ -10705,29 +9350,13 @@ action.escu.full_search_name = ESCU - Detection of tools built by NirSoft - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A "] -======= -action.escu.analytic_story = ["XMRig"] -action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Suspicious files were downloaded with the Telegram application on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 49}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Detection of tools built by NirSoft - Rule action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A "], "cis20": ["CIS 3"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1072"], "nist": ["PR.IP"]} -======= -action.correlationsearch.label = ESCU - Download Files Using Telegram - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -10762,29 +9391,13 @@ action.escu.full_search_name = ESCU - Disable AMSI Through Registry - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware"] -======= -action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Disable AMSI Through Registry - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} -======= -action.correlationsearch.label = ESCU - Dump LSASS via comsvcs DLL - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -10819,29 +9432,13 @@ action.escu.full_search_name = ESCU - Disable ETW Through Registry - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware"] -======= -action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Disable ETW Through Registry - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} -======= -action.correlationsearch.label = ESCU - Dump LSASS via procdump - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -10876,29 +9473,20 @@ action.escu.full_search_name = ESCU - Disable Logs Using WevtUtil - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware"] -======= -action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 24 +action.risk.param._risk_message = WevtUtil.exe used to disable Event Logging on $dest +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Disable Logs Using WevtUtil - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"]} -======= -action.correlationsearch.label = ESCU - Dump LSASS via procdump Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1070.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -10920,10 +9508,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Disable Registry Tool - Rule] action.escu = 0 action.escu.enabled = 1 -description = This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. +description = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. +action.escu.eli5 = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. action.escu.known_false_positives = admin may disable this application for non technical user. action.escu.creation_date = 2021-03-31 @@ -10934,16 +9522,23 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 40 +action.risk.param._risk_message = Disabled Registry Tools +action.risk.param._risk = [] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Registry Tool - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search is to identifies modification of registry to disable the regedit or registry tools of windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. +action.notable.param.rule_description = This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application to prevent the removal of their registry entry such as persistence, file less components and defense evasion. action.notable.param.rule_title = Disable Registry Tool action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -10961,10 +9556,10 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Disable Show Hidden Files - Rule] action.escu = 0 action.escu.enabled = 1 -description = The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. +description = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} action.escu.data_models = ["Endpoint"] -action.escu.eli5 = The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. +action.escu.eli5 = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. action.escu.known_false_positives = unknown action.escu.creation_date = 2021-03-31 @@ -10975,16 +9570,23 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 40 +action.risk.param._risk_message = Disabled 'Show Hidden Files' +action.risk.param._risk = [] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Show Hidden Files - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1564.001", "T1562.001"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = The following search is to idetifies a modification in registry to prevent the user seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. +action.notable.param.rule_description = The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files on the infected machine. action.notable.param.rule_title = Disable Show Hidden Files action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -11016,12 +9618,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 40 +action.risk.param._risk_message = Disabled 'Windows App Hotkeys' +action.risk.param._risk = [] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Windows App Hotkeys - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11057,12 +9666,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 40 +action.risk.param._risk_message = Windows Defender real time behavior monitoring disabled on $dest +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 40}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Windows Behavior Monitoring - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Ransomware", "Revil Ransomware"], "confidence": 100, "context": [{"Source": "Endpoint"}, {"Stage": "Defense Evasion"}], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11098,12 +9714,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows Smartscreen was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disable Windows SmartScreen Protection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11139,12 +9762,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows command prompt was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling CMD Application - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11180,12 +9810,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows Control Panel was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling ControlPanel - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11221,12 +9858,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows Firewall was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Disabling Firewall with Netsh - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11261,29 +9905,20 @@ action.escu.full_search_name = ESCU - Disabling FolderOptions Windows Feature - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -======= -action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = RDP was moved to a non-standard port on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows Folder Options, to hide files, was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Disabling FolderOptions Windows Feature - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} -======= -action.correlationsearch.label = ESCU - Enable RDP In Other Port Number - Rule -action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11320,23 +9955,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = ComputerName +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 80}] +action.risk.param._risk_score = 42 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified disabling a user account on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Disabling Net User Account - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]} -======= -action.correlationsearch.label = ESCU - Enumerate Users Local Group Using Telegram - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11375,21 +10005,16 @@ action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param._risk_score = 25 +action.risk.param._risk_message = The Windows registry was modified to disable run application in window start menu on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 25}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 25}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Disabling NoRun Windows App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} -======= -action.correlationsearch.label = ESCU - Eventvwr UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11424,29 +10049,20 @@ action.escu.full_search_name = ESCU - Disabling Remote User Account Control - Ru action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"] -======= -action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 42 +action.risk.param._risk_message = The Windows registry keys that control the enforcement of Windows User Account Control (UAC) were modified on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Disabling Remote User Account Control - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Excel Spawning PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1548.002"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -11481,29 +10097,20 @@ action.escu.full_search_name = ESCU - Disabling SystemRestore In Registry - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -======= -action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = The Windows registry was modified to disable system restore on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Disabling SystemRestore In Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} -======= -action.correlationsearch.label = ESCU - Excel Spawning Windows Script Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11538,29 +10145,20 @@ action.escu.full_search_name = ESCU - Disabling Task Manager - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -======= -action.escu.analytic_story = ["XMRig"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 42 +action.risk.param._risk_message = The Windows Task Manager was disabled on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Disabling Task Manager - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} -======= -action.correlationsearch.label = ESCU - Excessive Attempt To Disable Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11635,29 +10233,20 @@ action.escu.full_search_name = ESCU - Download Files Using Telegram - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["XMRig"] -======= -action.escu.analytic_story = ["XMRig", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Computer action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Suspicious files were downloaded with the Telegram application on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Download Files Using Telegram - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"]} -======= -action.correlationsearch.label = ESCU - Excessive Service Stop Attempt - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1105"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic will identify a suspicious download by the Telegram application on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with downloading different network scanners (port, bruteforcer, masscan) to the system and later used to mapped the whole network and further move laterally. @@ -11691,29 +10280,20 @@ action.escu.full_search_name = ESCU - Dump LSASS via comsvcs DLL - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"] -======= -action.escu.analytic_story = ["XMRig"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system action.risk.param._risk_score = 80 -action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified accessing credentials using comsvcs.dll on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Dump LSASS via comsvcs DLL - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Excessive Usage Of Cacls App - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "Suspicious Rundll32 Activity", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11750,29 +10330,20 @@ action.escu.full_search_name = ESCU - Dump LSASS via procdump - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] -======= -action.escu.analytic_story = ["XMRig", "Ransomware"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 28 -action.risk.param._risk_message = Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified attempting to dump lsass.exe on endpoint $dest$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Dump LSASS via procdump - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Excessive Usage Of Net App - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Scope:Local", "Stage:Execution"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Process", "Attacker"], "type": "Process Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11811,12 +10382,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$, attempting to dump lsass.exe. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Dump LSASS via procdump Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 16"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -11852,7 +10430,6 @@ action.escu.full_search_name = ESCU - EC2 Instance Modified With Previously Unse action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Unusual AWS EC2 Modifications"] action.risk = 1 action.risk.param._risk_object = @@ -11860,27 +10437,13 @@ action.risk.param._risk_object_type = action.risk.param._risk_score = 5 action.risk.param._risk_message = action.risk.param._risk = [] -======= -action.escu.analytic_story = ["XMRig"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 28 -action.risk.param._risk_message = Excessive usage of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - EC2 Instance Modified With Previously Unseen User - Rule action.correlationsearch.annotations = {"analytic_story": ["Unusual AWS EC2 Modifications"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Excessive Usage Of Taskkill - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -11902,7 +10465,6 @@ search = `cloudtrail` `ec2_modification_api_calls` [search `cloudtrail` `ec2_mod [ESCU - EC2 Instance Started In Previously Unseen Region - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started action.escu.mappings = {"cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} action.escu.data_models = [] @@ -11911,22 +10473,11 @@ action.escu.how_to_implement = You must install the AWS App for Splunk (version action.escu.known_false_positives = It's possible that a user has unknowingly started an instance in a new region. Please verify that this activity is legitimate. action.escu.creation_date = 2018-02-23 action.escu.modification_date = 2018-02-23 -======= -description = This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} -action.escu.data_models = [] -action.escu.eli5 = This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used. -action.escu.known_false_positives = unknown -action.escu.creation_date = 2021-04-21 -action.escu.modification_date = 2021-04-21 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - EC2 Instance Started In Previously Unseen Region - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] action.risk = 1 action.risk.param._risk_object = @@ -11934,21 +10485,11 @@ action.risk.param._risk_object_type = action.risk.param._risk_score = 10 action.risk.param._risk_message = action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"] -action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 28 -action.risk.param._risk_message = Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 28}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - EC2 Instance Started In Previously Unseen Region - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.DP", "DE.AE"]} schedule_window = auto @@ -11956,15 +10497,6 @@ action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for AWS CloudTrail events where an instance is started in a particular region in the last one hour and then compares it to a lookup file of previously seen regions where an instance was started action.notable.param.rule_title = EC2 Instance Started In Previously Unseen Region action.notable.param.security_domain = network -======= -action.correlationsearch.label = ESCU - Excessive Usage of NSLOOKUP App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "confidence": 70, "context": ["Source:Endpoint", "Scope:Local", "Stage:Exfiltration"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} -schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. -action.notable.param.rule_title = Excessive Usage of NSLOOKUP App -action.notable.param.security_domain = endpoint ->>>>>>> develop action.notable.param.severity = high alert.digest_mode = 1 disabled = true @@ -11993,29 +10525,13 @@ action.escu.full_search_name = ESCU - EC2 Instance Started With Previously Unsee action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS Cryptomining"] -======= -action.escu.analytic_story = ["meterpreter"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = Multiple processes were executed out of windows\temp within a short amount of time on $dest$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - EC2 Instance Started With Previously Unseen AMI - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule -action.correlationsearch.annotations = {"analytic_story": ["meterpreter"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for EC2 instances being created with previously unseen AMIs. This search is deprecated and have been translated to use the latest Change Datamodel. @@ -12049,29 +10565,13 @@ action.escu.full_search_name = ESCU - EC2 Instance Started With Previously Unsee action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS Cryptomining"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - EC2 Instance Started With Previously Unseen Instance Type - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"], "cis20": ["CIS 1"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Excessive number of service control start as disabled - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12106,29 +10606,13 @@ action.escu.full_search_name = ESCU - EC2 Instance Started With Previously Unsee action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -======= -action.escu.analytic_story = ["Meterpreter"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - EC2 Instance Started With Previously Unseen User - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"], "cis20": ["CIS 1"], "mitre_attack": ["T1078.004"], "nist": ["ID.AM"]} -======= -action.correlationsearch.label = ESCU - Excessive number of taskhost processes - Rule -action.correlationsearch.annotations = {"analytic_story": ["Meterpreter"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -12165,29 +10649,13 @@ action.escu.full_search_name = ESCU - Email Attachments With Lots Of Spaces - Ru action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"] -======= -action.escu.analytic_story = ["XMRig"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 -action.risk.param._risk_message = Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Email Attachments With Lots Of Spaces - Rule action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} -======= -action.correlationsearch.label = ESCU - Executables Or Script Creation In Suspicious Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = Attackers often use spaces as a means to obfuscate an attachment's file extension. This search looks for messages with email attachments that have many spaces within the file names. @@ -12221,29 +10689,13 @@ action.escu.full_search_name = ESCU - Email files written outside of the Outlook action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Collection and Staging"] -======= -action.escu.analytic_story = ["Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Email files written outside of the Outlook directory - Rule action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.001"]} -======= -action.correlationsearch.label = ESCU - Execute Javascript With Jscript COM CLSID - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -12318,29 +10770,20 @@ action.escu.full_search_name = ESCU - Enable RDP In Other Port Number - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch"] -======= -action.escu.analytic_story = ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = process $process$ have double extensions in the file name is executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process", "threat_object_type": "process"}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = RDP was moved to a non-standard port on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Enable RDP In Other Port Number - Rule -action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"]} -======= -action.correlationsearch.label = ESCU - Execution of File with Multiple Extensions - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"], "cis20": ["CIS 3", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process", "role": ["Parent Process", "Attacker"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1021"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12376,12 +10819,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = The Telegram application has been identified enumerating local groups on $ComputerName$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 80}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Enumerate Users Local Group Using Telegram - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1087"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when a process enumerates a user's security-enabled local groups on a computer or device. @@ -12415,29 +10865,20 @@ action.escu.full_search_name = ESCU - Eventvwr UAC Bypass - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -======= -action.escu.analytic_story = ["DarkSide Ransomware", "Credential Dumping"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_id", "threat_object_type": "process"}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = Registry values were modified to bypass UAC using Event Viewer on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Eventvwr UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002"]} -======= -action.correlationsearch.label = ESCU - Extract SAM from Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -12472,29 +10913,20 @@ action.escu.full_search_name = ESCU - Excel Spawning PowerShell - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Spearphishing Attachments"] -======= -action.escu.analytic_story = ["SamSam Ransomware"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 90 -action.risk.param._risk_message = File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Excel Spawning PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} -======= -action.correlationsearch.label = ESCU - File with Samsam Extension - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 100, "kill_chain_phases": ["Installation"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12529,29 +10961,20 @@ action.escu.full_search_name = ESCU - Excel Spawning Windows Script Host - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Spearphishing Attachments"] -======= -action.escu.analytic_story = ["Suspicious Zoom Child Processes"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 -action.risk.param._risk_message = Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$, indicating potential suspicious macro execution. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "parent_process_name", "threat_object_type": "parent process"}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Excel Spawning Windows Script Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} -======= -action.correlationsearch.label = ESCU - First Time Seen Child Process of Zoom - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Zoom Child Processes"], "cis20": ["CIS 3", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1068"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Attacker", "Child Process"], "type": "Process Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "parent_process_name", "role": ["Parent Process"], "type": "Parent Process"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12587,12 +11010,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Attempt To Disable Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12667,29 +11097,20 @@ action.escu.full_search_name = ESCU - Excessive Service Stop Attempt - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["XMRig", "Ransomware"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 -action.risk.param._risk_message = Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Excessive Service Stop Attempt - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"]} -======= -action.correlationsearch.label = ESCU - FodHelper UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1548.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1489"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12725,12 +11146,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to modify permissions. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Usage Of Cacls App - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12766,12 +11194,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 28 +action.risk.param._risk_message = Excessive usage of net1.exe or net.exe within 1m, with command line $process$ has been detected on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Usage Of Net App - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Scope:Local", "Stage:Execution"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1531"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Process", "Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12847,12 +11282,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 28 +action.risk.param._risk_message = Excessive usage of taskkill.exe with process id $process_id$ (more than 10 within 1m) has been detected on $dest$ with a parent process of $parent_process_name$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Usage Of Taskkill - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12874,10 +11316,10 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as [ESCU - Excessive Usage of NSLOOKUP App - Rule] action.escu = 0 action.escu.enabled = 1 -description = this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. +description = This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} action.escu.data_models = [] -action.escu.eli5 = this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. +action.escu.eli5 = This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances of nslookup.exe may be used. action.escu.known_false_positives = unknown action.escu.creation_date = 2021-04-21 @@ -12888,15 +11330,22 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 28 +action.risk.param._risk_message = Excessive usage of nslookup.exe has been detected on $Computer$. This detection is triggered as as it violates the dynamic threshold +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 28}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive Usage of NSLOOKUP App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious DNS Traffic", "Dynamic DNS", "Command and Control", "Data Exfiltration"], "confidence": 70, "context": ["Source:Endpoint", "Scope:Local", "Stage:Exfiltration"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1048"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 -action.notable.param.rule_description = this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. +action.notable.param.rule_description = This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique use of nslookup where it tries to use specific record type (TXT, A, AAAA) that are commonly used by attacker and also the retry parameter which is designed to query C2 DNS multiple tries. action.notable.param.rule_title = Excessive Usage of NSLOOKUP App action.notable.param.security_domain = endpoint action.notable.param.severity = high @@ -12928,12 +11377,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["meterpreter"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = Multiple processes were executed out of windows\temp within a short amount of time on $dest$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Excessive number of distinct processes created in Windows Temp folder - Rule -action.correlationsearch.annotations = {"analytic_story": ["meterpreter"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +action.correlationsearch.annotations = {"analytic_story": ["meterpreter"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -12968,29 +11424,20 @@ action.escu.full_search_name = ESCU - Excessive number of service control start action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Defense Evasion Tactics"] -======= -action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = connection_to_CNC +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 81 -action.risk.param._risk_message = Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"risk_object_field": "connection_to_CNC", "risk_object_type": "system", "risk_score": 81}] +action.risk.param._risk_score = 80 +action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ attempting to disable services. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Excessive number of service control start as disabled - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} -======= -action.correlationsearch.label = ESCU - GPUpdate with no Command Line Arguments with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "connection_to_CNC", "role": ["Other"], "type": "IP Address"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13025,29 +11472,20 @@ action.escu.full_search_name = ESCU - Excessive number of taskhost processes - R action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Meterpreter"] -======= -action.escu.analytic_story = ["XMRig"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 -action.risk.param._risk_message = Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "registry_value_name", "threat_object_type": "other"}] +action.risk.param._risk_score = 56 +action.risk.param._risk_message = An excessive amount of $process_name$ was executed on $dest$ indicative of suspicious behavior. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Excessive number of taskhost processes - Rule -action.correlationsearch.annotations = {"analytic_story": ["Meterpreter"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"]} -======= -action.correlationsearch.label = ESCU - Hide User Account From Sign-In Screen - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "registry_value_name", "role": ["Attacker"], "type": "Other"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Meterpreter"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1033"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Child Process"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -13082,29 +11520,20 @@ action.escu.full_search_name = ESCU - Executables Or Script Creation In Suspicio action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["XMRig"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 -action.risk.param._risk_message = Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process", "threat_object_type": "other"}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Suspicious executable or scripts with file name $file_name$, $file_path$ and process_id $process_id$ executed in suspicious file path in Windows by $user$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Executables Or Script Creation In Suspicious Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"]} -======= -action.correlationsearch.label = ESCU - Hiding Files And Directories With Attrib exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Attacker", "Parent Process"], "type": "Other"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1036"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -13139,29 +11568,20 @@ action.escu.full_search_name = ESCU - Execute Javascript With Jscript COM CLSID action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware"] -======= -action.escu.analytic_story = ["Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = Computer +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 -action.risk.param._risk_message = High frequency file deletion activity detected on host $Computer$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "deleted_files", "threat_object_type": "file name"}] +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Suspicious process of cscript.exe with a parent process $parent_process_name$ where it tries to execute javascript using jscript.encode CLSID (COM OBJ), detected on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Execute Javascript With Jscript COM CLSID - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005"]} -======= -action.correlationsearch.label = ESCU - High File Deletion Frequency - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "deleted_files", "role": ["Target"], "type": "File Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.005"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Attacker"], "type": "Process"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13237,29 +11657,20 @@ action.escu.full_search_name = ESCU - Execution of File with Multiple Extensions action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"] -======= -action.escu.analytic_story = ["Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = Computer +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 -action.risk.param._risk_message = High frequency process termination (more than 15 processes within 3s) detected on host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "proc_terminated", "threat_object_type": "process"}] +action.risk.param._risk_score = 56 +action.risk.param._risk_message = process $process$ have double extensions in the file name is executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Execution of File with Multiple Extensions - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - High Process Termination Frequency - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "proc_terminated", "role": ["Target"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows File Extension and Association Abuse", "Masquerading - Rename System Utilities"], "cis20": ["CIS 3", "CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["DE.CM", "PR.PT", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process", "role": ["Parent Process", "Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13335,29 +11746,20 @@ action.escu.full_search_name = ESCU - Extract SAM from Registry - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DarkSide Ransomware", "Credential Dumping"] -======= -action.escu.analytic_story = ["XMRig", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Suspicious use of `reg.exe` exporting Windows Registry hives containing credentials executed on $dest$ by user $user$, with a parent process of $parent_process_id$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "parent_process_id", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Extract SAM from Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} -======= -action.correlationsearch.label = ESCU - ICACLS Grant Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Credential Dumping"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Credential Access", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13392,29 +11794,20 @@ action.escu.full_search_name = ESCU - File with Samsam Extension - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["SamSam Ransomware"] -======= -action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 72 -action.risk.param._risk_message = Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 90 +action.risk.param._risk_message = File writes $file_name$ with extensions consistent with a SamSam ransomware attack seen on $dest$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 90}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 90}, {"threat_object_field": "file_name", "threat_object_type": "file name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - File with Samsam Extension - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Icacls Deny Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 100, "kill_chain_phases": ["Installation"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "file_name", "role": ["Other", "Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13450,12 +11843,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Zoom Child Processes"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 64 +action.risk.param._risk_message = Child process $process_name$ with $process_id$ spawned by zoom.exe or zoom.us which has not been previously on host $dest$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - First Time Seen Child Process of Zoom - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Zoom Child Processes"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1068"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Zoom Child Processes"], "cis20": ["CIS 3", "CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1068"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_name", "role": ["Attacker", "Child Process"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -13490,29 +11890,13 @@ action.escu.full_search_name = ESCU - First Time Seen Running Windows Service - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Service Abuse", "Orangeworm Attack Group", "NOBELIUM Group"] -======= -action.escu.analytic_story = ["Lateral Movement"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 -action.risk.param._risk_message = Potential kerberoasting attack via service principal name requests detected on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - First Time Seen Running Windows Service - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Orangeworm Attack Group", "NOBELIUM Group"], "cis20": ["CIS 2", "CIS 9"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1569.002"], "nist": ["ID.AM", "PR.DS", "PR.AC", "DE.AE"]} -======= -action.correlationsearch.label = ESCU - Kerberoasting spn request with RC4 encryption - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 8", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -13547,29 +11931,13 @@ action.escu.full_search_name = ESCU - First time seen command line argument - Ru action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DHS Report TA18-074A", "Suspicious Command-Line Executions", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Hidden Cobra Malware"] -======= -action.escu.analytic_story = ["Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 -action.risk.param._risk_message = Known services $Message$ terminated by a potential ransomware on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "Message", "threat_object_type": "other"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - First time seen command line argument - Rule action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Suspicious Command-Line Executions", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Hidden Cobra Malware"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001", "T1059.003"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Known Services Killed by Ransomware - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Message", "role": ["Other"], "type": "Other"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for command-line arguments that use a `/c` parameter to execute a command that has not previously been seen. @@ -13612,12 +11980,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = Suspcious registy keys added by process fodhelper.exe (process_id- $process_id), with a parent_process of $parent_process_name$ that has been executed on $dest$ by $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - FodHelper UAC Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1548.002"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation"], "impact": 90, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1548.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13899,12 +12274,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] +action.risk = 1 +action.risk.param._risk_object = connection_to_CNC +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 81 +action.risk.param._risk_message = Process gpupdate.exe with parent_process $parent_process_name$ is executed on $dest$ by user $user$, followed by an outbound network connection to $connection_to_CNC$ on port $dest_port$. This behaviour is seen with cobaltstrike. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"threat_object_field": "parent_process_name", "threat_object_type": "process name"}, {"risk_object_field": "connection_to_CNC", "risk_object_type": "system", "risk_score": 81}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - GPUpdate with no Command Line Arguments with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_name", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "connection_to_CNC", "role": ["Other"], "type": "IP Address"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -13940,12 +12322,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = Suspicious registry modification ($registry_value_name$) which is used go hide a user account on the Windows Login screen detected on $dest$ executed by $user$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "registry_value_name", "threat_object_type": "other"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Hide User Account From Sign-In Screen - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "registry_value_name", "role": ["Attacker"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -13981,12 +12370,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = Attrib.exe with +h flag to hide files on $dest$ executed by $user$ is detected. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process", "threat_object_type": "other"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Hiding Files And Directories With Attrib exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Persistence"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1222.001"], "nist": ["DE.CM"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process", "role": ["Attacker", "Parent Process"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -14022,12 +12418,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = High frequency file deletion activity detected on host $Computer$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}, {"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "deleted_files", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - High File Deletion Frequency - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"]} +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1485"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "deleted_files", "role": ["Target"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -14104,12 +12507,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = High frequency process termination (more than 15 processes within 3s) detected on host $Computer$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "proc_terminated", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - High Process Termination Frequency - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"]} +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1486"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "proc_terminated", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytics are designed to indentify a high frequency of process termination on a machine which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing (docs, images, database and etc..) in the infected machine for encryption. @@ -14184,12 +12594,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Process name $process_name$ with grant argument executed by $user$ to change security permission of a specific file or directory on host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - ICACLS Grant Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig", "Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -14225,12 +12642,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 72 +action.risk.param._risk_message = Process name $process_name$ with deny argument executed by $user$ to change security permission of a specific file or directory on host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Icacls Deny Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -14429,12 +12853,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Lateral Movement"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = Potential kerberoasting attack via service principal name requests detected on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Kerberoasting spn request with RC4 encryption - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement"], "cis20": ["CIS 8", "CIS 16"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 90, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1558.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects a potential kerberoasting attack via service principal name requests @@ -14468,29 +12899,20 @@ action.escu.full_search_name = ESCU - Known Services Killed by Ransomware - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware"] -======= -action.escu.analytic_story = ["Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system action.risk.param._risk_score = 72 -action.risk.param._risk_message = mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] +action.risk.param._risk_message = Known services $Message$ terminated by a potential ransomware on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "Message", "threat_object_type": "other"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Known Services Killed by Ransomware - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} -======= -action.correlationsearch.label = ESCU - Mailsniper Invoke functions - Rule -action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Message", "role": ["Other"], "type": "Other"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -14525,29 +12947,13 @@ action.escu.full_search_name = ESCU - Kubernetes AWS detect RBAC authorization b action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -======= -action.escu.analytic_story = ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 81 -action.risk.param._risk_message = PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"threat_object_field": "process", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes AWS detect RBAC authorization by account - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Attacker"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding top to see both extremes of RBAC by accounts occurrences @@ -14581,29 +12987,13 @@ action.escu.full_search_name = ESCU - Kubernetes AWS detect most active service action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -======= -action.escu.analytic_story = ["Malicious PowerShell", "NOBELIUM Group"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = Powershell.exe running potentially malicious encodede commands on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes AWS detect most active service accounts by pod - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Malicious PowerShell Process - Encoded Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes service accounts,accessing pods by IP address, verb and decision @@ -14637,29 +13027,13 @@ action.escu.full_search_name = ESCU - Kubernetes AWS detect sensitive role acces action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -======= -action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = PowerShell local execution policy bypass attempt on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes AWS detect sensitive role access - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets @@ -14733,29 +13107,13 @@ action.escu.full_search_name = ESCU - Kubernetes AWS detect suspicious kubectl c action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -======= -action.escu.analytic_story = ["Malicious PowerShell"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = Powershell.exe running with potential obfuscated arguments on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -14790,29 +13148,13 @@ action.escu.full_search_name = ESCU - Kubernetes Azure detect RBAC authorization action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -======= -action.escu.analytic_story = ["Malicious Powershell"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 72 -action.risk.param._risk_message = Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes Azure detect RBAC authorization by account - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Malicious Powershell Executed As A Service - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious Powershell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes RBAC authorizations by accounts, this search can be modified by adding rare or top to see both extremes of RBAC by accounts occurrences @@ -14846,29 +13188,13 @@ action.escu.full_search_name = ESCU - Kubernetes Azure detect most active servic action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -======= -action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 54 -action.risk.param._risk_message = Wallpaper modification on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes Azure detect most active service accounts by pod namespace - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Modification Of Wallpaper - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes service accounts,accessing pods and namespaces by IP address and verb @@ -14902,29 +13228,13 @@ action.escu.full_search_name = ESCU - Kubernetes Azure detect sensitive object a action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -======= -action.escu.analytic_story = ["XMRig"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 32 -action.risk.param._risk_message = Suspicious ACL permission modification on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes Azure detect sensitive object access - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Modify ACL permission To Files Or Folder - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on Kubernetes accounts accessing sensitve objects such as configmpas or secrets @@ -15038,29 +13348,13 @@ action.escu.full_search_name = ESCU - Kubernetes Azure detect suspicious kubectl action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -======= -action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 64 -action.risk.param._risk_message = New print monitor added on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes Azure detect suspicious kubectl calls - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Monitor Registry Keys for Print Monitors - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8", "CIS 5"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search provides information on rare Kubectl calls with IP, verb namespace and object access context @@ -15174,29 +13468,13 @@ action.escu.full_search_name = ESCU - Kubernetes GCP detect RBAC authorizations action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -======= -action.escu.analytic_story = ["Command and Control", "Data Exfiltration"] -action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 25 -action.risk.param._risk_message = A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$ -action.risk.param._risk = [{"threat_object_field": "uri_path", "threat_object_type": "uripath"}, {"threat_object_field": "form_data", "threat_object_type": "formdata"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes GCP detect RBAC authorizations by account - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Multiple Archive Files Http Post Traffic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "UriPath"}, {"name": "form_data", "role": ["Attacker"], "type": "formdata"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -15231,29 +13509,13 @@ action.escu.full_search_name = ESCU - Kubernetes GCP detect most active service action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -======= -action.escu.analytic_story = ["Active Directory Password Spraying"] -action.risk = 1 -action.risk.param._risk_object = Client_Address -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ -action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes GCP detect most active service accounts by pod - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -15288,29 +13550,13 @@ action.escu.full_search_name = ESCU - Kubernetes GCP detect sensitive object acc action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -======= -action.escu.analytic_story = ["Active Directory Password Spraying"] -action.risk = 1 -action.risk.param._risk_object = Client_Address -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ -action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes GCP detect sensitive object access - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -15345,29 +13591,13 @@ action.escu.full_search_name = ESCU - Kubernetes GCP detect sensitive role acces action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Role Activity"] -======= -action.escu.analytic_story = ["Active Directory Password Spraying"] -action.risk = 1 -action.risk.param._risk_object = Source_Workstation -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$ -action.risk.param._risk = [{"risk_object_field": "Source_Workstation", "risk_object_type": "system", "risk_score": 49}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes GCP detect sensitive role access - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Role Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -15443,29 +13673,13 @@ action.escu.full_search_name = ESCU - Kubernetes GCP detect suspicious kubectl c action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Kubernetes Sensitive Object Access Activity"] -======= -action.escu.analytic_story = ["Active Directory Password Spraying"] -action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Potential password spraying attack from $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Kubernetes GCP detect suspicious kubectl calls - Rule action.correlationsearch.annotations = {"analytic_story": ["Kubernetes Sensitive Object Access Activity"], "kill_chain_phases": ["Lateral Movement"]} -======= -action.correlationsearch.label = ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -15500,29 +13714,13 @@ action.escu.full_search_name = ESCU - Large Volume of DNS ANY Queries - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DNS Amplification Attacks"] -======= -action.escu.analytic_story = ["Active Directory Password Spraying"] -action.risk = 1 -action.risk.param._risk_object = Client_Address -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ -action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Large Volume of DNS ANY Queries - Rule action.correlationsearch.annotations = {"analytic_story": ["DNS Amplification Attacks"], "cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498.002"], "nist": ["PR.PT", "DE.AE", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = The search is used to identify attempts to use your DNS Infrastructure for DDoS purposes via a DNS amplification attack leveraging ANY queries. @@ -15556,29 +13754,13 @@ action.escu.full_search_name = ESCU - MacOS - Re-opened Applications - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = [] -======= -action.escu.analytic_story = ["Active Directory Password Spraying"] -action.risk = 1 -action.risk.param._risk_object = Source_Workstation -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$ -action.risk.param._risk = [{"risk_object_field": "Source_Workstation", "risk_object_type": "system", "risk_score": 49}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - MacOS - Re-opened Applications - Rule action.correlationsearch.annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Installation", "Command and Control"], "nist": ["DE.DP", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -15613,29 +13795,20 @@ action.escu.full_search_name = ESCU - Mailsniper Invoke functions - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Data Exfiltration"] -======= -action.escu.analytic_story = ["Active Directory Password Spraying"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Potential password spraying attack from $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 72 +action.risk.param._risk_message = mailsniper.ps1 functions $Message$ executed on a $ComputerName$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Mailsniper Invoke functions - Rule -action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114.001"]} -======= -action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Data Exfiltration"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 90, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1114.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. @@ -15669,29 +13842,20 @@ action.escu.full_search_name = ESCU - Malicious PowerShell Process - Connect To action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group"] -======= -action.escu.analytic_story = ["Active Directory Password Spraying"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Potential password spraying attack on $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 81 +action.risk.param._risk_message = PowerShell processes $process$ started with parameters to modify the execution policy of the run, run in a hidden window, and connect to the Internet on host $dest$ executed by user $user$. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}, {"threat_object_field": "process", "threat_object_type": "process"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command And Control"], "impact": 90, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -15726,29 +13890,20 @@ action.escu.full_search_name = ESCU - Malicious PowerShell Process - Encoded Com action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Malicious PowerShell", "NOBELIUM Group"] -======= -action.escu.analytic_story = ["Ryuk Ransomware", "Domain Trust Discovery"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 15 -action.risk.param._risk_message = Domain trust discovery execution on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Powershell.exe running potentially malicious encodede commands on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Malicious PowerShell Process - Encoded Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - NLTest Domain Trust Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Domain Trust Discovery"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1027"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -15784,12 +13939,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A", "HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = PowerShell local execution policy bypass attempt on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -15824,29 +13986,13 @@ action.escu.full_search_name = ESCU - Malicious PowerShell Process - Multiple Su action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Malicious PowerShell"] -======= -action.escu.analytic_story = ["HAFNIUM Group"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Nishang PowershellTCPOneLine - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command and Control"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -15882,12 +14028,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Powershell.exe running with potential obfuscated arguments on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "cis20": ["CIS 3", "CIS 7", "CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Command and Control", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["PR.PT", "DE.CM", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -15922,29 +14075,20 @@ action.escu.full_search_name = ESCU - Malicious Powershell Executed As A Service action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Malicious Powershell"] -======= -action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 50 -action.risk.param._risk_message = Active Directory NTDS export on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 50}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 72 +action.risk.param._risk_message = Identifies the abuse the Windows SC.exe to execute malicious powerShell as a service $Service_File_Name$ by $user$ on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Malicious Powershell Executed As A Service - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious Powershell"], "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"]} -======= -action.correlationsearch.label = ESCU - Ntdsutil Export NTDS - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Malicious Powershell"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 90, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1569.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -15979,29 +14123,20 @@ action.escu.full_search_name = ESCU - Modification Of Wallpaper - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] -======= -action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 18 -action.risk.param._risk_message = User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$ -action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] +action.risk.param._risk_score = 54 +action.risk.param._risk_message = Wallpaper modification on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Modification Of Wallpaper - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"]} -======= -action.correlationsearch.label = ESCU - O365 Add App Role Assignment Grant User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Actor.ID", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1491"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain a note that the machine was compromised and make it as a wallpaper. @@ -16035,29 +14170,20 @@ action.escu.full_search_name = ESCU - Modify ACL permission To Files Or Folder - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["XMRig"] -======= -action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = Target.ID +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$ -action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Target.ID", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_score = 32 +action.risk.param._risk_message = Suspicious ACL permission modification on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 32}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Modify ACL permission To Files Or Folder - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} -======= -action.correlationsearch.label = ESCU - O365 Added Service Principal - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Target.ID", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -16079,7 +14205,6 @@ search = | tstats `security_content_summariesonly` values(Processes.process) as [ESCU - Monitor DNS For Brand Abuse - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse. action.escu.mappings = {"kill_chain_phases": ["Delivery", "Actions on Objectives"]} action.escu.data_models = ["Network_Resolution"] @@ -16088,44 +14213,18 @@ action.escu.how_to_implement = You need to ingest data from your DNS logs. Speci action.escu.known_false_positives = None at this time action.escu.creation_date = 2017-09-23 action.escu.modification_date = 2017-09-23 -======= -description = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. -action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007"]} -action.escu.data_models = [] -action.escu.eli5 = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. -action.escu.how_to_implement = You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity -action.escu.known_false_positives = Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration. -action.escu.creation_date = 2021-07-19 -action.escu.modification_date = 2021-07-19 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - Monitor DNS For Brand Abuse - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Brand Monitoring"] -======= -action.escu.analytic_story = ["Office 365 Detections"] -action.risk = 1 -action.risk.param._risk_object = user_id -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 -action.risk.param._risk_message = User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA -action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Monitor DNS For Brand Abuse - Rule action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring"], "kill_chain_phases": ["Delivery", "Actions on Objectives"]} -======= -action.correlationsearch.label = ESCU - O365 Bypass MFA via Trusted IP - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007"], "observable": [{"name": "ip_addresses_new_added", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_id", "role": ["Attacker"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for DNS requests for faux domains similar to the domains that you want to have monitored for abuse. @@ -16141,11 +14240,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = | tstats `security_content_summariesonly` values(DNS.answer) as IPs min(_time) as firstTime from datamodel=Network_Resolution by DNS.src, DNS.query | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)`| `brand_abuse_dns` | `monitor_dns_for_brand_abuse_filter` -======= -search = `o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter` ->>>>>>> develop [ESCU - Monitor Email For Brand Abuse - Rule] action.escu = 0 @@ -16163,29 +14258,13 @@ action.escu.full_search_name = ESCU - Monitor Email For Brand Abuse - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"] -======= -action.escu.analytic_story = ["Office 365 Detections"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 -action.risk.param._risk_message = User $user$ has executed an operation $Operation$ for this destination $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Monitor Email For Brand Abuse - Rule action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring", "Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} -======= -action.correlationsearch.label = ESCU - O365 Disable MFA - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for emails claiming to be sent from a domain similar to one that you want to have monitored for abuse. @@ -16219,29 +14298,20 @@ action.escu.full_search_name = ESCU - Monitor Registry Keys for Print Monitors - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"] -======= -action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system action.risk.param._risk_score = 64 -action.risk.param._risk_message = User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$. -action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}] +action.risk.param._risk_message = New print monitor added on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Monitor Registry Keys for Print Monitors - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"]} -======= -action.correlationsearch.label = ESCU - O365 Excessive Authentication Failures Alert - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Initial Access"], "impact": 80, "kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8", "CIS 5"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.010"], "nist": ["PR.PT", "DE.CM", "PR.AC"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -16276,29 +14346,13 @@ action.escu.full_search_name = ESCU - Monitor Successful Backups action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Monitor Backup Solution"] -======= -action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] -action.risk = 1 -action.risk.param._risk_object = UserId -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 -action.risk.param._risk_message = User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$. -action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Monitor Successful Backups - Rule action.correlationsearch.annotations = {"analytic_story": ["Monitor Backup Solution"]} -======= -action.correlationsearch.label = ESCU - O365 Excessive SSO logon errors - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Initial Access"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -16333,29 +14387,13 @@ action.escu.full_search_name = ESCU - Monitor Unsuccessful Backups action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Monitor Backup Solution"] -======= -action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] -action.risk = 1 -action.risk.param._risk_object = UserId -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 64 -action.risk.param._risk_message = User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$ -action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Monitor Unsuccessful Backups - Rule action.correlationsearch.annotations = {"analytic_story": ["Monitor Backup Solution"]} -======= -action.correlationsearch.label = ESCU - O365 New Federated Domain Added - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "OrganizationName", "role": ["Victim"], "type": "Other"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -16390,29 +14428,13 @@ action.escu.full_search_name = ESCU - Monitor Web Traffic For Brand Abuse - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Brand Monitoring"] -======= -action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] -action.risk = 1 -action.risk.param._risk_object = Source -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 -action.risk.param._risk_message = User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$ -action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}, {"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Monitor Web Traffic For Brand Abuse - Rule action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": ["PR.IP"]} -======= -action.correlationsearch.label = ESCU - O365 PST export alert - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"], "observable": [{"name": "Source", "role": ["Attacker"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src'] @@ -16447,29 +14469,13 @@ action.escu.full_search_name = ESCU - Msmpeng Application DLL Side Loading - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] -======= -action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 -action.risk.param._risk_message = User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Msmpeng Application DLL Side Loading - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1574.002"]} -======= -action.correlationsearch.label = ESCU - O365 Suspicious Admin Email Forwarding - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -16504,29 +14510,20 @@ action.escu.full_search_name = ESCU - Multiple Archive Files Http Post Traffic - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Command and Control", "Data Exfiltration"] -======= -action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 -action.risk.param._risk_message = User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}] +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 25 +action.risk.param._risk_message = A http post $http_method$ sending packet with possible archive bytes header 4form_data$ in uri path $uri_path$ +action.risk.param._risk = [{"threat_object_field": "uri_path", "threat_object_type": "uripath"}, {"threat_object_field": "form_data", "threat_object_type": "formdata"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Multiple Archive Files Http Post Traffic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"]} -======= -action.correlationsearch.label = ESCU - O365 Suspicious Rights Delegation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 50, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "UriPath"}, {"name": "form_data", "role": ["Attacker"], "type": "formdata"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, sensitive data to the infected machines. The attacker may execute archiving command to the collected data, save it a temp folder with a hidden attribute then send it to its C2 through HTTP POST. Sometimes adversaries will rename the archive files or encode/encrypt to cover their tracks. This detection can detect a renamed archive files transfer to HTTP POST since it checks the request body header. Unfortunately this detection cannot support archive that was encrypted or encoded before doing the exfiltration. @@ -16566,29 +14563,20 @@ action.escu.full_search_name = ESCU - Multiple Disabled Users Failing To Authent action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Active Directory Password Spraying"] -======= -action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = ForwardingSmtpAddress -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 -action.risk.param._risk_message = User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "ForwardingSmtpAddress", "risk_object_type": "user", "risk_score": 48}] +action.risk.param._risk_object = Client_Address +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ +action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Multiple Disabled Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} -======= -action.correlationsearch.label = ESCU - O365 Suspicious User Email Forwarding - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "ForwardingSmtpAddress", "role": ["Other"], "type": "Email Address"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple disabled domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack against disabled users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code `0x12` stands for `clients credentials have been revoked` (account disabled, expired or locked out).\ @@ -16631,29 +14619,20 @@ action.escu.full_search_name = ESCU - Multiple Invalid Users Failing To Authenti action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Active Directory Password Spraying"] -======= -action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Client_Address action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = Office application spawning rundll32.exe on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ +action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} -======= -action.correlationsearch.label = ESCU - Office Application Spawn rundll32 process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid domain users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4768 is generated every time the Key Distribution Center issues a Kerberos Ticket Granting Ticket (TGT). Failure code 0x6 stands for `client not found in Kerberos database` (the attempted user is not a valid domain user).\ @@ -16696,29 +14675,20 @@ action.escu.full_search_name = ESCU - Multiple Invalid Users Failing To Authenti action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Active Directory Password Spraying"] -======= -action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Source_Workstation action.risk.param._risk_object_type = system action.risk.param._risk_score = 49 -action.risk.param._risk_message = Office document creating a schedule task on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$ +action.risk.param._risk = [{"risk_object_field": "Source_Workstation", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Multiple Invalid Users Failing To Authenticate From Host Using NTLM - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} -======= -action.correlationsearch.label = ESCU - Office Document Creating Schedule Task - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple invalid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. As attackers progress in a breach, mistakes will be made. In certain scenarios, adversaries may execute a password spraying attack using an invalid list of users. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC0000064 stands for `The username you typed does not exist` (the attempted user is a legitimate domain user).\ @@ -16755,29 +14725,13 @@ action.escu.full_search_name = ESCU - Multiple Okta Users With Invalid Credentia action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Okta Activity"] -======= -action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = Office document executing a macro on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Office Document Executing Macro Code - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search detects Okta login failures due to bad credentials for multiple users originating from the same ip address. @@ -16817,29 +14771,20 @@ action.escu.full_search_name = ESCU - Multiple Users Attempting To Authenticate action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Active Directory Password Spraying"] -======= -action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = ComputerName action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = Office document spawning suspicious child process on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential password spraying attack from $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Multiple Users Attempting To Authenticate Using Explicit Credentials - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} -======= -action.correlationsearch.label = ESCU - Office Document Spawned Child Process To Download - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies a source user failing to authenticate with multiple users using explicit credentials on a host. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4648 is generated when a process attempts an account logon by explicitly specifying that accounts credentials. This event generates on domain controllers, member servers, and workstations.\ @@ -16882,29 +14827,20 @@ action.escu.full_search_name = ESCU - Multiple Users Failing To Authenticate Fro action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Active Directory Password Spraying"] -======= -action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Client_Address action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential Kerberos based password spraying attack from $Client_Address$ +action.risk.param._risk = [{"risk_object_field": "Client_Address", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Host Using Kerberos - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} -======= -action.correlationsearch.label = ESCU - Office Product Spawning BITSAdmin - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Client_Address", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the Kerberos protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using Kerberos to obtain initial access or elevate privileges. Event 4771 is generated when the Key Distribution Center fails to issue a Kerberos Ticket Granting Ticket (TGT). Failure code 0x18 stands for `wrong password provided` (the attempted user is a legitimate domain user).\ @@ -16947,29 +14883,20 @@ action.escu.full_search_name = ESCU - Multiple Users Failing To Authenticate Fro action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Active Directory Password Spraying"] -======= -action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Source_Workstation action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential NTLM based password spraying attack from $Source_Workstation$ +action.risk.param._risk = [{"risk_object_field": "Source_Workstation", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Host Using NTLM - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} -======= -action.correlationsearch.label = ESCU - Office Product Spawning CertUtil - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "Source_Workstation", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies one source endpoint failing to authenticate with multiple valid users using the NTLM protocol. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment using NTLM to obtain initial access or elevate privileges. Event 4776 is generated on the computer that is authoritative for the provided credentials. For domain accounts, the domain controller is authoritative. For local accounts, the local computer is authoritative. Error code 0xC000006A means: misspelled or bad password (the attempted user is a legitimate domain user).\ @@ -17012,29 +14939,20 @@ action.escu.full_search_name = ESCU - Multiple Users Failing To Authenticate Fro action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Active Directory Password Spraying"] -======= -action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = ComputerName action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential password spraying attack from $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Multiple Users Failing To Authenticate From Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} -======= -action.correlationsearch.label = ESCU - Office Product Spawning MSHTA - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies a source process name failing to authenticate with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 generates on domain controllers, member servers, and workstations when an account fails to logon. Logon Type 2 describes an iteractive logon attempt.\ @@ -17077,29 +14995,20 @@ action.escu.full_search_name = ESCU - Multiple Users Remotely Failing To Authent action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Active Directory Password Spraying"] -======= -action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = ComputerName action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Potential password spraying attack on $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Multiple Users Remotely Failing To Authenticate From Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"]} -======= -action.correlationsearch.label = ESCU - Office Product Spawning Rundll32 with no DLL - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Active Directory Password Spraying"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.003"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies a source host failing to authenticate against a remote host with multiple users. This behavior could represent an adversary performing a Password Spraying attack against an Active Directory environment to obtain initial access or elevate privileges. Event 4625 documents each and every failed attempt to logon to the local computer. This event generates on domain controllers, member servers, and workstations. Logon Type 3 describes an remote authentication attempt.\ @@ -17136,29 +15045,20 @@ action.escu.full_search_name = ESCU - NLTest Domain Trust Discovery - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ryuk Ransomware", "Domain Trust Discovery"] -======= -action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] +action.risk.param._risk_score = 15 +action.risk.param._risk_message = Domain trust discovery execution on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - NLTest Domain Trust Discovery - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Domain Trust Discovery"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Office Product Spawning Wmic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Domain Trust Discovery"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1482"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -17235,12 +15135,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Possible Nishang Invoke-PowerShellTCPOneLine behavior on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Nishang PowershellTCPOneLine - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Command and Control"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -17321,12 +15228,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Credential Dumping", "HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 50 +action.risk.param._risk_message = Active Directory NTDS export on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 50}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Ntdsutil Export NTDS - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Credential Access"], "impact": 100, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1003.003"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -17365,18 +15279,18 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 18 +action.risk.param._risk_message = User $Actor.ID$ has created a new federation setting on $dest$ from IP Address $ActorIpAddress$ +action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 18, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "Actor.ID", "risk_object_type": "user", "risk_score": 18, "threat_object_field": "Actor.ID", "threat_object_type": "user"}, {"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 18}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Add App Role Assignment Grant User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 30, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Actor.ID", "role": ["Attacker"], "type": "User"}, {"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17405,35 +15319,20 @@ action.escu.full_search_name = ESCU - O365 Added Service Principal - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Windows Privilege Escalation"] -action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Target.ID action.risk.param._risk_object_type = system -action.risk.param._risk_score = 72 -action.risk.param._risk_message = A suspicious file modification or replace in $file_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "file_path", "threat_object_type": "file_path"}] ->>>>>>> develop +action.risk.param._risk_score = 42 +action.risk.param._risk_message = User $Actor.ID$ created a new federation setting on $Target.ID$ and added service principal credentials from IP Address $ActorIpAddress$ +action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "Target.ID", "risk_object_type": "system", "risk_score": 42}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - O365 Added Service Principal - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} -======= -action.correlationsearch.label = ESCU - Overwriting Accessibility Binaries - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "privilege escalation"}], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.008"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Attacker"], "type": "file_path"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "Target.ID", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17455,42 +15354,27 @@ action.escu.data_models = [] action.escu.eli5 = This search detects newly added IP addresses/CIDR blocks to the list of MFA Trusted IPs to bypass multi factor authentication. Attackers are often known to use this technique so that they can bypass the MFA system. action.escu.how_to_implement = You must install Splunk Microsoft Office 365 add-on. This search works with o365:management:activity action.escu.known_false_positives = Unless it is a special case, it is uncommon to continually update Trusted IPs to MFA configuration. -action.escu.creation_date = 2021-01-12 -action.escu.modification_date = 2021-01-12 +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 action.escu.confidence = high action.escu.full_search_name = ESCU - O365 Bypass MFA via Trusted IP - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] ->>>>>>> develop +action.risk.param._risk_object = user_id +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 42 +action.risk.param._risk_message = User $user_id$ has added new IP addresses $ip_addresses_new_added$ to a list of trusted IPs to bypass MFA +action.risk.param._risk = [{"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "ip_addresses_new_added", "risk_object_type": "system", "risk_score": 42, "threat_object_field": "ip_addresses_new_added", "threat_object_type": "ip address"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}, {"risk_object_field": "user_id", "risk_object_type": "user", "risk_score": 42, "threat_object_field": "user_id", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - O365 Bypass MFA via Trusted IP - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007"]} -======= -action.correlationsearch.label = ESCU - Permission Modification using Takeown App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1562.007"], "observable": [{"name": "ip_addresses_new_added", "role": ["Attacker"], "type": "IP Address"}, {"name": "user_id", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17501,7 +15385,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature vendor_product vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter` +search = `o365_management_activity` signature="Set Company Information." ModifiedProperties{}.Name=StrongAuthenticationPolicy | rex max_match=100 field=ModifiedProperties{}.NewValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | rex max_match=100 field=ModifiedProperties{}.OldValue "(?\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\/\d{1,2})" | eval ip_addresses_old=if(isnotnull(ip_addresses_old),ip_addresses_old,"0") | mvexpand ip_addresses_new_added | where isnull(mvfind(ip_addresses_old,ip_addresses_new_added)) |stats count min(_time) as firstTime max(_time) as lastTime values(ip_addresses_old) as ip_addresses_old by user ip_addresses_new_added signature Workload vendor_account status user_id action | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `o365_bypass_mfa_via_trusted_ip_filter` [ESCU - O365 Disable MFA - Rule] action.escu = 0 @@ -17519,35 +15403,20 @@ action.escu.full_search_name = ESCU - O365 Disable MFA - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Command and Control", "Data Exfiltration"] -action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$ -action.risk.param._risk = [{"threat_object_field": "uri_path", "threat_object_type": "uripath"}, {"threat_object_field": "form_data", "threat_object_type": "formdata"}] ->>>>>>> develop +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 64 +action.risk.param._risk_message = User $user$ has executed an operation $Operation$ for this destination $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 64}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64, "threat_object_field": "user", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - O365 Disable MFA - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} -======= -action.correlationsearch.label = ESCU - Plain HTTP POST Exfiltrated Data - Rule -action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "UriPath"}, {"name": "form_data", "role": ["Attacker"], "type": "formdata"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17576,35 +15445,20 @@ action.escu.full_search_name = ESCU - O365 Excessive Authentication Failures Ale action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Malicious PowerShell"] -action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = user action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 -action.risk.param._risk_message = A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}] ->>>>>>> develop +action.risk.param._risk_score = 64 +action.risk.param._risk_message = User $user$ has caused excessive number of authentication failures from $src_ip$ using UserAgent $UserAgent$. +action.risk.param._risk = [{"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - O365 Excessive Authentication Failures Alert - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"]} -======= -action.correlationsearch.label = ESCU - PowerShell Domain Enumeration - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Initial Access"], "impact": 80, "kill_chain_phases": ["Not Applicable"], "mitre_attack": ["T1110"], "observable": [{"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17623,55 +15477,30 @@ action.escu.enabled = 1 description = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. action.escu.mappings = {"kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} action.escu.data_models = [] -<<<<<<< HEAD action.escu.eli5 = This search detects accounts with high number of Single Sign ON (SSO) logon errors. Excessive logon errors may indicate attempts to bruteforce of password or single sign on token hijack or reuse. action.escu.how_to_implement = You must install splunk Microsoft Office 365 add-on. This search works with o365:management:activity action.escu.known_false_positives = Logon errors may not be malicious in nature however it may indicate attempts to reuse a token or password obtained via credential access attack. action.escu.creation_date = 2021-01-26 action.escu.modification_date = 2021-01-26 -======= -action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ -This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \ -During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. -action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -action.escu.known_false_positives = False positives should be limited as day to day scripts do not use this method. -action.escu.creation_date = 2021-06-10 -action.escu.modification_date = 2021-06-10 ->>>>>>> develop action.escu.confidence = high action.escu.full_search_name = ESCU - O365 Excessive SSO logon errors - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Malicious PowerShell"] -action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = UserId action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A suspicious powershell script contains reflective class assembly command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}] ->>>>>>> develop +action.risk.param._risk_score = 64 +action.risk.param._risk_message = User $UserId$ has caused excessive number of SSO logon errors from $ActorIpAddress$ using UserAgent $UserAgent$. +action.risk.param._risk = [{"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "ActorIpAddress", "risk_object_type": "system", "risk_score": 64, "threat_object_field": "ActorIpAddress", "threat_object_type": "ip address"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - O365 Excessive SSO logon errors - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"]} -======= -action.correlationsearch.label = ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Initial Access"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1556"], "observable": [{"name": "ActorIpAddress", "role": ["Attacker"], "type": "IP Address"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17682,11 +15511,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = `o365_management_activity` Workload=AzureActiveDirectory LogonError=SsoArtifactInvalidOrExpired | stats count min(_time) as firstTime max(_time) as lastTime by LogonError ActorIpAddress UserAgent UserId | where count > 5 | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `o365_excessive_sso_logon_errors_filter` -======= -search = `powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter` ->>>>>>> develop [ESCU - O365 New Federated Domain Added - Rule] action.escu = 0 @@ -17704,35 +15529,20 @@ action.escu.full_search_name = ESCU - O365 New Federated Domain Added - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Office 365 Detections", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["BITS Jobs"] -action.risk = 1 -action.risk.param._risk_object = user +action.risk.param._risk_object = UserId action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] ->>>>>>> develop +action.risk.param._risk_score = 64 +action.risk.param._risk_message = User $UserId$ has added a new federated domaain $Parameters.Value$ for $OrganizationName$ +action.risk.param._risk = [{"threat_object_field": "OrganizationName", "threat_object_type": "other"}, {"risk_object_field": "UserId", "risk_object_type": "user", "risk_score": 64}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - O365 New Federated Domain Added - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"]} -======= -action.correlationsearch.label = ESCU - PowerShell Start-BitsTransfer - Rule -action.correlationsearch.annotations = {"analytic_story": ["BITS Jobs"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Cloud Federated Credential Abuse"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1136.003"], "observable": [{"name": "OrganizationName", "role": ["Victim"], "type": "Other"}, {"name": "UserId", "role": ["Victim"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17761,35 +15571,20 @@ action.escu.full_search_name = ESCU - O365 PST export alert - Rule action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Malicious PowerShell"] -action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = Source action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}] ->>>>>>> develop +action.risk.param._risk_score = 48 +action.risk.param._risk_message = User $Source$ has exported a PST file from the search using this operation- $Operation$ with a severity of $Severity$ +action.risk.param._risk = [{"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}, {"risk_object_field": "Source", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "Source", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - O365 PST export alert - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"]} -======= -action.correlationsearch.label = ESCU - Powershell Creating Thread Mutex - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Actions on Objective"], "mitre_attack": ["T1114"], "observable": [{"name": "Source", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17820,18 +15615,18 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 48 +action.risk.param._risk_message = User $user$ has configured a forwarding rule for multiple mailboxes to the same destination $ForwardingAddress$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Suspicious Admin Email Forwarding - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Exfiltration"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17862,18 +15657,18 @@ action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", action.escu.providing_technologies = [] action.escu.analytic_story = ["Office 365 Detections"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 48 +action.risk.param._risk_message = User $user$ has delegated suspicious rights $AccessRights$ to user $dest_user$ that allow access to sensitive +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - O365 Suspicious Rights Delegation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.002"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17902,35 +15697,20 @@ action.escu.full_search_name = ESCU - O365 Suspicious User Email Forwarding - Ru action.escu.search_type = detection action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Office 365 Detections", "Data Exfiltration"] action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 20 -action.risk.param._risk_message = -action.risk.param._risk = [] -======= -action.escu.analytic_story = ["Malicious PowerShell"] -action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = ForwardingSmtpAddress action.risk.param._risk_object_type = user action.risk.param._risk_score = 48 -action.risk.param._risk_message = A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 48}] ->>>>>>> develop +action.risk.param._risk_message = User $user$ configured multiple users $src_user$ with a count of $count_src_user$, a forwarding rule to same destination $ForwardingSmtpAddress$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user", "threat_object_type": "user"}, {"risk_object_field": "ForwardingSmtpAddress", "risk_object_type": "user", "risk_score": 48}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - O365 Suspicious User Email Forwarding - Rule -action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"]} -======= -action.correlationsearch.label = ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Office 365 Detections", "Data Exfiltration"], "cis20": ["CIS 16"], "confidence": 60, "context": ["Source:Cloud Data", "Scope:External", "Stage:Exfiltration", "Stage:Execution"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1114.003"], "nist": ["DE.DP", "DE.AE"], "observable": [{"name": "user", "role": ["Attacker"], "type": "User"}, {"name": "ForwardingSmtpAddress", "role": ["Other"], "type": "Email Address"}]} schedule_window = auto alert.digest_mode = 1 disabled = true @@ -17959,29 +15739,20 @@ action.escu.full_search_name = ESCU - Office Application Spawn rundll32 process action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"] -======= -action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Office application spawning rundll32.exe on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Office Application Spawn rundll32 process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} -======= -action.correlationsearch.label = ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1027", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18016,29 +15787,20 @@ action.escu.full_search_name = ESCU - Office Document Creating Schedule Task - R action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Spearphishing Attachments"] -======= -action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Office document creating a schedule task on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Office Document Creating Schedule Task - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} -======= -action.correlationsearch.label = ESCU - Powershell Processing Stream Of Data - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , beaconing using task schedule malware entry The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it's possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' @@ -18072,29 +15834,20 @@ action.escu.full_search_name = ESCU - Office Document Executing Macro Code - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Spearphishing Attachments", "Trickbot"] -======= -action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = Computer +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Office document executing a macro on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Office Document Executing Macro Code - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} -======= -action.correlationsearch.label = ESCU - Powershell Remote Thread To Known Windows Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 90, "context": ["source:endpoint", {"stage": "Defense Evasion"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments", "Trickbot"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office document as an attachment that may execute malicious payload, download malware payload or other malware component. It is really good practice to disable macro by default to avoid automatically execute macro code while opening or closing a office document files. @@ -18128,29 +15881,20 @@ action.escu.full_search_name = ESCU - Office Document Spawned Child Process To D action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Spearphishing Attachments"] -======= -action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 40 -action.risk.param._risk_message = A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Office document spawning suspicious child process on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Office Document Spawned Child Process To Download - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} -======= -action.correlationsearch.label = ESCU - Powershell Using memory As Backing Store - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is to detect potential malicious office document executing lolbin child process to download payload or other malware. Since most of the attacker abused the capability of office document to execute living on land application to blend it to the normal noise in the infected machine to cover its track. @@ -18184,29 +15928,20 @@ action.escu.full_search_name = ESCU - Office Product Spawning BITSAdmin - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Spearphishing Attachments"] -======= -action.escu.analytic_story = ["Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Office Product Spawning BITSAdmin - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} -======= -action.correlationsearch.label = ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18242,12 +15977,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Product Spawning CertUtil - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18283,12 +16025,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Office Product Spawning MSHTA - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18325,23 +16074,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system action.risk.param._risk_score = 63 -action.risk.param._risk_message = A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ and no dll commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Office Product Spawning Rundll32 with no DLL - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} -======= -action.correlationsearch.label = ESCU - Process Creating LNK file in Suspicious Location - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "Initial Access"}], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18376,29 +16120,20 @@ action.escu.full_search_name = ESCU - Office Product Spawning Wmic - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Spearphishing Attachments"] -======= -action.escu.analytic_story = ["Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 60 -action.risk.param._risk_message = A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 60}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = office parent process $parent_process_name$ will execute a suspicious child process $process_name$ with process id $process_id$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process_name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Office Product Spawning Wmic - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} -======= -action.correlationsearch.label = ESCU - Process Deleting Its Process File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["source:endpoint", {"stage": "Credential Access"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 90, "context": ["source:endpoint", {"stage": "recon"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process_name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18433,29 +16168,13 @@ action.escu.full_search_name = ESCU - Okta Account Lockout Events - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Okta Activity"] -======= -action.escu.analytic_story = ["Suspicious WMI Use"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 -action.risk.param._risk_message = A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Okta Account Lockout Events - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Process Execution via WMI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 70, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = Detect Okta user lockout events @@ -18489,29 +16208,13 @@ action.escu.full_search_name = ESCU - Okta Failed SSO Attempts - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Okta Activity"] -======= -action.escu.analytic_story = ["XMRig"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Okta Failed SSO Attempts - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Okta Activity"], "cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Process Kill Base On File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = Detect failed Okta SSO events @@ -18626,29 +16329,13 @@ action.escu.full_search_name = ESCU - Osquery pack - ColdRoot detection - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["ColdRoot MacOS RAT"] -======= -action.escu.analytic_story = ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 -action.risk.param._risk_message = A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Osquery pack - ColdRoot detection - Rule action.correlationsearch.annotations = {"analytic_story": ["ColdRoot MacOS RAT"], "cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Installation", "Command and Control"], "nist": ["DE.DP", "DE.CM", "PR.PT"]} -======= -action.correlationsearch.label = ESCU - Processes launching netsh - Rule -action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 70, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search looks for ColdRoot events from the osx-attacks osquery pack. @@ -18683,12 +16370,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Privilege Escalation"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 72 +action.risk.param._risk_message = A suspicious file modification or replace in $file_path$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "file_path", "threat_object_type": "file_path"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Overwriting Accessibility Binaries - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.008"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation"], "cis20": ["CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "privilege escalation"}], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.008"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Attacker"], "type": "file_path"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18724,12 +16418,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A suspicious of execution of $process_name$ with process id $process_id$ and commandline $process$ to modify permission of directory or files in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Permission Modification using Takeown App - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1222"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18765,12 +16466,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Command and Control", "Data Exfiltration"] +action.risk = 1 +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A http post $http_method$ sending packet with plain text of information $form_data$ in uri path $uri_path$ +action.risk.param._risk = [{"threat_object_field": "uri_path", "threat_object_type": "uripath"}, {"threat_object_field": "form_data", "threat_object_type": "formdata"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Plain HTTP POST Exfiltrated Data - Rule -action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Data Exfiltration"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Exfiltration"], "impact": 70, "kill_chain_phases": ["Exfiltration"], "mitre_attack": ["T1048.003"], "observable": [{"name": "uri_path", "role": ["Attacker"], "type": "UriPath"}, {"name": "form_data", "role": ["Attacker"], "type": "formdata"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using HTTP POST method as part of data exfiltration. @@ -18809,12 +16517,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 42 +action.risk.param._risk_message = A suspicious powershell script contains domain enumeration command in $Message$ with EventCode $EventCode$ in host $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - PowerShell Domain Enumeration - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -18846,7 +16561,7 @@ action.escu.eli5 = The following analytic utilizes PowerShell Script Block Loggi This analytic identifies the use of PowerShell loading .net assembly via reflection. This is commonly found in malicious PowerShell usage, including Empire and Cobalt Strike. In addition, the `load(` value may be modifed by removing `(` and it will identify more events to review. \ During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. -action.escu.known_false_positives = False positives will be limited to +action.escu.known_false_positives = False positives should be limited as day to day scripts do not use this method. action.escu.creation_date = 2021-06-10 action.escu.modification_date = 2021-06-10 action.escu.confidence = high @@ -18854,29 +16569,20 @@ action.escu.full_search_name = ESCU - PowerShell Loading DotNET into Memory via action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Malicious PowerShell"] -======= -action.escu.analytic_story = ["Clop Ransomware", "DarkSide Ransomware"] action.risk = 1 -action.risk.param._risk_object = user +action.risk.param._risk_object = User action.risk.param._risk_object_type = user -action.risk.param._risk_score = 81 -action.risk.param._risk_message = A high frequency file creation of $file_name$ in different file path in host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}] +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A suspicious powershell script contains reflective class assembly command in $Message$ to load .net code in memory with EventCode $EventCode$ in host $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} -======= -action.correlationsearch.label = ESCU - Ransomware Notes bulk creation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware", "DarkSide Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 90, "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -18894,7 +16600,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `powershell` EventCode=4104 Message="*[system.reflection.assembly]::load(*" | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter` +search = `powershell` EventCode=4104 Message IN ("*[system.reflection.assembly]::load(*","*[reflection.assembly]*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `powershell_loading_dotnet_into_memory_via_system_reflection_assembly_filter` [ESCU - PowerShell Start-BitsTransfer - Rule] action.escu = 0 @@ -18912,29 +16618,20 @@ action.escu.full_search_name = ESCU - PowerShell Start-BitsTransfer - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["BITS Jobs"] -======= -action.escu.analytic_story = ["Ransomware", "Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 56 -action.risk.param._risk_message = A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk_message = A suspicious process $process_name$ with commandline $process$ that are related to bittransfer functionality in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - PowerShell Start-BitsTransfer - Rule -action.correlationsearch.annotations = {"analytic_story": ["BITS Jobs"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"]} -======= -action.correlationsearch.label = ESCU - Recon AVProduct Through Pwh or WMI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Reconnaissance"}], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["BITS Jobs"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -18973,21 +16670,16 @@ action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 action.risk.param._risk_object = User action.risk.param._risk_object_type = user -action.risk.param._risk_score = 60 -action.risk.param._risk_message = A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 60}] +action.risk.param._risk_score = 40 +action.risk.param._risk_message = A suspicious powershell script contains Thread Mutex in $Message$ with EventCode $EventCode$ in host $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Powershell Creating Thread Mutex - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]} -======= -action.correlationsearch.label = ESCU - Recon Using WMI Class - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Reconnaissance"}], "impact": 75, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using the `mutex` function. This function is commonly seen in some obfuscated PowerShell scripts to make sure that only one instance of there process is running on a compromise machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. @@ -19062,29 +16754,13 @@ action.escu.full_search_name = ESCU - Powershell Enable SMB1Protocol Feature - R action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Malicious PowerShell", "Ransomware"] -======= -action.escu.analytic_story = ["Windows Service Abuse", "Windows Persistence Techniques"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 45 -action.risk.param._risk_message = A reg.exe process $process_name$ with commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 45}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Powershell Enable SMB1Protocol Feature - Rule action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027.005"]} -======= -action.correlationsearch.label = ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 60, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation", "Defense Evasion"], "impact": 75, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the compromise network system. @@ -19125,12 +16801,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 48 +action.risk.param._risk_message = A suspicious powershell script contains GetProcAddress API in $Message$ with EventCode $EventCode$ in host $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 48}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1059.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "recon"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -19173,29 +16856,20 @@ action.escu.full_search_name = ESCU - Powershell Fileless Script Contains Base64 action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Malicious PowerShell"] -======= -action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A "] action.risk = 1 -action.risk.param._risk_object = user +action.risk.param._risk_object = User action.risk.param._risk_object_type = user -action.risk.param._risk_score = 76 -action.risk.param._risk_message = A registry activity in $registry_path$ related to persistence in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 76}] +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A suspicious powershell script contains base64 command in $Message$ with EventCode $EventCode$ in host $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1027", "T1059.001"]} -======= -action.correlationsearch.label = ESCU - Registry Keys Used For Persistence - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A "], "cis20": ["CIS 8"], "confidence": 95, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1027", "T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -19232,29 +16906,20 @@ action.escu.full_search_name = ESCU - Powershell Processing Stream Of Data - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Malicious PowerShell"] -======= -action.escu.analytic_story = ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"] action.risk = 1 -action.risk.param._risk_object = user +action.risk.param._risk_object = User action.risk.param._risk_object_type = user -action.risk.param._risk_score = 76 -action.risk.param._risk_message = A registry activity in $registry_path$ related to privilege escalation in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 76}] +action.risk.param._risk_score = 40 +action.risk.param._risk_message = A suspicious powershell script contains stream command in $Message$ commonly for processing compressed or to decompressed binary file with EventCode $EventCode$ in host $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Powershell Processing Stream Of Data - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"]} -======= -action.correlationsearch.label = ESCU - Registry Keys Used For Privilege Escalation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"], "cis20": ["CIS 8"], "confidence": 95, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059.001"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is processing compressed stream data. This is typically found in obfuscated PowerShell or PowerShell executing embedded .NET or binary files that are stream flattened and will be deflated durnig execution. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. @@ -19288,29 +16953,20 @@ action.escu.full_search_name = ESCU - Powershell Remote Thread To Known Windows action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Trickbot"] -======= -action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A registry activity in $registry_path$ related to shim modication in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A suspicious powershell process $process_name$ that tries to create a remote thread on target process $TargetImage$ with eventcode $EventCode$ in host $Computer$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "process_name", "threat_object_type": "process name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Powershell Remote Thread To Known Windows Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} -======= -action.correlationsearch.label = ESCU - Registry Keys for Creating SHIM Databases - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 90, "context": ["source:endpoint", {"stage": "Defense Evasion"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "process name"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and offensive tooling like cobaltstrike where it load a shellcode to svchost.exe to execute reverse shell to c2 and download another payload @@ -19345,12 +17001,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 40 +action.risk.param._risk_message = A suspicious powershell script contains memorystream command in $Message$ as new object backstore with EventCode $EventCode$ in host $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 40}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 40}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Powershell Using memory As Backing Store - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 50, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1140"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 that is using memory stream as new object backstore. The malicious PowerShell script will contain stream flate data and will be decompressed in memory to run or drop the actual payload. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. @@ -19385,12 +17048,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A suspicious process $process_name$ with process id $process_id$ contains commandline $process$ to ignore all bcdedit execution failure in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 80, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -19465,7 +17135,6 @@ action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] cron_schedule = 0 1 1 1,4,7,10 * dispatch.earliest_time = -90d@d @@ -19473,22 +17142,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen AWS Cross Account Activity - Initial - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} -======= -action.escu.analytic_story = ["Ransomware", "Suspicious WMI Use"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 -action.risk.param._risk_message = A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Remote Process Instantiation via WMI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 70, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -19552,29 +17205,13 @@ action.escu.full_search_name = ESCU - Previously Seen AWS Provisioning Activity action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"] -======= -action.escu.analytic_story = ["Suspicious WMI Use"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 -action.risk.param._risk_message = A wmic.exe process $process$ contain node commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Previously Seen AWS Provisioning Activity Sources - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"]} -======= -action.correlationsearch.label = ESCU - Remote WMI Command Attempt - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 60, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. @@ -19608,29 +17245,13 @@ action.escu.full_search_name = ESCU - Previously Seen AWS Regions action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -======= -action.escu.analytic_story = ["Clop Ransomware"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 72 -action.risk.param._risk_message = A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Previously Seen AWS Regions - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]} -======= -action.correlationsearch.label = ESCU - Resize ShadowStorage volume - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days @@ -19664,7 +17285,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User R action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud User Activities"] cron_schedule = 0 1 1 1,4,7,10 * dispatch.earliest_time = -90d@d @@ -19672,22 +17292,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud API Calls Per User Role - Initial - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} -======= -action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 54 -action.risk.param._risk_message = A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 54}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Revil Common Exec Parameter - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -19716,7 +17320,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User R action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud User Activities"] cron_schedule = 10 0 * * * dispatch.earliest_time = -1450m@m @@ -19724,22 +17327,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud API Calls Per User Role - Update - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} -======= -action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 60 -action.risk.param._risk_message = A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 60}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Revil Registry Entry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -19768,7 +17355,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] cron_schedule = 55 * * * * dispatch.earliest_time = -70m@m @@ -19776,22 +17362,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Creations By User - Initial - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -======= -action.escu.analytic_story = ["Unusual Processes"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 -action.risk.param._risk_message = A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - RunDLL Loading DLL By Ordinal - Rule -action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 8"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -19820,7 +17390,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] cron_schedule = 10 0 * * * dispatch.earliest_time = -1450m@m @@ -19828,22 +17397,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Creations By User - Update - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -======= -action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 -action.risk.param._risk_message = A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "processname"}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Rundll32 with no Command Line Arguments with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "processname"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -19872,7 +17425,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Ini action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] cron_schedule = 0 1 1 1,4,7,10 * dispatch.earliest_time = -90d@d @@ -19880,22 +17432,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Images - Initial - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -======= -action.escu.analytic_story = ["Ryuk Ransomware"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 -action.risk.param._risk_message = A creation of ryuk test file $file_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Ryuk Test Files Detected - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -19924,7 +17460,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Upd action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] cron_schedule = 10 0 * * * dispatch.earliest_time = -1450m@m @@ -19932,22 +17467,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Images - Update - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -======= -action.escu.analytic_story = ["Ryuk Ransomware"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A process $process_name$ with wake on LAN commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Ryuk Wake on LAN Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1059.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -19976,7 +17495,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Typ action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] cron_schedule = 0 1 1 1,4,7,10 * dispatch.earliest_time = -90d@d @@ -19984,22 +17502,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Instance Types - Initial - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -======= -action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A slui process $process_name$ with elevated commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "system", "risk_score": 63}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - SLUI RunAs Elevated - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "Hostname"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20028,7 +17530,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Typ action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] cron_schedule = 10 0 * * * dispatch.earliest_time = -1450m@m @@ -20036,22 +17537,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Instance Types - Update - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -======= -action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - SLUI Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20185,7 +17670,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activit action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] cron_schedule = 10 0 * * * dispatch.earliest_time = -1450m@m @@ -20193,22 +17677,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud Provisioning Activity Sources - Update - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"]} -======= -action.escu.analytic_story = ["SamSam Ransomware"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 12 -action.risk.param._risk_message = A samsam ransomware test file creation in $file_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 12}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 12}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Samsam Test File Write - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 20, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 60, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20237,7 +17705,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Initial action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] cron_schedule = 0 1 1 1,4,7,10 * dispatch.earliest_time = -90d@d @@ -20245,22 +17712,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud Regions - Initial - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -======= -action.escu.analytic_story = ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Sc exe Manipulating Windows Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20289,7 +17740,6 @@ action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Update action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cloud Cryptomining"] cron_schedule = 10 0 * * * dispatch.earliest_time = -1450m@m @@ -20297,22 +17747,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Cloud Regions - Update - Rule action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -======= -action.escu.analytic_story = ["Windows Persistence Techniques"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "Arguments", "threat_object_type": "arguments"}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Schedule Task with HTTP Command Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Arguments", "role": ["Attacker"], "type": "Arguments"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20341,29 +17775,13 @@ action.escu.full_search_name = ESCU - Previously Seen EC2 AMIs action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS Cryptomining"] -======= -action.escu.analytic_story = ["Windows Persistence Techniques", "Trickbot"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 -action.risk.param._risk_message = A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Arguments", "threat_object_type": "arguments"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Previously Seen EC2 AMIs - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"]} -======= -action.correlationsearch.label = ESCU - Schedule Task with Rundll32 Command Trigger - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Trickbot"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Arguments", "role": ["Attacker"], "type": "Arguments"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search builds a table of previously seen AMIs used to launch EC2 instances @@ -20397,29 +17815,13 @@ action.escu.full_search_name = ESCU - Previously Seen EC2 Instance Types action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS Cryptomining"] -======= -action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Previously Seen EC2 Instance Types - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"]} -======= -action.correlationsearch.label = ESCU - Scheduled Task Deleted Or Created via CMD - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search builds a table of previously seen EC2 instance types @@ -20493,29 +17895,13 @@ action.escu.full_search_name = ESCU - Previously Seen EC2 Modifications By User action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Unusual AWS EC2 Modifications"] -======= -action.escu.analytic_story = ["XMRig"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 48 -action.risk.param._risk_message = A "on demand" execution of schedule task process $process_name$ using commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Previously Seen EC2 Modifications By User - Rule action.correlationsearch.annotations = {"analytic_story": ["Unusual AWS EC2 Modifications"]} -======= -action.correlationsearch.label = ESCU - Schtasks Run Task On Demand - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -20550,7 +17936,6 @@ action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] cron_schedule = 0 1 1 1,4,7,10 * dispatch.earliest_time = -90d@d @@ -20558,22 +17943,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Running Windows Services - Initial - Rule action.correlationsearch.annotations = {"analytic_story": ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"]} -======= -action.escu.analytic_story = ["Lateral Movement", "NOBELIUM Group"] -action.risk = 1 -action.risk.param._risk_object = Processes.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A schedule task process $process_name$ with remote job commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 63}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Schtasks scheduling job on remote system - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20602,7 +17971,6 @@ action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] cron_schedule = 55 * * * * dispatch.earliest_time = -70m@m @@ -20610,22 +17978,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Running Windows Services - Update - Rule action.correlationsearch.annotations = {"analytic_story": ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"]} -======= -action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Schtasks used for forcing a reboot - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware"], "cis20": ["CIS 3"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20654,7 +18006,6 @@ action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Upda action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] cron_schedule = 10 0 * * * dispatch.earliest_time = -1450m@m @@ -20662,22 +18013,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Users In CloudTrail - Update - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} -======= -action.escu.analytic_story = ["Suspicious WMI Use"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 36 -action.risk.param._risk_message = A wmic.exe process $process_name$ taht execute script in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Script Execution via WMI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 60, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20706,7 +18041,6 @@ action.escu.full_search_name = ESCU - Previously Seen Users in CloudTrail - Init action.escu.search_type = support action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] cron_schedule = 0 1 1 1,4,7,10 * dispatch.earliest_time = -90d@d @@ -20714,22 +18048,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Users in CloudTrail - Initial - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} -======= -action.escu.analytic_story = ["Cobalt Strike"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 -action.risk.param._risk_message = A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "processname"}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - SearchProtocolHost with no Command Line with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "processname"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20758,7 +18076,6 @@ action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Ini action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Zoom Child Processes"] cron_schedule = 0 1 1 1,4,7,10 * dispatch.earliest_time = -90d@d @@ -20766,22 +18083,6 @@ dispatch.latest_time = -1d@d action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Zoom Child Processes - Initial - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Zoom Child Processes"]} -======= -action.escu.analytic_story = ["Credential Dumping"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 80 -action.risk.param._risk_message = A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - SecretDumps Offline NTDS Dumping Tool - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["source:endpoint", {"stage": "Credential Access"}], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20810,7 +18111,6 @@ action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Upd action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Zoom Child Processes"] cron_schedule = 55 * * * * dispatch.earliest_time = -70m@m @@ -20818,22 +18118,6 @@ dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen Zoom Child Processes - Update - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Zoom Child Processes"]} -======= -action.escu.analytic_story = ["Cobalt Strike"] -action.risk = 1 -action.risk.param._risk_object = Processes.user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 76 -action.risk.param._risk_message = A service process $parent_process_name$ with process path $process_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 76}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Services Escalate Exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 95, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto alert.digest_mode = 1 disabled = true @@ -20862,29 +18146,13 @@ action.escu.full_search_name = ESCU - Previously seen API call per user roles in action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["AWS User Monitoring"] -======= -action.escu.analytic_story = ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 48 -action.risk.param._risk_message = A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"threat_object_field": "registry_path", "threat_object_type": "registrypath"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Previously seen API call per user roles in CloudTrail - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} -======= -action.correlationsearch.label = ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "registry_path", "role": ["Others"], "type": "RegistryPath"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. @@ -20918,29 +18186,13 @@ action.escu.full_search_name = ESCU - Previously seen S3 bucket access by remote action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS S3 Activities"] -======= -action.escu.analytic_story = ["Windows Persistence Techniques"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = A process that possibly write shim database in $file_path$ in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "file_path", "threat_object_type": "file path"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Previously seen S3 bucket access by remote IP - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"]} -======= -action.correlationsearch.label = ESCU - Shim Database File Creation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Others"], "type": "file path"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" @@ -20974,29 +18226,13 @@ action.escu.full_search_name = ESCU - Previously seen command line arguments action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity"] -======= -action.escu.analytic_story = ["Windows Persistence Techniques"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A process $process_name$ that possible create a shim db silently in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Previously seen command line arguments - Rule action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity"]} -======= -action.correlationsearch.label = ESCU - Shim Database Installation With Suspicious Parameters - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. @@ -21030,29 +18266,13 @@ action.escu.full_search_name = ESCU - Previously seen users in CloudTrail action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious AWS Login Activities"] -======= -action.escu.analytic_story = ["Account Monitoring and Controls"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A user account created or delete shortly in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Previously seen users in CloudTrail - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"]} -======= -action.correlationsearch.label = ESCU - Short Lived Windows Accounts - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 90, "context": ["source:endpoint", {"stage": "Persistence"}], "impact": 70, "mitre_attack": ["T1136.001"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'src'] @@ -21091,7 +18311,6 @@ action.escu.full_search_name = ESCU - Print Spooler Adding A Printer Driver - Ru action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 action.risk.param._risk_object = ComputerName @@ -21099,27 +18318,13 @@ action.risk.param._risk_object_type = system action.risk.param._risk_score = 72 action.risk.param._risk_message = Suspicious print driver was loaded on endpoint $ComputerName$. action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 72}] -======= -action.escu.analytic_story = ["DHS Report TA18-074A"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 -action.risk.param._risk_message = A suspicious process $process_name$ with single letter in host $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Print Spooler Adding A Printer Driver - Rule action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} -======= -action.correlationsearch.label = ESCU - Single Letter Process On Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 2"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ @@ -21212,12 +18417,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A process $process_name$ that launching .lnk file in $file_path$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Process Creating LNK file in Suspicious Location - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "cis20": ["CIS 7", "CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "Initial Access"}], "impact": 70, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1566.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21253,12 +18465,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 60 +action.risk.param._risk_message = A process $Image$ tries to delete its process path in commandline $cmdline$ as part of defense evasion in host $Computer$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 60}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Process Deleting Its Process File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 100, "context": ["source:endpoint", {"stage": "Credential Access"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -21294,12 +18513,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious WMI Use"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = A remote instance execution of wmic.exe that will spawn $parent_process_name$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Process Execution via WMI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 70, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21335,12 +18561,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A process $process_name$ attempt to kill process by its file path using commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Process Kill Base On File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21457,12 +18690,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 42 +action.risk.param._risk_message = A process $process_name$ that tries to execute netsh commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Processes launching netsh - Rule -action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Netsh Abuse", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 70, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21497,29 +18737,13 @@ action.escu.full_search_name = ESCU - Prohibited Network Traffic Allowed - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"] -======= -action.escu.analytic_story = ["Ransomware"] -action.risk = 1 -action.risk.param._risk_object = -action.risk.param._risk_object_type = -action.risk.param._risk_score = 42 -action.risk.param._risk_message = Safeboot registry $Registry.registry_path$ was added or modified with a new value $Registry.registry_value_name$ -action.risk.param._risk = [] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Prohibited Network Traffic Allowed - Rule action.correlationsearch.annotations = {"analytic_story": ["Prohibited Traffic Allowed or Protocol Mismatch", "Ransomware", "Command and Control"], "cis20": ["CIS 9", "CIS 12"], "kill_chain_phases": ["Delivery", "Command and Control"], "mitre_attack": ["T1048"], "nist": ["DE.AE", "PR.AC"]} -======= -action.correlationsearch.label = ESCU - Start Up During Safe Mode Boot - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for network traffic defined by port and transport layer protocol in the Enterprise Security lookup table "lookup_interesting_ports", that is marked as prohibited, and has an associated 'allow' action in the Network_Traffic data model. This could be indicative of a misconfigured network device. @@ -21676,12 +18900,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Clop Ransomware", "DarkSide Ransomware"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 81 +action.risk.param._risk_message = A high frequency file creation of $file_name$ in different file path in host $Computer$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 81}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 81}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Ransomware Notes bulk creation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware", "DarkSide Ransomware"], "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"]} +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware", "DarkSide Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 90, "kill_chain_phases": ["Obfuscation"], "mitre_attack": ["T1486"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security industry or the ransomware note filename is not in your ransomware lookup table list for monitoring. @@ -21715,29 +18946,20 @@ action.escu.full_search_name = ESCU - Recon AVProduct Through Pwh or WMI - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware", "Malicious PowerShell"] -======= -action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 action.risk.param._risk_object = User action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A suspicious powershell script contains AV recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 56}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Recon AVProduct Through Pwh or WMI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Malicious PowerShell"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} -======= -action.correlationsearch.label = ESCU - Suspicious DLLHost no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Reconnaissance"}], "impact": 70, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104 performing checks to identify anti-virus products installed on the endpoint. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. @@ -21771,29 +18993,20 @@ action.escu.full_search_name = ESCU - Recon Using WMI Class - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Malicious PowerShell"] -======= -action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 63 -action.risk.param._risk_message = Suspicious driver $ImageLoaded$ on $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file name"}] +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 60 +action.risk.param._risk_message = A suspicious powershell script contains host recon command in $Message$ with EventCode $EventCode$ in host $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 60}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Recon Using WMI Class - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} -======= -action.correlationsearch.label = ESCU - Suspicious Driver Loaded Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "File Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 80, "context": ["source:endpoint", {"stage": "Reconnaissance"}], "impact": 75, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies suspicious PowerShell via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found where the adversary will identify services and system information on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. @@ -21809,11 +19022,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -<<<<<<< HEAD search = `powershell` EventCode=4104 (Message= "*SELECT*" OR Message= "*Get-WmiObject*") AND (Message= "*Win32_Bios*" OR Message= "*Win32_OperatingSystem*" OR Message= "*Win32_Processor*" OR Message= "*Win32_ComputerSystem*" OR Message= "*Win32_ComputerSystemProduct*" OR Message= "*Win32_ShadowCopy*") | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Message ComputerName User | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `recon_using_wmi_class_filter` -======= -search = `sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter` ->>>>>>> develop [ESCU - Recursive Delete of Directory In Batch CMD - Rule] action.escu = 0 @@ -21873,12 +19082,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Service Abuse", "Windows Persistence Techniques"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 45 +action.risk.param._risk_message = A reg.exe process $process_name$ with commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 45}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "Windows Persistence Techniques"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 60, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation", "Defense Evasion"], "impact": 75, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1574.011"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -21913,29 +19129,13 @@ action.escu.full_search_name = ESCU - Reg exe used to hide files directories via action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"] -======= -action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] -action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 9 -action.risk.param._risk_message = The Windows Event Log Service shutdown on $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 9}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Reg exe used to hide files directories via registry keys - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1564.001"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Suspicious Event Log Service Behavior - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -21971,12 +19171,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A "] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 76 +action.risk.param._risk_message = A registry activity in $registry_path$ related to persistence in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 76}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Registry Keys Used For Persistence - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A "], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Suspicious MSHTA Activity", "DHS Report TA18-074A", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Windows Persistence Techniques", "Emotet Malware DHS Report TA18-201A "], "cis20": ["CIS 8"], "confidence": 95, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1547.001"], "nist": ["PR.PT", "DE.CM", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22011,29 +19218,20 @@ action.escu.full_search_name = ESCU - Registry Keys Used For Privilege Escalatio action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"] -======= -action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = user action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk_score = 76 +action.risk.param._risk_message = A registry activity in $registry_path$ related to privilege escalation in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 76}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Registry Keys Used For Privilege Escalation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Suspicious GPUpdate no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Privilege Escalation", "Suspicious Windows Registry Activities", "Cloud Federated Credential Abuse"], "cis20": ["CIS 8"], "confidence": 95, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 80, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.012"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22069,12 +19267,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A registry activity in $registry_path$ related to shim modication in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Registry Keys for Creating SHIM Databases - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22109,29 +19314,13 @@ action.escu.full_search_name = ESCU - Remote Desktop Network Bruteforce - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware"] -======= -action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"] -action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 -action.risk.param._risk_message = Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Remote Desktop Network Bruteforce - Rule action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware"], "cis20": ["CIS 12", "CIS 9", "CIS 16"], "kill_chain_phases": ["Reconnaissance", "Delivery"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Suspicious MSBuild Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -22166,29 +19355,13 @@ action.escu.full_search_name = ESCU - Remote Desktop Network Traffic - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Lateral Movement"] -======= -action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild"] -action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 42 -action.risk.param._risk_message = Suspicious msbuild.exe process executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Remote Desktop Network Traffic - Rule action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Hidden Cobra Malware", "Lateral Movement"], "cis20": ["CIS 3", "CIS 9", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.001"], "nist": ["DE.AE", "PR.AC", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Suspicious MSBuild Spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -22265,12 +19438,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Suspicious WMI Use"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = A wmic.exe process $process$ contain process spawn commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Remote Process Instantiation via WMI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 70, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22305,29 +19485,13 @@ action.escu.full_search_name = ESCU - Remote Registry Key modifications - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"] -======= -action.escu.analytic_story = ["XMRig"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = Suspicioues process $Processes.process_path.file_path$ running from suspicious location -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Remote Registry Key modifications - Rule action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Suspicious Windows Registry Activities", "Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Suspicious Process File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22362,29 +19526,20 @@ action.escu.full_search_name = ESCU - Remote WMI Command Attempt - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious WMI Use"] -======= -action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 36 +action.risk.param._risk_message = A wmic.exe process $process$ contain node commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Remote WMI Command Attempt - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Suspicious Reg exe Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 60, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22419,29 +19574,20 @@ action.escu.full_search_name = ESCU - Resize ShadowStorage volume - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Clop Ransomware"] -======= -action.escu.analytic_story = ["Suspicious Regsvr32 Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 72 +action.risk.param._risk_message = A process $parent_process_name$ attempt to resize shadow copy with commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 72}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Resize ShadowStorage volume - Rule -action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} -======= -action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Clop Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22476,29 +19622,20 @@ action.escu.full_search_name = ESCU - Revil Common Exec Parameter - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] -======= -action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"] action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = user action.risk.param._risk_object_type = user -action.risk.param._risk_score = 63 -action.risk.param._risk_message = Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk_score = 54 +action.risk.param._risk_message = A process $process_name$ with commandline $process$ related to revil ransomware in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 54}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 54}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Revil Common Exec Parameter - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} -======= -action.correlationsearch.label = ESCU - Suspicious Rundll32 Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22533,29 +19670,20 @@ action.escu.full_search_name = ESCU - Revil Registry Entry - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] -======= -action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"] action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = user action.risk.param._risk_object_type = user -action.risk.param._risk_score = 35 -action.risk.param._risk_message = rundll32.exe running with suspicious parameters on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param._risk_score = 60 +action.risk.param._risk_message = A registry entry $registry_path$ with registry value $registry_value_name$ and $registry_value_name$ related to revil ransomware in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 60}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 60}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Revil Registry Entry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"]} -======= -action.correlationsearch.label = ESCU - Suspicious Rundll32 StartW - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1112"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22590,29 +19718,20 @@ action.escu.full_search_name = ESCU - RunDLL Loading DLL By Ordinal - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Unusual Processes"] -======= -action.escu.analytic_story = ["Suspicious Rundll32 Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = $Processes.process_path.file_path$ process potentially loading malicious code -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 70 +action.risk.param._risk_message = A rundll32 process $process_name$ with ordinal parameter like this process commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - RunDLL Loading DLL By Ordinal - Rule -action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Suspicious Rundll32 dllregisterserver - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Unusual Processes"], "cis20": ["CIS 8"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22649,23 +19768,18 @@ action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splun action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 70 +action.risk.param._risk_message = A rundll32 process $process_name$ with no commandline argument like this process commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "processname"}] action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Rundll32 with no Command Line Arguments with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"]} -======= -action.correlationsearch.label = ESCU - Suspicious Rundll32 no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.011"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "processname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -22701,12 +19815,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 70 +action.risk.param._risk_message = A creation of ryuk test file $file_path$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Ryuk Test Files Detected - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. @@ -22740,29 +19861,20 @@ action.escu.full_search_name = ESCU - Ryuk Wake on LAN Command - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ryuk Ransomware"] -======= -action.escu.analytic_story = ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"] action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = user action.risk.param._risk_object_type = user -action.risk.param._risk_score = 35 -action.risk.param._risk_message = Suspicious scheduled task registered on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A process $process_name$ with wake on LAN commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Ryuk Wake on LAN Command - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1059.003"]} -======= -action.correlationsearch.label = ESCU - Suspicious Scheduled Task from Public Directory - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Exploitation", "Lateral Movement"], "mitre_attack": ["T1059.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22797,29 +19909,20 @@ action.escu.full_search_name = ESCU - SLUI RunAs Elevated - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"] -======= -action.escu.analytic_story = ["Cobalt Strike"] action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A slui process $process_name$ with elevated commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "system", "risk_score": 63}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - SLUI RunAs Elevated - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} -======= -action.correlationsearch.label = ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "Hostname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22854,29 +19957,20 @@ action.escu.full_search_name = ESCU - SLUI Spawning a Process - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DarkSide Ransomware", "Windows Defense Evasion Tactics"] -======= -action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"] action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = user action.risk.param._risk_object_type = user action.risk.param._risk_score = 63 -action.risk.param._risk_message = Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param._risk_message = A slui process $parent_process_name$ spawning child process $process_name$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - SLUI Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} -======= -action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["DarkSide Ransomware", "Windows Defense Evasion Tactics"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -22911,29 +20005,13 @@ action.escu.full_search_name = ESCU - SMB Traffic Spike - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"] -======= -action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution"] -action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 35 -action.risk.param._risk_message = Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - SMB Traffic Spike - Rule action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['src'] @@ -22971,29 +20049,13 @@ action.escu.full_search_name = ESCU - SMB Traffic Spike - MLTK - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"] -======= -action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"] -action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - SMB Traffic Spike - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Ransomware", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1021.002"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Suspicious msbuild path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -23069,29 +20131,20 @@ action.escu.full_search_name = ESCU - Samsam Test File Write - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["SamSam Ransomware"] -======= -action.escu.analytic_story = ["Suspicious MSHTA Activity"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = mshta.exe spawned by wmiprvse.exe on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 12 +action.risk.param._risk_message = A samsam ransomware test file creation in $file_path$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 12}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 12}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Samsam Test File Write - Rule -action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Suspicious mshta spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware"], "cis20": ["CIS 8"], "confidence": 20, "context": ["source:endpoint", {"stage": "Impact"}], "impact": 60, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1486"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23126,29 +20179,20 @@ action.escu.full_search_name = ESCU - Sc exe Manipulating Windows Services - Rul action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"] -======= -action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = user action.risk.param._risk_object_type = user -action.risk.param._risk_score = 28 -action.risk.param._risk_message = Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 28}] +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A sc process $process_name$ with commandline $process$ to create of configure services in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Sc exe Manipulating Windows Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Suspicious wevtutil Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Service Abuse", "DHS Report TA18-074A", "Orangeworm Attack Group", "Windows Persistence Techniques", "Disabling Security Tools", "NOBELIUM Group"], "cis20": ["CIS 3", "CIS 5", "CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Persistence"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Installation"], "mitre_attack": ["T1543.003"], "nist": ["PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23184,12 +20228,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A schedule task process commandline arguments $Arguments$ with http string on it in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "Arguments", "threat_object_type": "arguments"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schedule Task with HTTP Command Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Arguments", "role": ["Attacker"], "type": "Arguments"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry of malware or attack that uses lolbin to download other file or payload to the infected machine. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' @@ -23223,29 +20274,20 @@ action.escu.full_search_name = ESCU - Schedule Task with Rundll32 Command Trigge action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Persistence Techniques", "Trickbot"] -======= -action.escu.analytic_story = ["Collection and Staging"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 28 -action.risk.param._risk_message = Suspicious writes to windows Recycle Bin process $Processes.process_name$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param._risk_score = 70 +action.risk.param._risk_message = A schedule task process commandline rundll32 arguments $Arguments$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Arguments", "threat_object_type": "arguments"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Schedule Task with Rundll32 Command Trigger - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} -======= -action.correlationsearch.label = ESCU - Suspicious writes to windows Recycle Bin - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "mitre_attack": ["T1036"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Trickbot"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Arguments", "role": ["Attacker"], "type": "Arguments"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This technique is common in new trickbot that uses rundll32 to load is trickbot downloader. The search will return the first time and last time the task was registered, as well as the `Command` to be executed, `Task Name`, `Author`, `Enabled`, and whether it is `Hidden` or not. schtasks.exe is natively found in `C:\Windows\system32` and `C:\Windows\syswow64`. The following DLL(s) are loaded when schtasks.exe or TaskService is launched -`taskschd.dll`. If found loaded by another process, it is possible a scheduled task is being registered within that process context in memory. Upon triage, identify the task scheduled source. Was it schtasks.exe or via TaskService? Review the job created and the Command to be executed. Capture any artifacts on disk and review. Identify any parallel processes within the same timeframe to identify source.' @@ -23279,29 +20321,20 @@ action.escu.full_search_name = ESCU - Scheduled Task Deleted Or Created via CMD action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["DHS Report TA18-074A", "NOBELIUM Group"] -======= -action.escu.analytic_story = ["Discovery Techniques"] action.risk = 1 -action.risk.param._risk_object = User +action.risk.param._risk_object = user action.risk.param._risk_object_type = user -action.risk.param._risk_score = 15 -action.risk.param._risk_message = Potential system information discovery behavior on $dest$ by $User$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "User", "threat_object_type": "user"}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "User", "threat_object_type": "user"}] +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A schedule task process $process_name$ with create or delete commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Scheduled Task Deleted Or Created via CMD - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} -======= -action.correlationsearch.label = ESCU - System Information Discovery Detection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "cis20": ["CIS 6", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Recon", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Attacker"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23336,29 +20369,13 @@ action.escu.full_search_name = ESCU - Scheduled tasks used in BadRabbit ransomwa action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Ransomware"] -======= -action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = System process running from unexpected location on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Scheduled tasks used in BadRabbit ransomware - Rule action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} -======= -action.correlationsearch.label = ESCU - System Processes Run From Unexpected Locations - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -23394,12 +20411,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 48 +action.risk.param._risk_message = A "on demand" execution of schedule task process $process_name$ using commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 48}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Schtasks Run Task On Demand - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1053"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23434,29 +20458,20 @@ action.escu.full_search_name = ESCU - Schtasks scheduling job on remote system - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Lateral Movement", "NOBELIUM Group"] -======= -action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = Possible Trickbot namedpipe created on $Computer$ by $Image$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "Image", "threat_object_type": "process"}] +action.risk.param._risk_object = Processes.user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A schedule task process $process_name$ with remote job commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 63}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Schtasks scheduling job on remote system - Rule -action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement", "NOBELIUM Group"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} -======= -action.correlationsearch.label = ESCU - Trickbot Named Pipe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "Image", "role": ["Attacker"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Lateral Movement", "NOBELIUM Group"], "cis20": ["CIS 3"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23491,29 +20506,20 @@ action.escu.full_search_name = ESCU - Schtasks used for forcing a reboot - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware"] -======= -action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 45 -action.risk.param._risk_message = Possible USN journal deletion on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A schedule task process $process_name$ with force reboot commandline $process$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Schtasks used for forcing a reboot - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware"], "cis20": ["CIS 3"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"]} -======= -action.correlationsearch.label = ESCU - USN Journal Deletion - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 6", "CIS 8", "CIS 10"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware"], "cis20": ["CIS 3"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}, "Persistence", "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1053.005"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23549,12 +20555,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious WMI Use"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 36 +action.risk.param._risk_message = A wmic.exe process $process_name$ taht execute script in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 36}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 36}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Script Execution via WMI - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 60, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1047"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23589,29 +20602,20 @@ action.escu.full_search_name = ESCU - SearchProtocolHost with no Command Line wi action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cobalt Strike"] -======= -action.escu.analytic_story = ["HAFNIUM Group"] action.risk = 1 action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = Possible CVE-2021-26857 exploitation on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param._risk_score = 70 +action.risk.param._risk_message = A searchprotocolhost.exe process $process_name$ with no commandline in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "processname"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - SearchProtocolHost with no Command Line with Network - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} -======= -action.correlationsearch.label = ESCU - Unified Messaging Service Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 100, "context": ["source:endpoint", {"stage": "Defense Evasion"}, "Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "process_name", "role": ["Attacker"], "type": "processname"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -23646,29 +20650,20 @@ action.escu.full_search_name = ESCU - SecretDumps Offline NTDS Dumping Tool - Ru action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Credential Dumping"] -======= -action.escu.analytic_story = ["Disabling Security Tools"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 45 -action.risk.param._risk_message = Possible Sysmon filter driver unloading on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 80 +action.risk.param._risk_message = A secretdump process $process_name$ with secretdump commandline $process$ to dump credentials in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 80}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - SecretDumps Offline NTDS Dumping Tool - Rule -action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003"]} -======= -action.correlationsearch.label = ESCU - Unload Sysmon Filter Driver - Rule -action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["source:endpoint", {"stage": "Credential Access"}], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23703,29 +20698,20 @@ action.escu.full_search_name = ESCU - Services Escalate Exe - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cobalt Strike"] -======= -action.escu.analytic_story = ["Malicious PowerShell"] action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 49 -action.risk.param._risk_message = Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param._risk_object = Processes.user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 76 +action.risk.param._risk_message = A service process $parent_process_name$ with process path $process_path$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "Processes.dest", "risk_object_type": "system", "risk_score": 76}, {"risk_object_field": "Processes.user", "risk_object_type": "user", "risk_score": 76}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Services Escalate Exe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548"]} -======= -action.correlationsearch.label = ESCU - Unloading AMSI via Reflection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 95, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1548"], "observable": [{"name": "Processes.dest", "role": ["Victim"], "type": "Hostname"}, {"name": "Processes.user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23761,12 +20747,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 48 +action.risk.param._risk_message = A registry modification in $registry_path$ with reg key $registry_key_name$ and reg value $registry_value_name$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 48}, {"threat_object_field": "registry_path", "threat_object_type": "registrypath"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell", "Credential Dumping", "HAFNIUM Group"], "cis20": ["CIS 3", "CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 60, "kill_chain_phases": ["Installation", "Actions on Objectives"], "mitre_attack": ["T1059.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "registry_path", "role": ["Others"], "type": "RegistryPath"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -23802,12 +20795,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = A process that possibly write shim database in $file_path$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"threat_object_field": "file_path", "threat_object_type": "file path"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Shim Database File Creation - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 80, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "file_path", "role": ["Others"], "type": "file path"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -23842,29 +20842,20 @@ action.escu.full_search_name = ESCU - Shim Database Installation With Suspicious action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Persistence Techniques"] -======= -action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 42 -action.risk.param._risk_message = Unusually long command line $Processes.process_name$ on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A process $process_name$ that possible create a shim db silently in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Shim Database Installation With Suspicious Parameters - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Unusually Long Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques"], "cis20": ["CIS 8"], "confidence": 90, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.011"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23900,12 +20891,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Account Monitoring and Controls"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A user account created or delete shortly in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Short Lived Windows Accounts - Rule -action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "mitre_attack": ["T1136.001"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Account Monitoring and Controls"], "cis20": ["CIS 16"], "confidence": 90, "context": ["source:endpoint", {"stage": "Persistence"}], "impact": 70, "mitre_attack": ["T1136.001"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -23941,12 +20939,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = A suspicious process $process_name$ with single letter in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Single Letter Process On Endpoint - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 2"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"]} +action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A"], "cis20": ["CIS 2"], "confidence": 90, "context": ["source:endpoint", {"stage": "Execution"}], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1204.002"], "nist": ["ID.AM", "PR.DS"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search looks for process names that consist only of a single letter. @@ -23980,29 +20985,13 @@ action.escu.full_search_name = ESCU - Spectre and Meltdown Vulnerable Systems - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Spectre And Meltdown Vulnerabilities"] -======= -action.escu.analytic_story = ["HAFNIUM Group"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = Possible Web Shell execution on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Spectre and Meltdown Vulnerable Systems - Rule action.correlationsearch.annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"], "cis20": ["CIS 4"], "nist": ["ID.RA", "RS.MI", "PR.IP", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - W3WP Spawning Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24037,29 +21026,13 @@ action.escu.full_search_name = ESCU - Spike in File Writes - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware"] -======= -action.escu.analytic_story = ["Ryuk Ransomware", "Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 15 -action.risk.param._risk_message = System backups deletion on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Spike in File Writes - Rule action.correlationsearch.annotations = {"analytic_story": ["SamSam Ransomware", "Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - WBAdmin Delete System Backups - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24135,7 +21108,6 @@ action.escu.full_search_name = ESCU - Spoolsv Spawning Rundll32 - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 action.risk.param._risk_object = dest @@ -24143,27 +21115,13 @@ action.risk.param._risk_object_type = system action.risk.param._risk_score = 72 action.risk.param._risk_message = $parent_process$ has spawned $process_name$ on endpoint $ComputerName$. This behavior is suspicious and related to PrintNightmare. action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "parent_process_id", "threat_object_type": "process"}, {"threat_object_field": "process_id", "threat_object_type": "process"}] -======= -action.escu.analytic_story = ["Suspicious WMI Use"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 -action.risk.param._risk_message = User $user$ on $host$ executed the following suspicious WMI query: $Query$. Filter: $filter$. Consumer: $Consumer$. EventCode: $EventCode$ -action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Spoolsv Spawning Rundll32 - Rule action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "parent_process_id", "role": ["Parent Process", "Attacker"], "type": "Process"}, {"name": "process_id", "role": ["Child Process"], "type": "Process"}]} -======= -action.correlationsearch.label = ESCU - WMI Permanent Event Subscription - Sysmon - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "host", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -24198,7 +21156,6 @@ action.escu.full_search_name = ESCU - Spoolsv Suspicious Loaded Modules - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 action.risk.param._risk_object = Computer @@ -24206,27 +21163,13 @@ action.risk.param._risk_object_type = system action.risk.param._risk_score = 72 action.risk.param._risk_message = $Image$ with process id $process_id$ has loaded a driver from $ImageLoaded$ on endpoint $Computer$. This behavior is suspicious and related to PrintNightmare. action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process name"}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file"}] -======= -action.escu.analytic_story = ["Malicious PowerShell"] -action.risk = 1 -action.risk.param._risk_object = User -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 30 -action.risk.param._risk_message = Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 30}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Spoolsv Suspicious Loaded Modules - Rule action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Local"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Parent Process", "Attacker"], "type": "Process Name"}, {"name": "ImageLoaded", "role": ["Other"], "type": "File"}]} -======= -action.correlationsearch.label = ESCU - WMI Recon Running Process Or Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.rule_description = This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. @@ -24307,7 +21250,6 @@ action.escu.full_search_name = ESCU - Spoolsv Writing a DLL - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["PrintNightmare CVE-2021-34527"] action.risk = 1 action.risk.param._risk_object = dest @@ -24315,27 +21257,13 @@ action.risk.param._risk_object_type = system action.risk.param._risk_score = 72 action.risk.param._risk_message = $process_name$ has been identified writing dll's to $file_path$ on endpoint $dest$. This behavior is suspicious and related to PrintNightmare. action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 72}, {"threat_object_field": "process_id", "threat_object_type": "process"}, {"threat_object_field": "file_path", "threat_object_type": "file"}] -======= -action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] -action.risk = 1 -action.risk.param._risk_object = Computer -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 35 -action.risk.param._risk_message = Suspicious COM Object Execution on $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 35}] ->>>>>>> develop action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Spoolsv Writing a DLL - Rule action.correlationsearch.annotations = {"analytic_story": ["PrintNightmare CVE-2021-34527"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.012"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "process_id", "role": ["Process"], "type": "Process"}, {"name": "file_path", "role": ["Other"], "type": "File"}]} -======= -action.correlationsearch.label = ESCU - Wbemprox COM Object Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24418,12 +21346,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware"] +action.risk = 1 +action.risk.param._risk_object = +action.risk.param._risk_object_type = +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Safeboot registry $Registry.registry_path$ was added or modified with a new value $Registry.registry_value_name$ +action.risk.param._risk = [] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Start Up During Safe Mode Boot - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Persistence"], "impact": 60, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1547.001"]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24540,29 +21475,13 @@ action.escu.full_search_name = ESCU - Suspicious Changes to File Associations - action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Windows Registry Activities", "Windows File Extension and Association Abuse"] -======= -action.escu.analytic_story = ["Trickbot"] -action.risk = 1 -action.risk.param._risk_object = ComputerName -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = Wermgr.exe process connecting IP location web services on $ComputerName$ -action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Suspicious Changes to File Associations - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Windows Registry Activities", "Windows File Extension and Association Abuse"], "cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001"], "nist": ["DE.CM", "PR.PT", "PR.IP"]} -======= -action.correlationsearch.label = ESCU - Wermgr Process Connecting To IP Check Web Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24597,29 +21516,13 @@ action.escu.full_search_name = ESCU - Suspicious Curl Network Connection - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Silver Sparrow", "Ingress Tool Transfer"] -======= -action.escu.analytic_story = ["Trickbot"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = Wermgr.exe writing executable files on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Suspicious Curl Network Connection - Rule action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow", "Ingress Tool Transfer"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1105"]} -======= -action.correlationsearch.label = ESCU - Wermgr Process Create Executable File - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -24654,29 +21557,20 @@ action.escu.full_search_name = ESCU - Suspicious DLLHost no Command Line Argumen action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cobalt Strike"] -======= -action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 56 -action.risk.param._risk_message = Wermgr.exe spawning suspicious processes on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Suspicious dllhost.exe process with no command line arguments executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Suspicious DLLHost no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} -======= -action.correlationsearch.label = ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24711,29 +21605,20 @@ action.escu.full_search_name = ESCU - Suspicious Driver Loaded Path - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["XMRig"] -======= -action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest +action.risk.param._risk_object = Computer action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 -action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "command"}] +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious driver $ImageLoaded$ on $Computer$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}, {"threat_object_field": "ImageLoaded", "threat_object_type": "file name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Suspicious Driver Loaded Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"]} -======= -action.correlationsearch.label = ESCU - WinEvent Scheduled Task Created Within Public Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Command"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly exist. During triage, validate this driver is for legitimate business use. Review the metadata and certificate information. Unsigned drivers from non-standard paths is not normal, but occurs. In addition, review driver loads into `ntoskrnl.exe` for possible other drivers of interest. Long tail analyze drivers by path (outside of default, and in default) for further review. @@ -24749,7 +21634,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter` +search = `sysmon` EventCode=6 ImageLoaded = "*.sys" NOT (ImageLoaded IN("*\\WINDOWS\\inf","*\\WINDOWS\\System32\\drivers\\*", "*\\WINDOWS\\System32\\DriverStore\\FileRepository\\*")) | stats min(_time) as firstTime max(_time) as lastTime count by Computer ImageLoaded Hashes IMPHASH Signature Signed | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `suspicious_driver_loaded_path_filter` [ESCU - Suspicious Email - UBA Anomaly - Rule] action.escu = 0 @@ -24767,29 +21652,13 @@ action.escu.full_search_name = ESCU - Suspicious Email - UBA Anomaly - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Emails"] -======= -action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 -action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "command"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Suspicious Email - UBA Anomaly - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious Emails"], "cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566"], "nist": ["PR.IP"]} -======= -action.correlationsearch.label = ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Command"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -24867,12 +21736,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 9 +action.risk.param._risk_message = The Windows Event Log Service shutdown on $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 9}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Event Log Service Behavior - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 30, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24907,29 +21783,13 @@ action.escu.full_search_name = ESCU - Suspicious File Write - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Hidden Cobra Malware"] -======= -action.escu.analytic_story = ["Ryuk Ransomware", "Windows Defense Evasion Tactics"] -action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 24 -action.risk.param._risk_message = Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Deprecated - Suspicious File Write - Rule action.correlationsearch.annotations = {"analytic_story": ["Hidden Cobra Malware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} -======= -action.correlationsearch.label = ESCU - Windows DisableAntiSpyware Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -24964,29 +21824,20 @@ action.escu.full_search_name = ESCU - Suspicious GPUpdate no Command Line Argume action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Cobalt Strike"] -======= -action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] action.risk = 1 -action.risk.param._risk_object = dest -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 70 -action.risk.param._risk_message = Windows event logs cleared on $dest$ via EventCode $EventCode$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}] +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Suspicious gpupdate.exe process with no command line arguments executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Suspicious GPUpdate no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} -======= -action.correlationsearch.label = ESCU - Windows Event Log Cleared - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -25021,29 +21872,13 @@ action.escu.full_search_name = ESCU - Suspicious Java Classes - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Apache Struts Vulnerability"] -======= -action.escu.analytic_story = ["Ryuk Ransomware"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 -action.risk.param._risk_message = The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$ -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Suspicious Java Classes - Rule action.correlationsearch.annotations = {"analytic_story": ["Apache Struts Vulnerability"], "cis20": ["CIS 7", "CIS 12"], "kill_chain_phases": ["Exploitation"], "nist": ["DE.AE"]} -======= -action.correlationsearch.label = ESCU - Windows Security Account Manager Stopped - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1489"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Target"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest', 'src'] @@ -25079,12 +21914,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious renamed msbuild.exe binary ran on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious MSBuild Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -25120,12 +21962,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Suspicious msbuild.exe process executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious MSBuild Spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25174,29 +22023,13 @@ action.escu.full_search_name = ESCU - Suspicious PlistBuddy Usage - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Silver Sparrow"] -======= -action.escu.analytic_story = ["Spearphishing Attachments"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 -action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks. -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Suspicious PlistBuddy Usage - Rule action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001"]} -======= -action.correlationsearch.label = ESCU - Winword Spawning Cmd - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} ->>>>>>> develop schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25225,7 +22058,6 @@ search = | tstats `security_content_summariesonly` count min(_time) as firstTime [ESCU - Suspicious PlistBuddy Usage via OSquery - Rule] action.escu = 0 action.escu.enabled = 1 -<<<<<<< HEAD description = The following analytic identifies the use of a native MacOS utility, PlistBuddy, creating or modifying a properly list (.plist) file. In the instance of Silver Sparrow, the following commands were executed:\ - PlistBuddy -c "Add :Label string init_verx" ~/Library/Launchagents/init_verx.plist \ - PlistBuddy -c "Add :RunAtLoad bool true" ~/Library/Launchagents/init_verx.plist \ @@ -25254,34 +22086,10 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Silver Sparrow"] -======= -description = The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. -action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. -action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. -action.escu.known_false_positives = False positives should be limited, but if any are present, filter as needed. -action.escu.creation_date = 2021-04-12 -action.escu.modification_date = 2021-04-12 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Winword Spawning PowerShell - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Spearphishing Attachments"] -action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 -action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}] -action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Suspicious PlistBuddy Usage via OSquery - Rule action.correlationsearch.annotations = {"analytic_story": ["Silver Sparrow"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1543.001"]} schedule_window = auto @@ -25295,15 +22103,6 @@ action.notable.param.rule_description = The following analytic identifies the us - PlistBuddy -c "Add :ProgramArguments:1 string -c" ~/Library/Launchagents/init_verx.plist \ Upon triage, capture the property list file being written to disk and review for further indicators. Contain the endpoint and triage further. action.notable.param.rule_title = Suspicious PlistBuddy Usage via OSquery -======= -action.correlationsearch.label = ESCU - Winword Spawning PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} -schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` (version will vary). PowerShell spawning from winword.exe is common for a spearphishing attachment and is actively used. Albeit, the command executed will most likely be encoded and captured via another detection. During triage, review parallel processes and identify any files that may have been written. -action.notable.param.rule_title = Winword Spawning PowerShell ->>>>>>> develop action.notable.param.security_domain = endpoint action.notable.param.severity = high alert.digest_mode = 1 @@ -25333,29 +22132,20 @@ action.escu.full_search_name = ESCU - Suspicious Process File Path - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["XMRig"] -======= -action.escu.analytic_story = ["Spearphishing Attachment"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 -action.risk.param._risk_message = User $user$ on $dest$ spawned Windows Script Host from Winword.exe -action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicioues process $Processes.process_path.file_path$ running from suspicious location +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Suspicious Process File Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"]} -======= -action.correlationsearch.label = ESCU - Winword Spawning Windows Script Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachment"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25390,29 +22180,20 @@ action.escu.full_search_name = ESCU - Suspicious Reg exe Process - Rule action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"] -======= -action.escu.analytic_story = ["Trickbot"] action.risk = 1 -action.risk.param._risk_object = user -action.risk.param._risk_object_type = user -action.risk.param._risk_score = 70 -action.risk.param._risk_message = $user$ dropped or created an executable file in known sensitive SMB share. Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$ -action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}] +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process running with an uncommon parent process $Processes.parent_process_name$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Suspicious Reg exe Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - Write Executable in SMB Share - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics", "Disabling Security Tools", "DHS Report TA18-074A"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1112"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25447,29 +22228,20 @@ action.escu.full_search_name = ESCU - Suspicious Regsvr32 Register Suspicious Pa action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] -<<<<<<< HEAD action.escu.analytic_story = ["Suspicious Regsvr32 Activity"] -======= -action.escu.analytic_story = ["XMRig"] action.risk = 1 -action.risk.param._risk_object = Computer +action.risk.param._risk_object = dest action.risk.param._risk_object_type = system -action.risk.param._risk_score = 80 -action.risk.param._risk_message = A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ -action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "ImageLoaded", "threat_object_type": "imageloaded"}] +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicious $Processes.process_path.file_path$ process potentially loading malicious code +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] action.risk.param.verbose = 0 ->>>>>>> develop cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 -<<<<<<< HEAD action.correlationsearch.label = ESCU - Suspicious Regsvr32 Register Suspicious Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity"], "cis20": ["CIS 8", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"]} -======= -action.correlationsearch.label = ESCU - XMRIG Driver Loaded - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "ImageLoaded"}]} ->>>>>>> develop +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Regsvr32 Activity"], "cis20": ["CIS 8", "CIS 16"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.010"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25505,12 +22277,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious renamed rundll32.exe binary ran on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 Rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -25546,12 +22325,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 35 +action.risk.param._risk_message = rundll32.exe running with suspicious parameters on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 StartW - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "Trickbot"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25587,12 +22373,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = $Processes.process_path.file_path$ process potentially loading malicious code +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"threat_object_field": "Processes.process_path.file_path", "threat_object_type": "file name"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 dllregisterserver - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_path.file_path", "role": ["Attacker"], "type": "File Name"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25628,12 +22421,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Suspicious rundll32.exe process with no command line arguments executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Rundll32 no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Rundll32 Activity", "Cobalt Strike", "PrintNightmare CVE-2021-34527"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.011"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -25710,12 +22510,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicious scheduled task registered on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious Scheduled Task from Public Directory - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"], "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Ryuk Ransomware", "Windows Persistence Techniques"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation", "Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25751,12 +22558,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Cobalt Strike"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Suspicious searchprotocolhost.exe process with no command line arguments executed on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious SearchProtocolHost no Command Line Arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.correlationsearch.annotations = {"analytic_story": ["Cobalt Strike"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Initial Access", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -25792,12 +22606,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious renamed microsoft.workflow.compiler.exe binary ran on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 63}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler rename - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -25833,12 +22654,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicious microsoft.workflow.compiler.exe process ran on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 35}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious microsoft workflow compiler usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25874,12 +22702,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Msbuild.exe ran from an uncommon path on $dest$ execyted by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious msbuild path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Trusted Developer Utilities Proxy Execution MSBuild", "Cobalt Strike", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1127.001", "T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -25963,12 +22798,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious MSHTA Activity"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = mshta.exe spawned by wmiprvse.exe on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious mshta spawn - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious MSHTA Activity"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26004,12 +22846,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 28 +action.risk.param._risk_message = Wevtutil.exe being used to clear Event Logs on $dest$ by $user$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 28}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious wevtutil Usage - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.PT", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -26085,12 +22934,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Collection and Staging"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 28 +action.risk.param._risk_message = Suspicious writes to windows Recycle Bin process $Processes.process_name$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 28}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Suspicious writes to windows Recycle Bin - Rule -action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "mitre_attack": ["T1036"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Collection and Staging"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 40, "mitre_attack": ["T1036"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26126,12 +22982,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Discovery Techniques"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 15 +action.risk.param._risk_message = Potential system information discovery behavior on $dest$ by $User$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "User", "threat_object_type": "user"}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 15, "threat_object_field": "User", "threat_object_type": "user"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - System Information Discovery Detection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Discovery Techniques"], "cis20": ["CIS 6", "CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Recon", "Stage:Discovery"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1082"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Attacker"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26171,12 +23034,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = System process running from unexpected location on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 49}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - System Processes Run From Unexpected Locations - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Ransomware", "Masquerading - Rename System Utilities"], "cis20": ["CIS 8"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26294,12 +23164,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Possible Trickbot namedpipe created on $Computer$ by $Image$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "Image", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Trickbot Named Pipe - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}, {"name": "Image", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. @@ -26334,12 +23211,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 45 +action.risk.param._risk_message = Possible USN journal deletion on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - USN Journal Deletion - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 6", "CIS 8", "CIS 10"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware"], "cis20": ["CIS 6", "CIS 8", "CIS 10"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070"], "nist": ["DE.CM", "PR.PT", "DE.AE", "DE.DP", "PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26416,12 +23300,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Possible CVE-2021-26857 exploitation on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unified Messaging Service Spawning a Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26457,12 +23348,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Disabling Security Tools"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 45 +action.risk.param._risk_message = Possible Sysmon filter driver unloading on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 45}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unload Sysmon Filter Driver - Rule -action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Disabling Security Tools"], "cis20": ["CIS 8"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 50, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.001"], "nist": ["DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26502,12 +23400,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 49 +action.risk.param._risk_message = Possible AMSI Unloading via Reflection using PowerShell on $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 49}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unloading AMSI via Reflection - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 70, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ @@ -26625,12 +23530,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 42 +action.risk.param._risk_message = Unusually long command line $Processes.process_name$ on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 42}, {"threat_object_field": "Processes.process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Unusually Long Command Line - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Command-Line Executions", "Unusual Processes", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware"], "cis20": ["CIS 8"], "confidence": 60, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Processes.process_name", "role": ["Attacker"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26788,12 +23700,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["HAFNIUM Group"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Possible Web Shell execution on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - W3WP Spawning Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"]} +action.correlationsearch.annotations = {"analytic_story": ["HAFNIUM Group"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1505.003"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26829,12 +23748,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware", "Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 15 +action.risk.param._risk_message = System backups deletion on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 15}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WBAdmin Delete System Backups - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Ransomware"], "cis20": ["CIS 8"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1490"], "nist": ["PR.IP"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -26921,12 +23847,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious WMI Use"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 30 +action.risk.param._risk_message = User $user$ on $host$ executed the following suspicious WMI query: $Query$. Filter: $filter$. Consumer: $Consumer$. EventCode: $EventCode$ +action.risk.param._risk = [{"risk_object_field": "host", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 30}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WMI Permanent Event Subscription - Sysmon - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"]} +action.correlationsearch.annotations = {"analytic_story": ["Suspicious WMI Use"], "cis20": ["CIS 3", "CIS 5"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Privilege Escalation", "Stage:Persistence"], "impact": 30, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.003"], "nist": ["PR.PT", "PR.AT", "PR.AC", "PR.IP"], "observable": [{"name": "host", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -26967,12 +23900,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Malicious PowerShell"] +action.risk = 1 +action.risk.param._risk_object = User +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 30 +action.risk.param._risk_message = Suspicious powerShell script execution by $user$ on $ComputerName$ via EventCode 4104, where WMI is performing an event query looking for running processes or running services +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 30}, {"risk_object_field": "User", "risk_object_type": "user", "risk_score": 30}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WMI Recon Running Process Or Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"]} +action.correlationsearch.annotations = {"analytic_story": ["Malicious PowerShell"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Recon"], "impact": 30, "kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1592"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}, {"name": "User", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following analytic identifies suspicious PowerShell script execution via EventCode 4104, where WMI is performing an event query looking for running processes or running services. This technique is commonly found in malware and APT events where the adversary will map all running security applications or services on the compromised machine. During triage, review parallel processes within the same timeframe. Review the full script block to identify other related artifacts. @@ -27047,12 +23987,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ransomware", "Revil Ransomware"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 35 +action.risk.param._risk_message = Suspicious COM Object Execution on $Computer$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 35}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wbemprox COM Object Execution - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"]} +action.correlationsearch.annotations = {"analytic_story": ["Ransomware", "Revil Ransomware"], "confidence": 50, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is designed to detect potential malicious process loading COM object to wbemprox.dll, @@ -27250,12 +24197,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Wermgr.exe process connecting IP location web services on $ComputerName$ +action.risk.param._risk = [{"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wermgr Process Connecting To IP Check Web Services - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Initial Access", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1590.005"], "observable": [{"name": "ComputerName", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address without so much finger print on the commandline process. Since wermgr.exe is designed for error handling process of windows it is really suspicious that this process is trying to connect to this IP web services cause that maybe cause of some malicious code injection. @@ -27290,12 +24244,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Wermgr.exe writing executable files on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wermgr Process Create Executable File - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1027"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -27331,12 +24292,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 56 +action.risk.param._risk_message = Wermgr.exe spawning suspicious processes on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Execution"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1059"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -27380,12 +24348,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 70 +action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "command"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WinEvent Scheduled Task Created Within Public Path - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Command"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed from a user writeable file path.\ @@ -27432,12 +24407,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 70 +action.risk.param._risk_message = A windows scheduled task was created (task name=$Task_Name$) on $dest$ by the following command: $Command$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"threat_object_field": "Command", "threat_object_type": "command"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Persistence Techniques", "Ransomware", "Ryuk Ransomware"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Execution", "Stage:Persistence", "Stage:Privilege Escalation"], "impact": 70, "kill_chain_phases": ["Privilege Escalation"], "mitre_attack": ["T1053.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "Command", "role": ["Target"], "type": "Command"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a native Windows shell (PowerShell, Cmd, Wscript, Cscript).\ @@ -27558,12 +24540,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware", "Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 24 +action.risk.param._risk_message = Windows DisableAntiSpyware registry key set to 'disabled' on $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 24}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows DisableAntiSpyware Registry - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware", "Windows Defense Evasion Tactics"], "cis20": ["CIS 8"], "confidence": 80, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 30, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1562.001"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -27599,12 +24588,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 70 +action.risk.param._risk_message = Windows event logs cleared on $dest$ via EventCode $EventCode$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows Event Log Cleared - Rule -action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"]} +action.correlationsearch.annotations = {"analytic_story": ["Windows Log Manipulation", "Ransomware", "Clop Ransomware"], "cis20": ["CIS 3", "CIS 5", "CIS 6"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070.001"], "nist": ["DE.DP", "PR.IP", "PR.AC", "PR.AT", "DE.AE"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['dest'] @@ -27640,12 +24636,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Ryuk Ransomware"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 70 +action.risk.param._risk_message = The Windows Security Account Manager (SAM) was stopped via cli by $user$ on $dest$ by this command: $processs$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows Security Account Manager Stopped - Rule -action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1489"], "nist": ["PR.PT", "DE.CM"]} +action.correlationsearch.annotations = {"analytic_story": ["Ryuk Ransomware"], "cis20": ["CIS 8"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 70, "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1489"], "nist": ["PR.PT", "DE.CM"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. @@ -27842,12 +24845,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 70 +action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched command: $process_name$ which is very common in spearphishing attacks. +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Winword Spawning Cmd - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -27883,12 +24893,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachments"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 70 +action.risk.param._risk_message = $parent_process_name$ on $dest$ by $user$ launched the following powershell process: $process_name$ which is very common in spearphishing attacks +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Winword Spawning PowerShell - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachments"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -27924,12 +24941,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spearphishing Attachment"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 70 +action.risk.param._risk_message = User $user$ on $dest$ spawned Windows Script Host from Winword.exe +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 70}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}, {"threat_object_field": "process_name", "threat_object_type": "process"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Winword Spawning Windows Script Host - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachment"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"]} +action.correlationsearch.annotations = {"analytic_story": ["Spearphishing Attachment"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Initial Access"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.001"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Endpoint"}, {"name": "user", "role": ["Victim"], "type": "User"}, {"name": "process_name", "role": ["Target"], "type": "Process"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user', 'dest'] @@ -27965,12 +24989,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 70 +action.risk.param._risk_message = $user$ dropped or created an executable file in known sensitive SMB share. Share name=$Share_Name$, Target name=$Relative_Target_Name$, and Access mask=$Access_Mask$ +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 70}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Write Executable in SMB Share - Rule -action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021.002"]} +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Lateral Movement"], "impact": 70, "kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1021.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}]} schedule_window = auto action.notable = 1 action.notable.param.nes_fields = ['user'] @@ -28006,12 +25037,19 @@ action.escu.search_type = detection action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["XMRig"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = A driver $ImageLoaded$ related to xmrig crytominer loaded in host $Computer$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 80}, {"threat_object_field": "ImageLoaded", "threat_object_type": "imageloaded"}] +action.risk.param.verbose = 0 cron_schedule = 0 * * * * dispatch.earliest_time = -70m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - XMRIG Driver Loaded - Rule -action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"]} +action.correlationsearch.annotations = {"analytic_story": ["XMRig"], "confidence": 100, "context": ["source:endpoint", {"stage": "Privilege Escalation"}, "Persistence"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1543.003"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}, {"name": "ImageLoaded", "role": ["Attacker"], "type": "ImageLoaded"}]} schedule_window = auto action.notable = 1 action.notable.param.rule_description = This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin. diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 8f520807e7..f39333a340 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T14:08:27 UTC +# On Date: 2021-07-21T07:45:06 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index bc2010bff0..cd501b9f27 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-20T14:08:27 UTC +# On Date: 2021-07-21T07:45:07 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -7443,6 +7443,3 @@ earliest_time_offset = 14400 latest_time_offset = 0 ### END RESPONSE TASKS ### - -### BASELINES ### -### END ESCU BASELINES ### \ No newline at end of file From 80be6029dec41aaeea2cb2636c564d4162c7d539 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 21 Jul 2021 12:26:15 +0200 Subject: [PATCH 11/21] updated stories --- bin/validate.py | 5 +++-- stories/active_directory_password_spraying.yml | 1 - stories/apache_struts_vulnerability.yml | 1 - stories/asset_tracking.yml | 1 - stories/aws_cross_account_activity.yml | 1 - stories/aws_iam_privilege_escalation.yml | 1 - stories/aws_network_acl_activity.yml | 1 - stories/aws_security_hub_alerts.yml | 1 - stories/aws_user_monitoring.yml | 1 - stories/baron_samedit_cve_2021_3156.yml | 1 - stories/bits_jobs.yml | 1 - stories/brand_monitoring.yml | 1 - stories/cloud_cryptomining.yml | 1 - stories/cloud_federated_credential_abuse.yml | 1 - stories/cobalt_strike.yml | 1 - stories/coldroot_macos_rat.yml | 1 - stories/collection_and_staging.yml | 1 - stories/command_and_control.yml | 1 - .../container_implantation_monitoring_and_investigation.yml | 1 - stories/credential_dumping.yml | 1 - stories/data_exfiltration.yml | 1 - stories/data_protection.yml | 1 - stories/deobfuscate_decode_files_or_information.yml | 1 - stories/detect_zerologon_attack.yml | 1 - stories/dhs_report_ta18_074a.yml | 1 - stories/disabling_security_tools.yml | 1 - stories/dns_amplification_attacks.yml | 1 - stories/dns_hijacking.yml | 1 - stories/domain_trust_discovery.yml | 1 - stories/dynamic_dns.yml | 1 - stories/emotet_malware__dhs_report_ta18_201a_.yml | 1 - stories/f5_tmui_rce_cve_2020_5902.yml | 1 - stories/gcp_cross_account_activity.yml | 1 - stories/hafnium_group.yml | 1 - stories/hidden_cobra_malware.yml | 1 - stories/ingress_tool_transfer.yml | 1 - stories/jboss_vulnerability.yml | 1 - stories/kubernetes_scanning_activity.yml | 1 - stories/kubernetes_sensitive_object_access_activity.yml | 1 - stories/lateral_movement.yml | 1 - stories/malicious_powershell.yml | 1 - stories/masquerading___rename_system_utilities.yml | 1 - stories/meterpreter.yml | 1 - stories/monitor_for_updates.yml | 1 - stories/netsh_abuse.yml | 1 - stories/nobelium_group.yml | 1 - stories/office_365_detections.yml | 1 - stories/orangeworm_attack_group.yml | 1 - ..._activity_associated_with_mudcarp_espionage_campaigns.yml | 1 - stories/printnightmare_cve_2021_34527.yml | 1 - stories/prohibited_traffic_allowed_or_protocol_mismatch.yml | 1 - stories/ransomware.yml | 1 - stories/ransomware_clop.yml | 1 - stories/ransomware_cloud.yml | 1 - stories/ransomware_darkside.yml | 1 - stories/ransomware_revil.yml | 1 - stories/ransomware_ryuk.yml | 1 - stories/ransomware_samsam.yml | 1 - stories/router_and_infrastructure_security.yml | 1 - stories/silver_sparrow.yml | 1 - stories/spearphishing_attachments.yml | 1 - stories/sql_injection.yml | 1 - stories/suspicious_aws_login_activities.yml | 1 - stories/suspicious_aws_s3_activities.yml | 1 - stories/suspicious_aws_traffic.yml | 1 - stories/suspicious_cloud_authentication_activities.yml | 1 - stories/suspicious_cloud_instance_activities.yml | 1 - stories/suspicious_cloud_provisioning_activities.yml | 1 - stories/suspicious_cloud_user_activities.yml | 1 - stories/suspicious_command_line_executions.yml | 1 - stories/suspicious_compiled_html_activity.yml | 1 - stories/suspicious_dns_traffic.yml | 1 - stories/suspicious_emails.yml | 1 - stories/suspicious_gcp_storage_activities.yml | 1 - stories/suspicious_mshta_activity.yml | 1 - stories/suspicious_okta_activity.yml | 1 - stories/suspicious_regsvcs_regasm_activity.yml | 1 - stories/suspicious_regsvr32_activity.yml | 1 - stories/suspicious_rundll32_activity.yml | 1 - stories/suspicious_windows_registry_activities.yml | 1 - stories/suspicious_wmi_use.yml | 1 - stories/suspicious_zoom_child_processes.yml | 1 - stories/trickbot.yml | 1 - stories/trusted_developer_utilities_proxy_execution.yml | 1 - .../trusted_developer_utilities_proxy_execution_msbuild.yml | 1 - stories/unusual_processes.yml | 1 - stories/use_of_cleartext_protocols.yml | 1 - stories/windows_defense_evasion_tactics.yml | 1 - stories/windows_discovery_techniques.yml | 1 - stories/windows_dns_sigred_cve_2020_1350.yml | 1 - stories/windows_file_extension_and_association_abuse.yml | 1 - stories/windows_log_manipulation.yml | 1 - stories/windows_persistence_techniques.yml | 1 - stories/windows_privilege_escalation.yml | 1 - stories/windows_service_abuse.yml | 1 - stories/xmrig.yml | 1 - 96 files changed, 3 insertions(+), 97 deletions(-) diff --git a/bin/validate.py b/bin/validate.py index 13a7a34f7a..e68a772f34 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -122,8 +122,9 @@ def validate_standard_fields(object, uuids): else: uuids.append(object['id']) - if (object['type']) == 'batch' and len(object['name']) > 75: - errors.append('ERROR: Search name is longer than 75 characters: %s' % (object['name'])) + if 'products' in object['tags']: + if (not 'Splunk Behavioral Analytics' in object['tags']['products']) and len(object['name']) > 75: + errors.append('ERROR: Search name is longer than 75 characters: %s' % (object['name'])) # if object['name'].endswith(" "): # errors.append( diff --git a/stories/active_directory_password_spraying.yml b/stories/active_directory_password_spraying.yml index 0b96099ec6..43d0084537 100644 --- a/stories/active_directory_password_spraying.yml +++ b/stories/active_directory_password_spraying.yml @@ -3,7 +3,6 @@ id: 3de109da-97d2-11eb-8b6a-acde48001122 version: 1 date: '2021-04-07' author: Mauricio Velazco, Splunk -type: batch description: Monitor for activities and techniques associated with Password Spraying attacks within Active Directory environments. narrative: In a password spraying attack, adversaries leverage one or a small list of commonly used / popular passwords against a large volume of usernames to acquire valid account credentials. Unlike a Brute Force attack that targets a specific user or small group of users with a large number of passwords, password spraying follows the opposite aproach and increases the chances of obtaining valid credentials while avoiding account lockouts. diff --git a/stories/apache_struts_vulnerability.yml b/stories/apache_struts_vulnerability.yml index 844472655f..a3b40c39bc 100644 --- a/stories/apache_struts_vulnerability.yml +++ b/stories/apache_struts_vulnerability.yml @@ -3,7 +3,6 @@ id: 2dcfd6a2-e7d2-4873-b6ba-adaf819d2a1e version: 1 date: '2018-12-06' author: Rico Valdez, Splunk -type: batch description: Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. diff --git a/stories/asset_tracking.yml b/stories/asset_tracking.yml index 29b5fa430d..a1c83ccb7e 100644 --- a/stories/asset_tracking.yml +++ b/stories/asset_tracking.yml @@ -3,7 +3,6 @@ id: 91c676cf-0b23-438d-abee-f6335e1fce77 version: 1 date: '2017-09-13' author: Bhavin Patel, Splunk -type: batch description: Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. diff --git a/stories/aws_cross_account_activity.yml b/stories/aws_cross_account_activity.yml index 330ee1e9d3..4bddf3c277 100644 --- a/stories/aws_cross_account_activity.yml +++ b/stories/aws_cross_account_activity.yml @@ -3,7 +3,6 @@ id: 2f2f610a-d64d-48c2-b57c-967a2b49ab5a version: 1 date: '2018-06-04' author: David Dorsey, Splunk -type: batch description: Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. diff --git a/stories/aws_iam_privilege_escalation.yml b/stories/aws_iam_privilege_escalation.yml index 7e12542750..0be124c6d0 100644 --- a/stories/aws_iam_privilege_escalation.yml +++ b/stories/aws_iam_privilege_escalation.yml @@ -3,7 +3,6 @@ id: ced74200-8465-4bc3-bd2c-22782eec6750 version: 1 date: '2021-03-08' author: Bhavin Patel, Splunk -type: batch description: This analytic story contains detections that query your AWS Cloudtrail for activities related to privilege escalation. narrative: 'Amazon Web Services provides a neat feature called Identity and Access Management (IAM) that enables organizations to manage various AWS services and resources in a secure way. All IAM users have roles, groups and policies associated with them which governs and sets permissions to allow a user to access specific restrictions.\ diff --git a/stories/aws_network_acl_activity.yml b/stories/aws_network_acl_activity.yml index 80e0343e19..265d4a8b84 100644 --- a/stories/aws_network_acl_activity.yml +++ b/stories/aws_network_acl_activity.yml @@ -3,7 +3,6 @@ id: 2e8948a5-5239-406b-b56b-6c50ff268af4 version: 2 date: '2018-05-21' author: Bhavin Patel, Splunk -type: batch description: Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative: AWS CloudTrail is an AWS service that helps you enable governance, compliance, diff --git a/stories/aws_security_hub_alerts.yml b/stories/aws_security_hub_alerts.yml index 02117cda41..5637e16115 100644 --- a/stories/aws_security_hub_alerts.yml +++ b/stories/aws_security_hub_alerts.yml @@ -3,7 +3,6 @@ id: 2f2f610a-d64d-48c2-b57c-96722b49ab5a version: 1 date: '2020-08-04' author: Bhavin Patel, Splunk -type: batch description: This story is focused around detecting Security Hub alerts generated from AWS narrative: AWS Security Hub collects and consolidates findings from AWS security services diff --git a/stories/aws_user_monitoring.yml b/stories/aws_user_monitoring.yml index b5ca874a7a..8476972f79 100644 --- a/stories/aws_user_monitoring.yml +++ b/stories/aws_user_monitoring.yml @@ -3,7 +3,6 @@ id: 2e8948a5-5239-406b-b56b-6c50f1269af3 version: 1 date: '2018-03-12' author: Bhavin Patel, Splunk -type: batch description: Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. diff --git a/stories/baron_samedit_cve_2021_3156.yml b/stories/baron_samedit_cve_2021_3156.yml index d66edc4d0e..496b8c342d 100644 --- a/stories/baron_samedit_cve_2021_3156.yml +++ b/stories/baron_samedit_cve_2021_3156.yml @@ -3,7 +3,6 @@ id: 817b0dfc-23ba-4bcc-96cc-2cb77e428fbe version: 1 date: '2021-01-27' author: Shannon Davis, Splunk -type: batch description: Uncover activity consistent with CVE-2021-3156. Discovered by the Qualys Research Team, this vulnerability has been found to affect sudo across multiple Linux distributions (Ubuntu 20.04 and prior, Debian 10 and prior, Fedora 33 and diff --git a/stories/bits_jobs.yml b/stories/bits_jobs.yml index 655efdd27e..fc9465367c 100644 --- a/stories/bits_jobs.yml +++ b/stories/bits_jobs.yml @@ -3,7 +3,6 @@ id: dbc7edce-8e4c-11eb-9f31-acde48001122 version: 1 date: '2021-03-26' author: Michael Haag, Splunk -type: batch description: Adversaries may abuse BITS jobs to persistently execute or clean up after malicious payloads. narrative: Windows Background Intelligent Transfer Service (BITS) is a low-bandwidth, asynchronous file transfer mechanism exposed through Component Object Model (COM). BITS is commonly used by updaters, messengers, and other applications preferred to operate in the background (using available idle bandwidth) without interrupting other networked applications. File transfer tasks are implemented as BITS jobs, which contain a queue of one or more file operations. The interface to create and manage BITS jobs is accessible through PowerShell and the BITSAdmin tool. Adversaries may abuse BITS to download, execute, and even clean up after running malicious code. BITS tasks are self-contained in the BITS job database, without new files or registry modifications, and often permitted by host firewalls. BITS enabled execution may also enable persistence by creating long-standing jobs (the default maximum lifetime is 90 days and extendable) or invoking an arbitrary program when a job completes or errors (including after system reboots). diff --git a/stories/brand_monitoring.yml b/stories/brand_monitoring.yml index e6554d0edf..2793a473cb 100644 --- a/stories/brand_monitoring.yml +++ b/stories/brand_monitoring.yml @@ -3,7 +3,6 @@ id: 91c676cf-0b23-438d-abee-f6335e1fce78 version: 1 date: '2017-12-19' author: David Dorsey, Splunk -type: batch description: Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. diff --git a/stories/cloud_cryptomining.yml b/stories/cloud_cryptomining.yml index f8b6cc70a8..493f847df1 100644 --- a/stories/cloud_cryptomining.yml +++ b/stories/cloud_cryptomining.yml @@ -3,7 +3,6 @@ id: 3b96d13c-fdc7-45dd-b3ad-c132b31cdd2a version: 1 date: '2019-10-02' author: David Dorsey, Splunk -type: batch description: Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users diff --git a/stories/cloud_federated_credential_abuse.yml b/stories/cloud_federated_credential_abuse.yml index 8f00c68e79..2ad5467a3d 100644 --- a/stories/cloud_federated_credential_abuse.yml +++ b/stories/cloud_federated_credential_abuse.yml @@ -3,7 +3,6 @@ id: cecdc1e7-0af2-4a55-8967-b9ea62c0317d version: 1 date: '2021-01-26' author: Rod Soto, Splunk -type: batch description: This analytical story addresses events that indicate abuse of cloud federated credentials. These credentials are usually extracted from endpoint desktop or servers specially those servers that provide federation services such as Windows Active diff --git a/stories/cobalt_strike.yml b/stories/cobalt_strike.yml index bb4cc786aa..ef1fd824fe 100644 --- a/stories/cobalt_strike.yml +++ b/stories/cobalt_strike.yml @@ -3,7 +3,6 @@ id: bcfd17e8-5461-400a-80a2-3b7d1459220c version: 1 date: '2021-02-16' author: Michael Haag, Splunk -type: batch description: Cobalt Strike is threat emulation software. Red teams and penetration testers use Cobalt Strike to demonstrate the risk of a breach and evaluate mature security programs. Most recently, Cobalt Strike has become the choice tool by threat groups due to its ease of use and extensibility. narrative: 'This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Cobalt Strike. Cobalt Strike has many ways to be enhanced by using aggressor scripts, malleable C2 profiles, default attack packages, and much more. diff --git a/stories/coldroot_macos_rat.yml b/stories/coldroot_macos_rat.yml index b1ea322c59..9c6b50cc02 100644 --- a/stories/coldroot_macos_rat.yml +++ b/stories/coldroot_macos_rat.yml @@ -3,7 +3,6 @@ id: bd91a2bc-d20b-4f44-a982-1bea98e86390 version: 1 date: '2019-01-09' author: Jose Hernandez, Splunk -type: batch description: Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, diff --git a/stories/collection_and_staging.yml b/stories/collection_and_staging.yml index 3557fd8bb6..12b1951c01 100644 --- a/stories/collection_and_staging.yml +++ b/stories/collection_and_staging.yml @@ -3,7 +3,6 @@ id: 8e03c61e-13c4-4dcd-bfbe-5ce5a8dc031a version: 1 date: '2020-02-03' author: Rico Valdez, Splunk -type: batch description: 'Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating diff --git a/stories/command_and_control.yml b/stories/command_and_control.yml index cf7241d118..5e40aceb19 100644 --- a/stories/command_and_control.yml +++ b/stories/command_and_control.yml @@ -3,7 +3,6 @@ id: 943773c6-c4de-4f38-89a8-0b92f98804d8 version: 1 date: '2018-06-01' author: Rico Valdez, Splunk -type: batch description: Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions diff --git a/stories/container_implantation_monitoring_and_investigation.yml b/stories/container_implantation_monitoring_and_investigation.yml index 23abd5d6ae..30543b29c3 100644 --- a/stories/container_implantation_monitoring_and_investigation.yml +++ b/stories/container_implantation_monitoring_and_investigation.yml @@ -3,7 +3,6 @@ id: aa0e28b1-0521-4b6f-9d2a-7b87e34af246 version: 1 date: '2020-02-20' author: Rod Soto, Rico Valdez, Splunk -type: batch description: Use the searches in this story to monitor your Kubernetes registry repositories for upload, and deployment of potentially vulnerable, backdoor, or implanted containers. These searches provide information on source users, destination path, container diff --git a/stories/credential_dumping.yml b/stories/credential_dumping.yml index a78c4523b4..c1d1950113 100644 --- a/stories/credential_dumping.yml +++ b/stories/credential_dumping.yml @@ -3,7 +3,6 @@ id: 854d78bf-d0e2-4f4e-b05c-640905f86d7a version: 3 date: '2020-02-04' author: Rico Valdez, Splunk -type: batch description: Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and diff --git a/stories/data_exfiltration.yml b/stories/data_exfiltration.yml index e97d584d9f..0990885754 100644 --- a/stories/data_exfiltration.yml +++ b/stories/data_exfiltration.yml @@ -3,7 +3,6 @@ id: 66b0fe0c-1351-11eb-adc1-0242ac120002 version: 1 date: '2020-10-21' author: Shannon Davis, Splunk -type: batch description: The stealing of data by an adversary. narrative: Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels diff --git a/stories/data_protection.yml b/stories/data_protection.yml index fdac1f2174..7b9fe695fa 100644 --- a/stories/data_protection.yml +++ b/stories/data_protection.yml @@ -3,7 +3,6 @@ id: 91c676cf-0b23-438d-abee-f6335e1fce33 version: 1 date: '2017-09-14' author: Bhavin Patel, Splunk -type: batch description: Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. diff --git a/stories/deobfuscate_decode_files_or_information.yml b/stories/deobfuscate_decode_files_or_information.yml index 3b88f611bd..983760790f 100644 --- a/stories/deobfuscate_decode_files_or_information.yml +++ b/stories/deobfuscate_decode_files_or_information.yml @@ -3,7 +3,6 @@ id: 0bd01a54-8cbe-11eb-abcd-acde48001122 version: 1 date: '2021-03-24' author: Michael Haag, Splunk -type: batch description: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. narrative: An example of obfuscated files is `Certutil.exe` usage to encode a portable executable to a certificate file, which is base64 encoded, to hide the originating file. There are many utilities cross-platform to encode using XOR, using compressed .cab files to hide contents and scripting languages that may perform similar native Windows tasks. Triaging an event related will require the capability to review related process events and file modifications. Using a tool such as CyberChef will assist with identifying the encoding that was used, and potentially assist with decoding the contents. diff --git a/stories/detect_zerologon_attack.yml b/stories/detect_zerologon_attack.yml index 0d4c72e47b..9ac0ed54e9 100644 --- a/stories/detect_zerologon_attack.yml +++ b/stories/detect_zerologon_attack.yml @@ -3,7 +3,6 @@ id: 5d14a962-569e-4578-939f-f386feb63ce4 version: 1 date: '2020-09-18' author: Rod Soto, Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk -type: batch description: Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now diff --git a/stories/dhs_report_ta18_074a.yml b/stories/dhs_report_ta18_074a.yml index 012190d978..6388122732 100644 --- a/stories/dhs_report_ta18_074a.yml +++ b/stories/dhs_report_ta18_074a.yml @@ -3,7 +3,6 @@ id: 0c016e5c-88be-4e2c-8c6c-c2b55b4fb4ef version: 2 date: '2020-01-22' author: Rico Valdez, Splunk -type: batch description: Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. diff --git a/stories/disabling_security_tools.yml b/stories/disabling_security_tools.yml index aebcad8523..830260235f 100644 --- a/stories/disabling_security_tools.yml +++ b/stories/disabling_security_tools.yml @@ -3,7 +3,6 @@ id: fcc27099-46a0-46b0-a271-5c7dab56b6f1 version: 2 date: '2020-02-04' author: Rico Valdez, Splunk -type: batch description: Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. diff --git a/stories/dns_amplification_attacks.yml b/stories/dns_amplification_attacks.yml index 23bdb70021..9426f1b102 100644 --- a/stories/dns_amplification_attacks.yml +++ b/stories/dns_amplification_attacks.yml @@ -3,7 +3,6 @@ id: e8afd39e-3294-11e6-b39d-a45e60c6700 version: 1 date: '2016-09-13' author: Bhavin Patel, Splunk -type: batch description: DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, diff --git a/stories/dns_hijacking.yml b/stories/dns_hijacking.yml index f40dcee71c..9e697bd6c9 100644 --- a/stories/dns_hijacking.yml +++ b/stories/dns_hijacking.yml @@ -3,7 +3,6 @@ id: 8169f17b-ef68-4b59-aa28-586907301221 version: 1 date: '2020-02-04' author: Bhavin Patel, Splunk -type: batch description: Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative: 'Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), diff --git a/stories/domain_trust_discovery.yml b/stories/domain_trust_discovery.yml index 23ac481d24..6831e4a759 100644 --- a/stories/domain_trust_discovery.yml +++ b/stories/domain_trust_discovery.yml @@ -3,7 +3,6 @@ id: e6f30f14-8daf-11eb-a017-acde48001122 version: 1 date: '2021-03-25' author: Michael Haag, Splunk -type: batch description: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments. narrative: Domain trusts provide a mechanism for a domain to allow access to resources based on the authentication procedures of another domain. Domain trusts allow the users of the trusted domain to access resources in the trusting domain. The information discovered may help the adversary conduct SID-History Injection, Pass the Ticket, and Kerberoasting. Domain trusts can be enumerated using the DSEnumerateDomainTrusts() Win32 API call, .NET methods, and LDAP. The Windows utility Nltest is known to be used by adversaries to enumerate domain trusts. references: diff --git a/stories/dynamic_dns.yml b/stories/dynamic_dns.yml index f8e0211fda..1b1e648a9c 100644 --- a/stories/dynamic_dns.yml +++ b/stories/dynamic_dns.yml @@ -3,7 +3,6 @@ id: 8169f17b-ef68-4b59-aae8-586907301221 version: 2 date: '2018-09-06' author: Bhavin Patel, Splunk -type: batch description: Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. diff --git a/stories/emotet_malware__dhs_report_ta18_201a_.yml b/stories/emotet_malware__dhs_report_ta18_201a_.yml index 48163971c5..1c29dbd0d7 100644 --- a/stories/emotet_malware__dhs_report_ta18_201a_.yml +++ b/stories/emotet_malware__dhs_report_ta18_201a_.yml @@ -3,7 +3,6 @@ id: bb9f5ed2-916e-4364-bb6d-91c310efcf52 version: 1 date: '2020-01-27' author: Bhavin Patel, Splunk -type: batch description: Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has diff --git a/stories/f5_tmui_rce_cve_2020_5902.yml b/stories/f5_tmui_rce_cve_2020_5902.yml index 3aa77c4f47..24793d3383 100644 --- a/stories/f5_tmui_rce_cve_2020_5902.yml +++ b/stories/f5_tmui_rce_cve_2020_5902.yml @@ -3,7 +3,6 @@ id: 7678c968-d46e-11ea-87d0-0242ac130003 version: 1 date: '2020-08-02' author: Shannon Davis, Splunk -type: batch description: Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows diff --git a/stories/gcp_cross_account_activity.yml b/stories/gcp_cross_account_activity.yml index 7e18c2dea7..6dc5c9c4e8 100644 --- a/stories/gcp_cross_account_activity.yml +++ b/stories/gcp_cross_account_activity.yml @@ -3,7 +3,6 @@ id: 0432039c-ef41-4b03-b157-450c25dad1e6 version: 1 date: '2020-09-01' author: Rod Soto, Splunk -type: batch description: Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. diff --git a/stories/hafnium_group.yml b/stories/hafnium_group.yml index f6647be9e5..dcd0e241d0 100644 --- a/stories/hafnium_group.yml +++ b/stories/hafnium_group.yml @@ -3,7 +3,6 @@ id: beae2ab0-7c3f-11eb-8b63-acde48001122 version: 1 date: '2021-03-03' author: Michael Haag, Splunk -type: batch description: HAFNIUM group was identified by Microsoft as exploiting 4 Microsoft Exchange CVEs in the wild - CVE-2021-26855, CVE-2021-26857, CVE-2021-26858 and CVE-2021-27065. narrative: 'On Tuesday, March 2, 2021, Microsoft released a set of security patches for its mail server, Microsoft Exchange. These patches respond to a group of vulnerabilities known to impact Exchange 2013, 2016, and 2019. It is important to note that an Exchange 2010 security update has also been issued, though the CVEs do not reference that version as being vulnerable.\ diff --git a/stories/hidden_cobra_malware.yml b/stories/hidden_cobra_malware.yml index 89c203de60..0c62805bc0 100644 --- a/stories/hidden_cobra_malware.yml +++ b/stories/hidden_cobra_malware.yml @@ -3,7 +3,6 @@ id: baf7580b-d4b4-4774-8173-7d198e9da335 version: 2 date: '2020-01-22' author: Rico Valdez, Splunk -type: batch description: Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported diff --git a/stories/ingress_tool_transfer.yml b/stories/ingress_tool_transfer.yml index 53441130b2..e9aa1d1dfa 100644 --- a/stories/ingress_tool_transfer.yml +++ b/stories/ingress_tool_transfer.yml @@ -3,7 +3,6 @@ id: b3782036-8cbd-11eb-9d8e-acde48001122 version: 1 date: '2021-03-24' author: Michael Haag, Splunk -type: batch description: Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. narrative: Ingress tool transfer is a Technique under tactic Command and Control. Behaviors will include the use of living off the land binaries to download implants or binaries over alternate communication ports. It is imperative to baseline applications on endpoints to understand what generates network activity, to where, and what is its native behavior. These utilities, when abused, will write files to disk in world writeable paths.\ During triage, review the reputation of the remote public destination IP or domain. Capture any files written to disk and perform analysis. Review other parrallel processes for additional behaviors. diff --git a/stories/jboss_vulnerability.yml b/stories/jboss_vulnerability.yml index e68a18c5cb..fb33969d18 100644 --- a/stories/jboss_vulnerability.yml +++ b/stories/jboss_vulnerability.yml @@ -3,7 +3,6 @@ id: 1f5294cb-b85f-4c2d-9c58-ffcf248f52bd version: 1 date: '2017-09-14' author: Bhavin Patel, Splunk -type: batch description: In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources diff --git a/stories/kubernetes_scanning_activity.yml b/stories/kubernetes_scanning_activity.yml index 0476024cf5..0d89c48de8 100644 --- a/stories/kubernetes_scanning_activity.yml +++ b/stories/kubernetes_scanning_activity.yml @@ -3,7 +3,6 @@ id: a9ef59cf-e981-4e66-9eef-bb049f695c09 version: 1 date: '2020-04-15' author: Rod Soto, Splunk -type: batch description: This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. diff --git a/stories/kubernetes_sensitive_object_access_activity.yml b/stories/kubernetes_sensitive_object_access_activity.yml index 911a57fa06..c44e439e03 100644 --- a/stories/kubernetes_sensitive_object_access_activity.yml +++ b/stories/kubernetes_sensitive_object_access_activity.yml @@ -3,7 +3,6 @@ id: 2574e6d9-7254-4751-8925-0447deeec8ea version: 1 date: '2020-05-20' author: Rod Soto, Splunk -type: batch description: This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. diff --git a/stories/lateral_movement.yml b/stories/lateral_movement.yml index 2cc361ff75..f5ac2aa14b 100644 --- a/stories/lateral_movement.yml +++ b/stories/lateral_movement.yml @@ -3,7 +3,6 @@ id: 399d65dc-1f08-499b-a259-aad9051f38ad version: 2 date: '2020-02-04' author: David Dorsey, Splunk -type: batch description: Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. diff --git a/stories/malicious_powershell.yml b/stories/malicious_powershell.yml index c1bcf4a50e..21d087f8cd 100644 --- a/stories/malicious_powershell.yml +++ b/stories/malicious_powershell.yml @@ -3,7 +3,6 @@ id: 2c8ff66e-0b57-42af-8ad7-912438a403fc version: 5 date: '2017-08-23' author: David Dorsey, Splunk -type: batch description: Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate diff --git a/stories/masquerading___rename_system_utilities.yml b/stories/masquerading___rename_system_utilities.yml index 631f9ee4c3..4826f8b119 100644 --- a/stories/masquerading___rename_system_utilities.yml +++ b/stories/masquerading___rename_system_utilities.yml @@ -3,7 +3,6 @@ id: f0258af4-a6ae-11eb-b3c2-acde48001122 version: 1 date: '2021-04-26' author: Michael Haag, Splunk -type: batch description: Adversaries may rename legitimate system utilities to try to evade security mechanisms concerning the usage of those utilities. narrative: 'Security monitoring and control mechanisms may be in place for system utilities adversaries are capable of abusing. It may be possible to bypass those security mechanisms by renaming the utility prior to utilization (ex: rename rundll32.exe). diff --git a/stories/meterpreter.yml b/stories/meterpreter.yml index 8e51ee26cf..67d0613073 100644 --- a/stories/meterpreter.yml +++ b/stories/meterpreter.yml @@ -3,7 +3,6 @@ id: d5f8e298-c85a-11eb-9fea-acde48001122 version: 1 date: '2021-06-08' author: Michael Hart -type: batch description: Meterpreter provides red teams, pen testers and threat actors interactive access to a compromised host to run commands, upload payloads, download files, and other actions. narrative: 'This Analytic Story supports you to detect Tactics, Techniques and Procedures (TTPs) from Meterpreter. Meterpreter is a Metasploit payload for remote execution that leverages DLL injection to make it extremely difficult to detect. Since the software diff --git a/stories/monitor_for_updates.yml b/stories/monitor_for_updates.yml index ba145b98e1..7cf230ba33 100644 --- a/stories/monitor_for_updates.yml +++ b/stories/monitor_for_updates.yml @@ -3,7 +3,6 @@ id: 9ef8d677-7b52-4213-a038-99cfc7acc2d8 version: 1 date: '2017-09-15' author: Rico Valdez, Splunk -type: batch description: Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches. diff --git a/stories/netsh_abuse.yml b/stories/netsh_abuse.yml index 316cb9eb52..83a715d79a 100644 --- a/stories/netsh_abuse.yml +++ b/stories/netsh_abuse.yml @@ -3,7 +3,6 @@ id: 2b1800dd-92f9-47ec-a981-fdf1351e5f65 version: 1 date: '2017-01-05' author: Bhavin Patel, Splunk -type: batch description: Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. diff --git a/stories/nobelium_group.yml b/stories/nobelium_group.yml index 4f953ee032..17309b5480 100644 --- a/stories/nobelium_group.yml +++ b/stories/nobelium_group.yml @@ -3,7 +3,6 @@ id: 758196b5-2e21-424f-a50c-6e421ce926c2 version: 2 date: '2020-12-14' author: Patrick Bareiss, Michael Haag, Splunk -type: batch description: Sunburst is a trojanized updates to SolarWinds Orion IT monitoring and management software. It was discovered by FireEye in December 2020. The actors behind this campaign gained access to numerous public and private organizations around diff --git a/stories/office_365_detections.yml b/stories/office_365_detections.yml index 26524e3c60..a88ebbccf8 100644 --- a/stories/office_365_detections.yml +++ b/stories/office_365_detections.yml @@ -3,7 +3,6 @@ id: 1a51dd71-effc-48b2-abc4-3e9cdb61e5b9 version: 1 date: '2020-12-16' author: Patrick Bareiss, Splunk -type: batch description: This story is focused around detecting Office 365 Attacks. narrative: More and more companies are using Microsofts Office 365 cloud offering. Therefore, we see more and more attacks against Office 365. This story provides diff --git a/stories/orangeworm_attack_group.yml b/stories/orangeworm_attack_group.yml index 2caa4a5fa2..5d27d3d8d7 100644 --- a/stories/orangeworm_attack_group.yml +++ b/stories/orangeworm_attack_group.yml @@ -3,7 +3,6 @@ id: bb9f5ed2-916e-4364-bb6d-97c370efcf52 version: 2 date: '2020-01-22' author: David Dorsey, Splunk -type: batch description: Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative: 'In May of 2018, the attack group Orangeworm was implicated for installing diff --git a/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml b/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml index fc38055e4b..b7b632d07c 100644 --- a/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml +++ b/stories/possible_backdoor_activity_associated_with_mudcarp_espionage_campaigns.yml @@ -3,7 +3,6 @@ id: 988C59C5-0A1C-45B6-A555-0C62276E327E version: 1 date: '2020-01-22' author: iDefense Cyber Espionage Team, iDefense -type: batch description: Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative: 'This story was created as a joint effort between iDefense and Splunk.\ diff --git a/stories/printnightmare_cve_2021_34527.yml b/stories/printnightmare_cve_2021_34527.yml index b9b52925ef..b5101c06e7 100644 --- a/stories/printnightmare_cve_2021_34527.yml +++ b/stories/printnightmare_cve_2021_34527.yml @@ -3,7 +3,6 @@ id: fd79470a-da88-11eb-b803-acde48001122 version: 1 date: '2021-07-01' author: Splunk Threat Research Team -type: batch description: The following analytic story identifies behaviors related PrintNightmare, or CVE-2021-34527 previously known as (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. narrative: 'This vulnerability affects the Print Spooler service, enabled by default on Windows systems, and allows adversaries to trick this service into installing a remotely hosted print driver using a low privileged user account. Successful exploitation effectively allows adversaries to execute code in the target system (Remote Code Execution) in the context of the Print Spooler service which runs with the highest privileges (Privilege Escalation). \ diff --git a/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml b/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml index 88c140a3ba..7fed5adc91 100644 --- a/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml +++ b/stories/prohibited_traffic_allowed_or_protocol_mismatch.yml @@ -3,7 +3,6 @@ id: 6d13121c-90f3-446d-8ac3-27efbbc65218 version: 1 date: '2017-09-11' author: Rico Valdez, Splunk -type: batch description: Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. diff --git a/stories/ransomware.yml b/stories/ransomware.yml index d2d5ad8bb4..1835219ce4 100644 --- a/stories/ransomware.yml +++ b/stories/ransomware.yml @@ -3,7 +3,6 @@ id: cf309d0d-d4aa-4fbb-963d-1e79febd3756 version: 1 date: '2020-02-04' author: David Dorsey, Splunk -type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected diff --git a/stories/ransomware_clop.yml b/stories/ransomware_clop.yml index 8177d02ac9..6138f515ab 100644 --- a/stories/ransomware_clop.yml +++ b/stories/ransomware_clop.yml @@ -3,7 +3,6 @@ id: 5a6f6849-1a26-4fae-aa05-fa730556eeb6 version: 1 date: '2021-03-17' author: Rod Soto, Teoderick Contreras, Splunk -type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Clop ransomware, including looking for file writes associated with Clope, encrypting network shares, deleting and resizing shadow volume storage, registry key modification, diff --git a/stories/ransomware_cloud.yml b/stories/ransomware_cloud.yml index 728c9805b5..5cc4ea4f92 100644 --- a/stories/ransomware_cloud.yml +++ b/stories/ransomware_cloud.yml @@ -3,7 +3,6 @@ id: f52f6c43-05f8-4b19-a9d3-5b8c56da91c2 version: 1 date: '2020-10-27' author: Rod Soto, David Dorsey, Splunk -type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. diff --git a/stories/ransomware_darkside.yml b/stories/ransomware_darkside.yml index 734c881cbc..f2e6d8bfd9 100644 --- a/stories/ransomware_darkside.yml +++ b/stories/ransomware_darkside.yml @@ -3,7 +3,6 @@ id: 507edc74-13d5-4339-878e-b9114ded1f35 version: 1 date: '2021-05-12' author: Bhavin Patel, Splunk -type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the DarkSide Ransomware narrative: 'This story addresses Darkside ransomware. This ransomware payload has many similarities to common ransomware however there are certain items particular to it. The creation of a .TXT log that shows every item being encrypted as well as the creation of ransomware notes and files adding a machine ID created based on CRC32 checksum algorithm. This ransomware payload leaves machines in minimal operation level,enough to browse the attackers websites. A customized URI with leaked information is presented to each victim.This is the ransomware payload that shut down the Colonial pipeline. The story is composed of several detection searches covering similar items to other ransomware payloads and those particular to Darkside payload.' diff --git a/stories/ransomware_revil.yml b/stories/ransomware_revil.yml index f9ce340b48..33cab06420 100644 --- a/stories/ransomware_revil.yml +++ b/stories/ransomware_revil.yml @@ -3,7 +3,6 @@ id: 817cae42-f54b-457a-8a36-fbf45521e29e version: 1 date: '2021-06-04' author: Teoderick Contreras, Splunk -type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Revil ransomware, including looking for file writes associated with Revil, encrypting network shares, deleting shadow volume storage, registry key modification, diff --git a/stories/ransomware_ryuk.yml b/stories/ransomware_ryuk.yml index 5fe0d2eb11..bfd0ff7438 100644 --- a/stories/ransomware_ryuk.yml +++ b/stories/ransomware_ryuk.yml @@ -3,7 +3,6 @@ id: 507edc74-13d5-4339-878e-b9744ded1f35 version: 1 date: '2020-11-06' author: Jose Hernandez, Splunk -type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, diff --git a/stories/ransomware_samsam.yml b/stories/ransomware_samsam.yml index bd3542f193..1d905c3bf0 100644 --- a/stories/ransomware_samsam.yml +++ b/stories/ransomware_samsam.yml @@ -3,7 +3,6 @@ id: c4b89506-fbcf-4cb7-bfd6-527e54789604 version: 1 date: '2018-12-13' author: Rico Valdez, Splunk -type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware diff --git a/stories/router_and_infrastructure_security.yml b/stories/router_and_infrastructure_security.yml index 346b45a98f..1d6f3a161c 100644 --- a/stories/router_and_infrastructure_security.yml +++ b/stories/router_and_infrastructure_security.yml @@ -3,7 +3,6 @@ id: 91c676cf-0b23-438d-abee-f6335e177e77 version: 1 date: '2017-09-12' author: Bhavin Patel, Splunk -type: batch description: Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. diff --git a/stories/silver_sparrow.yml b/stories/silver_sparrow.yml index 2c9ea4f838..bee529af8c 100644 --- a/stories/silver_sparrow.yml +++ b/stories/silver_sparrow.yml @@ -3,7 +3,6 @@ id: cb4f48fe-7699-11eb-af77-acde48001122 version: 1 date: '2021-02-24' author: Michael Haag, Splunk -type: batch description: Silver Sparrow, identified by Red Canary Intelligence, is a new forward looking MacOS (Intel and M1) malicious software downloader utilizing JavaScript for execution and a launchAgent to establish persistence. narrative: 'Silver Sparrow works is a dropper and uses typical persistence mechanisms on a Mac. It is cross platform, covering both Intel and Apple M1 architecture. To this date, no implant has been downloaded for malicious purposes. During installation of the update.pkg or updater.pkg file, the malicious software utilizes JavaScript to generate files and scripts on disk for persistence.These files later download a implant from an S3 bucket every hour. diff --git a/stories/spearphishing_attachments.yml b/stories/spearphishing_attachments.yml index ee7ef3b1bc..803a28a2b5 100644 --- a/stories/spearphishing_attachments.yml +++ b/stories/spearphishing_attachments.yml @@ -3,7 +3,6 @@ id: 57226b40-94f3-4ce5-b101-a75f67759c27 version: 1 date: '2019-04-29' author: Splunk Research Team, Splunk -type: batch description: Detect signs of malicious payloads that may indicate that your environment has been breached via a phishing attack. narrative: 'Despite its simplicity, phishing remains the most pervasive and dangerous diff --git a/stories/sql_injection.yml b/stories/sql_injection.yml index 25b2df4022..13a2a1ad46 100644 --- a/stories/sql_injection.yml +++ b/stories/sql_injection.yml @@ -3,7 +3,6 @@ id: 4f6632f5-449c-4686-80df-57625f59bab3 version: 1 date: '2017-09-19' author: Bhavin Patel, Splunk -type: batch description: Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters. diff --git a/stories/suspicious_aws_login_activities.yml b/stories/suspicious_aws_login_activities.yml index 4f230b72c7..247ee0e473 100644 --- a/stories/suspicious_aws_login_activities.yml +++ b/stories/suspicious_aws_login_activities.yml @@ -3,7 +3,6 @@ id: 2e8948a5-5239-406b-b56b-6c59f1268af3 version: 1 date: '2019-05-01' author: Bhavin Patel, Splunk -type: batch description: 'Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. ' diff --git a/stories/suspicious_aws_s3_activities.yml b/stories/suspicious_aws_s3_activities.yml index a02dbf536b..cff8756af5 100644 --- a/stories/suspicious_aws_s3_activities.yml +++ b/stories/suspicious_aws_s3_activities.yml @@ -3,7 +3,6 @@ id: 2e8948a5-5239-406b-b56b-6c50w3168af3 version: 2 date: '2018-07-24' author: Bhavin Patel, Splunk -type: batch description: Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative diff --git a/stories/suspicious_aws_traffic.yml b/stories/suspicious_aws_traffic.yml index d415be8ab2..f53703a296 100644 --- a/stories/suspicious_aws_traffic.yml +++ b/stories/suspicious_aws_traffic.yml @@ -3,7 +3,6 @@ id: 2e8948a5-5239-406b-b56b-6c50f2168af3 version: 1 date: '2018-05-07' author: Bhavin Patel, Splunk -type: batch description: Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). diff --git a/stories/suspicious_cloud_authentication_activities.yml b/stories/suspicious_cloud_authentication_activities.yml index f9e9a62fa2..7b7a386b11 100644 --- a/stories/suspicious_cloud_authentication_activities.yml +++ b/stories/suspicious_cloud_authentication_activities.yml @@ -3,7 +3,6 @@ id: 6380ebbb-55c5-4fce-b754-01fd565fb73c version: 1 date: '2020-06-04' author: Rico Valdez, Splunk -type: batch description: 'Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. ' diff --git a/stories/suspicious_cloud_instance_activities.yml b/stories/suspicious_cloud_instance_activities.yml index 68fae232e4..9d39f01564 100644 --- a/stories/suspicious_cloud_instance_activities.yml +++ b/stories/suspicious_cloud_instance_activities.yml @@ -3,7 +3,6 @@ id: 8168ca88-392e-42f4-85a2-767579c660ce version: 1 date: '2020-08-25' author: David Dorsey, Splunk -type: batch description: Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. diff --git a/stories/suspicious_cloud_provisioning_activities.yml b/stories/suspicious_cloud_provisioning_activities.yml index fecd3548cb..d994844215 100644 --- a/stories/suspicious_cloud_provisioning_activities.yml +++ b/stories/suspicious_cloud_provisioning_activities.yml @@ -3,7 +3,6 @@ id: 51045ded-1575-4ba6-aef7-af6c73cffd86 version: 1 date: '2018-08-20' author: David Dorsey, Splunk -type: batch description: Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. diff --git a/stories/suspicious_cloud_user_activities.yml b/stories/suspicious_cloud_user_activities.yml index 7270c9d8d9..a9629973c4 100644 --- a/stories/suspicious_cloud_user_activities.yml +++ b/stories/suspicious_cloud_user_activities.yml @@ -3,7 +3,6 @@ id: 1ed5ce7d-5469-4232-92af-89d1a3595b39 version: 1 date: '2020-09-04' author: David Dorsey, Splunk -type: batch description: Detect and investigate suspicious activities by users and roles in your cloud environments. narrative: 'It seems obvious that it is critical to monitor and control the users diff --git a/stories/suspicious_command_line_executions.yml b/stories/suspicious_command_line_executions.yml index 1cd363a106..4d9f231b56 100644 --- a/stories/suspicious_command_line_executions.yml +++ b/stories/suspicious_command_line_executions.yml @@ -3,7 +3,6 @@ id: f4368ddf-d59f-4192-84f6-778ac5a3ffc7 version: 2 date: '2020-02-03' author: Bhavin Patel, Splunk -type: batch description: Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI diff --git a/stories/suspicious_compiled_html_activity.yml b/stories/suspicious_compiled_html_activity.yml index 852ae02ef1..f9a6b1b98c 100644 --- a/stories/suspicious_compiled_html_activity.yml +++ b/stories/suspicious_compiled_html_activity.yml @@ -29,5 +29,4 @@ tags: - Splunk Enterprise Security - Splunk Cloud usecase: Advanced Threat Detection -type: ESCU version: 1 diff --git a/stories/suspicious_dns_traffic.yml b/stories/suspicious_dns_traffic.yml index 487bc98f77..7fa15d73c4 100644 --- a/stories/suspicious_dns_traffic.yml +++ b/stories/suspicious_dns_traffic.yml @@ -3,7 +3,6 @@ id: 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56 version: 1 date: '2017-09-18' author: Rico Valdez, Splunk -type: batch description: Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. diff --git a/stories/suspicious_emails.yml b/stories/suspicious_emails.yml index e8dc840e5c..c39649799d 100644 --- a/stories/suspicious_emails.yml +++ b/stories/suspicious_emails.yml @@ -3,7 +3,6 @@ id: 2b1800dd-92f9-47ec-a981-fdf1351e5d55 version: 1 date: '2020-01-27' author: Bhavin Patel, Splunk -type: batch description: Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. diff --git a/stories/suspicious_gcp_storage_activities.yml b/stories/suspicious_gcp_storage_activities.yml index ab82ae33e8..3964d460bb 100644 --- a/stories/suspicious_gcp_storage_activities.yml +++ b/stories/suspicious_gcp_storage_activities.yml @@ -3,7 +3,6 @@ id: 4d656b2e-d6be-11ea-87d0-0242ac130003 version: 1 date: '2020-08-05' author: Shannon Davis, Splunk -type: batch description: Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative diff --git a/stories/suspicious_mshta_activity.yml b/stories/suspicious_mshta_activity.yml index 71e73efbbf..13fbcab635 100644 --- a/stories/suspicious_mshta_activity.yml +++ b/stories/suspicious_mshta_activity.yml @@ -3,7 +3,6 @@ id: 2b1800dd-92f9-47dd-a981-fdf13w1q5d55 version: 2 date: '2021-01-20' author: Bhavin Patel, Michael Haag, Splunk -type: batch description: Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative: 'One common adversary tactic is to bypass application control solutions diff --git a/stories/suspicious_okta_activity.yml b/stories/suspicious_okta_activity.yml index 5e255e2fe3..d2d088ab3b 100644 --- a/stories/suspicious_okta_activity.yml +++ b/stories/suspicious_okta_activity.yml @@ -3,7 +3,6 @@ id: 9cbd34af-8f39-4476-a423-bacd126c750b version: 1 date: '2020-04-02' author: Rico Valdez, Splunk -type: batch description: Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they diff --git a/stories/suspicious_regsvcs_regasm_activity.yml b/stories/suspicious_regsvcs_regasm_activity.yml index d497be18ff..ba560e9176 100644 --- a/stories/suspicious_regsvcs_regasm_activity.yml +++ b/stories/suspicious_regsvcs_regasm_activity.yml @@ -20,5 +20,4 @@ tags: - Splunk Enterprise Security - Splunk Cloud usecase: Advanced Threat Detection -type: ESCU version: 1 diff --git a/stories/suspicious_regsvr32_activity.yml b/stories/suspicious_regsvr32_activity.yml index fb1a5987fe..57e97a3d32 100644 --- a/stories/suspicious_regsvr32_activity.yml +++ b/stories/suspicious_regsvr32_activity.yml @@ -3,7 +3,6 @@ id: b8bee41e-624f-11eb-ae93-0242ac130002 version: 1 date: '2021-01-29' author: Michael Haag, Splunk -type: batch description: Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. narrative: One common adversary tactic is to bypass application control solutions diff --git a/stories/suspicious_rundll32_activity.yml b/stories/suspicious_rundll32_activity.yml index 3834c54dd1..7ef59791b7 100644 --- a/stories/suspicious_rundll32_activity.yml +++ b/stories/suspicious_rundll32_activity.yml @@ -3,7 +3,6 @@ id: 80a65487-854b-42f1-80a1-935e4c170694 version: 1 date: '2021-02-03' author: Michael Haag, Splunk -type: batch description: Monitor and detect techniques used by attackers who leverage rundll32.exe to execute arbitrary malicious code. narrative: One common adversary tactic is to bypass application control solutions diff --git a/stories/suspicious_windows_registry_activities.yml b/stories/suspicious_windows_registry_activities.yml index ebc24e9a20..f754a8d85a 100644 --- a/stories/suspicious_windows_registry_activities.yml +++ b/stories/suspicious_windows_registry_activities.yml @@ -3,7 +3,6 @@ id: 2b1800dd-92f9-47dd-a981-fdf1351e5d55 version: 1 date: '2018-05-31' author: Bhavin Patel, Splunk -type: batch description: Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative: "Attackers are developing increasingly sophisticated techniques for hijacking\ diff --git a/stories/suspicious_wmi_use.yml b/stories/suspicious_wmi_use.yml index 08c48f624f..ba2fdc5918 100644 --- a/stories/suspicious_wmi_use.yml +++ b/stories/suspicious_wmi_use.yml @@ -3,7 +3,6 @@ id: c8ddc5be-69bc-4202-b3ab-4010b27d7ad5 version: 2 date: '2018-10-23' author: Rico Valdez, Splunk -type: batch description: Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it diff --git a/stories/suspicious_zoom_child_processes.yml b/stories/suspicious_zoom_child_processes.yml index fae67cd19b..f914b8fae1 100644 --- a/stories/suspicious_zoom_child_processes.yml +++ b/stories/suspicious_zoom_child_processes.yml @@ -3,7 +3,6 @@ id: aa3749a6-49c7-491e-a03f-4eaee5fe0258 version: 1 date: '2020-04-13' author: David Dorsey, Splunk -type: batch description: Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection. diff --git a/stories/trickbot.yml b/stories/trickbot.yml index 13f988bd86..00017136e8 100644 --- a/stories/trickbot.yml +++ b/stories/trickbot.yml @@ -3,7 +3,6 @@ id: 16f93769-8342-44c0-9b1d-f131937cce8e version: 1 date: '2021-04-20' author: Rod Soto, Teoderick Contreras, Splunk -type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment. diff --git a/stories/trusted_developer_utilities_proxy_execution.yml b/stories/trusted_developer_utilities_proxy_execution.yml index 6a16527344..afba77ef00 100644 --- a/stories/trusted_developer_utilities_proxy_execution.yml +++ b/stories/trusted_developer_utilities_proxy_execution.yml @@ -3,7 +3,6 @@ id: 270a67a6-55d8-11eb-ae93-0242ac130002 version: 1 date: '2021-01-12' author: Michael Haag, Splunk -type: batch description: Monitor and detect behaviors used by attackers who leverage trusted developer utilities to execute malicious code. narrative: 'Adversaries may take advantage of trusted developer utilities to proxy diff --git a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml index 7e7ba69a53..6539b84b12 100644 --- a/stories/trusted_developer_utilities_proxy_execution_msbuild.yml +++ b/stories/trusted_developer_utilities_proxy_execution_msbuild.yml @@ -3,7 +3,6 @@ id: be3418e2-551b-11eb-ae93-0242ac130002 version: 1 date: '2021-01-21' author: Michael Haag, Splunk -type: batch description: Monitor and detect techniques used by attackers who leverage the msbuild.exe process to execute malicious code. narrative: 'Adversaries may use MSBuild to proxy execution of code through a trusted diff --git a/stories/unusual_processes.yml b/stories/unusual_processes.yml index 128a66c667..d25056b6d0 100644 --- a/stories/unusual_processes.yml +++ b/stories/unusual_processes.yml @@ -3,7 +3,6 @@ id: f4368e3f-d59f-4192-84f6-748ac5a3ddb6 version: 2 date: '2020-02-04' author: Bhavin Patel, Splunk -type: batch description: Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples diff --git a/stories/use_of_cleartext_protocols.yml b/stories/use_of_cleartext_protocols.yml index b6e205332f..7c5861f4b4 100644 --- a/stories/use_of_cleartext_protocols.yml +++ b/stories/use_of_cleartext_protocols.yml @@ -3,7 +3,6 @@ id: 826e6431-aeef-41b4-9fc0-6d0985d65a21 version: 1 date: '2017-09-15' author: Bhavin Patel, Splunk -type: batch description: Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative: Various legacy protocols operate by default in the clear, without the protections diff --git a/stories/windows_defense_evasion_tactics.yml b/stories/windows_defense_evasion_tactics.yml index 3f9b2ca5f2..76c24c9309 100644 --- a/stories/windows_defense_evasion_tactics.yml +++ b/stories/windows_defense_evasion_tactics.yml @@ -3,7 +3,6 @@ id: 56e24a28-5003-4047-b2db-e8f3c4618064 version: 1 date: '2018-05-31' author: David Dorsey, Splunk -type: batch description: 'Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others ' diff --git a/stories/windows_discovery_techniques.yml b/stories/windows_discovery_techniques.yml index 5b0a190e53..47dc3978dc 100644 --- a/stories/windows_discovery_techniques.yml +++ b/stories/windows_discovery_techniques.yml @@ -3,7 +3,6 @@ id: f7aba570-7d59-11eb-825e-acde48001122 version: 1 date: '2021-03-04' author: Michael Hart, Splunk -type: streaming description: Monitors for behaviors associated with adversaries discovering objects in the environment that can be leveraged in the progression of the attack. narrative: Attackers may not have much if any insight into their target's environment diff --git a/stories/windows_dns_sigred_cve_2020_1350.yml b/stories/windows_dns_sigred_cve_2020_1350.yml index 8a4296c821..9737f6b304 100644 --- a/stories/windows_dns_sigred_cve_2020_1350.yml +++ b/stories/windows_dns_sigred_cve_2020_1350.yml @@ -3,7 +3,6 @@ id: 36dbb206-d073-11ea-87d0-0242ac130003 version: 1 date: '2020-07-28' author: Shannon Davis, Splunk -type: batch description: Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker diff --git a/stories/windows_file_extension_and_association_abuse.yml b/stories/windows_file_extension_and_association_abuse.yml index f1436b70df..ff0f6acb37 100644 --- a/stories/windows_file_extension_and_association_abuse.yml +++ b/stories/windows_file_extension_and_association_abuse.yml @@ -3,7 +3,6 @@ id: 30552a76-ac78-48e4-b3c0-de4e34e9563d version: 1 date: '2018-01-26' author: Rico Valdez, Splunk -type: batch description: Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different diff --git a/stories/windows_log_manipulation.yml b/stories/windows_log_manipulation.yml index 1fe8857921..a2fb2c0205 100644 --- a/stories/windows_log_manipulation.yml +++ b/stories/windows_log_manipulation.yml @@ -3,7 +3,6 @@ id: b6db2c60-a281-48b4-95f1-2cd99ed56835 version: 2 date: '2017-09-12' author: Rico Valdez, Splunk -type: batch description: Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. diff --git a/stories/windows_persistence_techniques.yml b/stories/windows_persistence_techniques.yml index 43d49de5d5..99c1a9088a 100644 --- a/stories/windows_persistence_techniques.yml +++ b/stories/windows_persistence_techniques.yml @@ -3,7 +3,6 @@ id: 30874d4f-20a1-488f-85ec-5d52ef74e3f9 version: 2 date: '2018-05-31' author: Bhavin Patel, Splunk -type: batch description: Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative: Maintaining persistence is one of the first steps taken by attackers after diff --git a/stories/windows_privilege_escalation.yml b/stories/windows_privilege_escalation.yml index ebc3787d94..667e7ba4ee 100644 --- a/stories/windows_privilege_escalation.yml +++ b/stories/windows_privilege_escalation.yml @@ -3,7 +3,6 @@ id: 644e22d3-598a-429c-a007-16fdb802cae5 version: 2 date: '2020-02-04' author: David Dorsey, Splunk -type: batch description: Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. diff --git a/stories/windows_service_abuse.yml b/stories/windows_service_abuse.yml index 1baa5e434c..118852aeee 100644 --- a/stories/windows_service_abuse.yml +++ b/stories/windows_service_abuse.yml @@ -3,7 +3,6 @@ id: 6dbd810e-f66d-414b-8dfc-e46de55cbfe2 version: 3 date: '2017-11-02' author: Rico Valdez, Splunk -type: batch description: Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are diff --git a/stories/xmrig.yml b/stories/xmrig.yml index 2c5f1b30eb..2ee5eb1781 100644 --- a/stories/xmrig.yml +++ b/stories/xmrig.yml @@ -3,7 +3,6 @@ id: 06723e6a-6bd8-4817-ace2-5fb8a7b06628 version: 1 date: '2021-05-07' author: Teoderick Contreras, Rod Soto Splunk -type: batch description: Leverage searches that allow you to detect and investigate unusual activities that might relate to the xmrig monero, including looking for file writes associated with its payload, process command-line, defense evasion (killing services, deleting users, modifying files or folder permission, killing other malware or other coin miner) From 21f8ef2990134b8d62d1de4e9304d7fe527118d9 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 21 Jul 2021 12:41:06 +0200 Subject: [PATCH 12/21] updated stories --- bin/generate.py | 2 +- dist/escu/default/analytic_stories.conf | 39 ++- dist/escu/default/collections.conf | 2 +- dist/escu/default/es_investigations.conf | 14 + dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 339 +++++------------------ dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 27 +- 8 files changed, 155 insertions(+), 272 deletions(-) diff --git a/bin/generate.py b/bin/generate.py index bd78d11921..5ae10636bd 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -584,7 +584,7 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH): # only use ESCU detections to the configurations objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name']) # only use ESCU stories to the configuration - objects["stories"] = sorted(filter(lambda s: s['type'].lower() == 'batch', objects["stories"]), key=lambda s: s['name']) + objects["stories"] = sorted(filter(lambda s: not 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name']) objects["response_tasks"] = sorted(objects["response_tasks"], key=lambda i: i['name']) objects["macros"] = sorted(objects["macros"], key=lambda m: m['name']) diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index b879113292..dbbce93190 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T07:45:07 UTC +# On Date: 2021-07-21T10:40:21 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1336,6 +1336,26 @@ description = Leveraging the Windows command-line interface (CLI) is one of the narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] +[Suspicious Compiled HTML Activity] +category = Adversary Tactics +creation_date = 2021-02-11 +modification_date = 2021-02-11 +id = a09db4d1-3827-4833-87b8-3a397e532119 +version = 1 +reference = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"] +detection_searches = ["ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule"] +mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.001"], "nist": ["DE.CM", "PR.PT"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ +HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ +During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ +Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. +product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] + [Suspicious DNS Traffic] category = Adversary Tactics creation_date = 2017-09-18 @@ -1439,6 +1459,23 @@ While SSO is a major convenience for users, it also provides attackers with an o With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] +[Suspicious Regsvcs Regasm Activity] +category = Adversary Tactics +creation_date = 2021-02-11 +modification_date = 2021-02-11 +id = 2cdf33a0-4805-4b61-b025-59c20f418fbe +version = 1 +reference = ["https://attack.mitre.org/techniques/T1218/009/", "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"] +detection_searches = ["ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule"] +mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1218.009"], "nist": ["DE.CM", "PR.PT"]} +investigative_searches = [] +support_searches = [] +data_models = ["Endpoint"] +providing_technologies = none +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. +product = ['Splunk Enterprise', 'Splunk Enterprise Security', 'Splunk Cloud'] + [Suspicious Regsvr32 Activity] category = Adversary Tactics creation_date = 2021-01-29 diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 9d278c1a6c..21ac1dbc12 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T07:45:06 UTC +# On Date: 2021-07-21T10:40:21 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index db760d9656..ca2fb6e15f 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -482,6 +482,13 @@ disabled = 0 panels = ["panel://workbench_panel_get_notable_history___response_task", "panel://workbench_panel_get_parent_process_info___response_task", "panel://workbench_panel_get_process_info___response_task"] +[panel_group://workbench_panel_group_suspicious_compiled_html_activity] +label = Suspicious Compiled HTML Activity +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + [panel_group://workbench_panel_group_suspicious_dns_traffic] label = Suspicious DNS Traffic description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. @@ -517,6 +524,13 @@ disabled = 0 panels = ["panel://workbench_panel_investigate_okta_activity_by_ip_address___response_task", "panel://workbench_panel_investigate_okta_activity_by_app___response_task", "panel://workbench_panel_investigate_user_activities_in_okta___response_task"] +[panel_group://workbench_panel_group_suspicious_regsvcs_regasm_activity] +label = Suspicious Regsvcs Regasm Activity +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +disabled = 0 + +panels = ["panel://workbench_panel_get_notable_history___response_task"] + [panel_group://workbench_panel_group_suspicious_regsvr32_activity] label = Suspicious Regsvr32 Activity description = Monitor and detect techniques used by attackers who leverage the regsvr32.exe process to execute malicious code. diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 485d8f5b8d..be4ff23cfc 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T07:45:07 UTC +# On Date: 2021-07-21T10:40:21 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index ecf25d610a..1580a7340c 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T07:45:06 UTC +# On Date: 2021-07-21T10:40:21 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1435,19 +1435,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Monitor for Unauthorized Software", "SamSam Ransomware"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Deprecated - Add Prohibited Processes to Enterprise Security - Rule action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Monitor for Unauthorized Software", "SamSam Ransomware"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. -action.notable.param.rule_title = Add Prohibited Processes to Enterprise Security -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2403,18 +2397,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline of API Calls per User ARN - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.notable.param.rule_title = Baseline of API Calls per User ARN -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2443,19 +2432,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline of Command Line Length - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'dest'] -action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. -action.notable.param.rule_title = Baseline of Command Line Length - MLTK -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2484,18 +2467,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline of DNS Query Length - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. -action.notable.param.rule_title = Baseline of DNS Query Length - MLTK -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2526,19 +2504,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. -action.notable.param.rule_title = Baseline of Excessive AWS Instances Launched by User - MLTK -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2569,19 +2541,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS EC2 Activities"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. -action.notable.param.rule_title = Baseline of Excessive AWS Instances Terminated by User - MLTK -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2610,18 +2576,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline of Network ACL Activity by ARN - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.notable.param.rule_title = Baseline of Network ACL Activity by ARN -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2650,18 +2611,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline of S3 Bucket deletion activity by ARN - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.notable.param.rule_title = Baseline of S3 Bucket deletion activity by ARN -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2690,19 +2646,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline of SMB Traffic - MLTK - Rule action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['src'] -action.notable.param.rule_description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. -action.notable.param.rule_title = Baseline of SMB Traffic - MLTK -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2731,18 +2681,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline of Security Group Activity by ARN - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.notable.param.rule_title = Baseline of Security Group Activity by ARN -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -2771,18 +2716,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Baseline of blocked outbound traffic from AWS - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. -action.notable.param.rule_title = Baseline of blocked outbound traffic from AWS -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4037,18 +3977,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = [] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Count of Unique IPs Connecting to Ports - Rule action.correlationsearch.annotations = {} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. -action.notable.param.rule_title = Count of Unique IPs Connecting to Ports -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4077,18 +4012,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Asset Tracking"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Count of assets by category - Rule action.correlationsearch.annotations = {"analytic_story": ["Asset Tracking"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search shows you every asset category you have and the assets that belong to those categories. -action.notable.param.rule_title = Count of assets by category -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4213,18 +4143,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Create a list of approved AWS service accounts - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. -action.notable.param.rule_title = Create a list of approved AWS service accounts -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -4865,18 +4790,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - DNSTwist Domain Names - Rule action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring", "Suspicious Emails"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. -action.notable.param.rule_title = DNSTwist Domain Names -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -10194,18 +10114,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DNS Hijacking"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Discover DNS records - Rule action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup -action.notable.param.rule_title = Discover DNS records -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -12730,19 +12645,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = [] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Identify Systems Creating Remote Desktop Traffic - Rule action.correlationsearch.annotations = {} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['src'] -action.notable.param.rule_description = This search counts the numbers of times the system has generated remote desktop traffic. -action.notable.param.rule_title = Identify Systems Creating Remote Desktop Traffic -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -12771,19 +12680,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = [] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Identify Systems Receiving Remote Desktop Traffic - Rule action.correlationsearch.annotations = {} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search counts the numbers of times the system has created remote desktop traffic -action.notable.param.rule_title = Identify Systems Receiving Remote Desktop Traffic -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -12812,19 +12715,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = [] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Identify Systems Using Remote Desktop - Rule action.correlationsearch.annotations = {} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. -action.notable.param.rule_title = Identify Systems Using Remote Desktop -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -14347,19 +14244,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Monitor Backup Solution"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Monitor Successful Backups - Rule action.correlationsearch.annotations = {"analytic_story": ["Monitor Backup Solution"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. -action.notable.param.rule_title = Monitor Successful Backups -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -14388,19 +14279,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Monitor Backup Solution"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Monitor Unsuccessful Backups - Rule action.correlationsearch.annotations = {"analytic_story": ["Monitor Backup Solution"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['dest'] -action.notable.param.rule_description = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. -action.notable.param.rule_title = Monitor Unsuccessful Backups -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -17096,18 +16981,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cross Account Activity"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen AWS Cross Account Activity - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cross Account Activity"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.notable.param.rule_title = Previously Seen AWS Cross Account Activity -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -17206,18 +17086,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen AWS Provisioning Activity Sources - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. -action.notable.param.rule_title = Previously Seen AWS Provisioning Activity Sources -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -17246,18 +17121,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen AWS Regions - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days -action.notable.param.rule_title = Previously Seen AWS Regions -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -17776,18 +17646,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen EC2 AMIs - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search builds a table of previously seen AMIs used to launch EC2 instances -action.notable.param.rule_title = Previously Seen EC2 AMIs -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -17816,18 +17681,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen EC2 Instance Types - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search builds a table of previously seen EC2 instance types -action.notable.param.rule_title = Previously Seen EC2 Instance Types -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -17856,18 +17716,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen EC2 Launches By User - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search builds a table of previously seen ARNs that have launched a EC2 instance. -action.notable.param.rule_title = Previously Seen EC2 Launches By User -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -17896,19 +17751,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Unusual AWS EC2 Modifications"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously Seen EC2 Modifications By User - Rule action.correlationsearch.annotations = {"analytic_story": ["Unusual AWS EC2 Modifications"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user'] -action.notable.param.rule_description = This search builds a table of previously seen ARNs that have launched a EC2 instance. -action.notable.param.rule_title = Previously Seen EC2 Modifications By User -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -18147,18 +17996,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["AWS User Monitoring"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously seen API call per user roles in CloudTrail - Rule action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. -action.notable.param.rule_title = Previously seen API call per user roles in CloudTrail -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -18187,18 +18031,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS S3 Activities"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously seen S3 bucket access by remote IP - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" -action.notable.param.rule_title = Previously seen S3 bucket access by remote IP -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -18227,18 +18066,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously seen command line arguments - Rule action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. -action.notable.param.rule_title = Previously seen command line arguments -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -18267,19 +18101,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Previously seen users in CloudTrail - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'src'] -action.notable.param.rule_description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -action.notable.param.rule_title = Previously seen users in CloudTrail -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -23084,18 +22912,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Spectre And Meltdown Vulnerabilities"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Systems Ready for Spectre-Meltdown Windows Patch - Rule action.correlationsearch.annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"]} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. -action.notable.param.rule_title = Systems Ready for Spectre-Meltdown Windows Patch -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -23659,19 +23482,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = ["Suspicious AWS Login Activities"] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Update previously seen users in CloudTrail - Rule action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"]} schedule_window = auto -action.notable = 1 -action.notable.param.nes_fields = ['user', 'src'] -action.notable.param.rule_description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -action.notable.param.rule_title = Update previously seen users in CloudTrail -action.notable.param.security_domain = network -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -24683,18 +24500,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = [] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows Updates Install Failures - Rule action.correlationsearch.annotations = {} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. -action.notable.param.rule_title = Windows Updates Install Failures -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 @@ -24723,18 +24535,13 @@ action.escu.search_type = support action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] action.escu.providing_technologies = [] action.escu.analytic_story = [] -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m +cron_schedule = 10 0 * * * +dispatch.earliest_time = -1450m@m dispatch.latest_time = -10m@m action.correlationsearch.enabled = 1 action.correlationsearch.label = ESCU - Windows Updates Install Successes - Rule action.correlationsearch.annotations = {} schedule_window = auto -action.notable = 1 -action.notable.param.rule_description = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. -action.notable.param.rule_title = Windows Updates Install Successes -action.notable.param.security_domain = endpoint -action.notable.param.severity = high alert.digest_mode = 1 disabled = true enableSched = 1 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index f39333a340..32df446f25 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T07:45:06 UTC +# On Date: 2021-07-21T10:40:21 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index cd501b9f27..04dcc3fe45 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T07:45:07 UTC +# On Date: 2021-07-21T10:40:21 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -922,6 +922,20 @@ searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ES description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. +[analytic_story://Suspicious Compiled HTML Activity] +category = Adversary Tactics +last_updated = 2021-02-11 +version = 1 +references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://attack.mitre.org/techniques/T1218/001/", "https://docs.microsoft.com/en-us/windows/win32/api/htmlhelp/nf-htmlhelp-htmlhelpa"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Detect HTML Help Renamed - Rule", "ESCU - Detect HTML Help Spawn Child Process - Rule", "ESCU - Detect HTML Help URL in Command Line - Rule", "ESCU - Detect HTML Help Using InfoTech Storage Handlers - Rule"] +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Compiled HTML files (.chm) to conceal malicious code. CHM files are commonly distributed as part of the Microsoft HTML Help system. CHM files are compressed compilations of various content such as HTML documents, images, and scripting/web related programming languages such VBA, JScript, Java, and ActiveX. CHM content is displayed using underlying components of the Internet Explorer browser loaded by the HTML Help executable program (hh.exe). \ +HH.exe relies upon hhctrl.ocx to load CHM topics.This will load upon execution of a chm file. \ +During investigation, review all parallel processes and child processes. It is possible for file modification events to occur and it is best to capture the CHM file and decompile it for further analysis. \ +Upon usage of InfoTech Storage Handlers, ms-its, its, mk, itss.dll will load. + [analytic_story://Suspicious DNS Traffic] category = Adversary Tactics last_updated = 2017-09-18 @@ -995,6 +1009,17 @@ narrative = Okta is the leading single sign on (SSO) provider, allowing users to While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ With people moving quickly to adopt web-based applications and ways to manage them, many are still struggling to understand how best to monitor these environments. This analytic story provides searches to help monitor this environment, and identify events and activity that warrant further investigation such as credential stuffing or password spraying attacks, and users logging in from multiple locations when travel is disallowed. +[analytic_story://Suspicious Regsvcs Regasm Activity] +category = Adversary Tactics +last_updated = 2021-02-11 +version = 1 +references = ["https://attack.mitre.org/techniques/T1218/009/", "https://github.com/rapid7/metasploit-framework/blob/master/documentation/modules/evasion/windows/applocker_evasion_regasm_regsvcs.md", "https://oddvar.moe/2017/12/13/applocker-case-study-how-insecure-is-it-really-part-1/"] +maintainers = [{"company": "Splunk", "email": "-", "name": "Michael Haag"}] +spec_version = 3 +searches = ["ESCU - Detect Regasm Spawning a Process - Rule", "ESCU - Detect Regasm with Network Connection - Rule", "ESCU - Detect Regasm with no Command Line Arguments - Rule", "ESCU - Detect Regsvcs Spawning a Process - Rule", "ESCU - Detect Regsvcs with Network Connection - Rule", "ESCU - Detect Regsvcs with No Command Line Arguments - Rule"] +description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. +narrative = Adversaries may abuse Regsvcs and Regasm to proxy execution of code through a trusted Windows utility. Regsvcs and Regasm are Windows command-line utilities that are used to register .NET Component Object Model (COM) assemblies. Both are digitally signed by Microsoft. The following queries assist with detecting suspicious and malicious usage of Regasm.exe and Regsvcs.exe. Upon reviewing usage of Regasm.exe Regsvcs.exe, review file modification events for possible script code written. Review parallel process events for csc.exe being utilized to compile script code. + [analytic_story://Suspicious Regsvr32 Activity] category = Adversary Tactics last_updated = 2021-01-29 From 618e2fbf21c312c439c854b097a5eda520a6cd82 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 21 Jul 2021 15:32:25 +0200 Subject: [PATCH 13/21] test circleci --- .circleci/config.yml | 40 +++++++++++++++++------- bin/create_baseline_folder.py | 52 +++++++++++++++++++++++++++++++ bin/reporting.py | 12 ++++--- bin/reporting/detection_count.svg | 2 +- 4 files changed, 89 insertions(+), 17 deletions(-) create mode 100644 bin/create_baseline_folder.py diff --git a/.circleci/config.yml b/.circleci/config.yml index 90855706c6..d107a952be 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -365,22 +365,40 @@ jobs: git clone --branch ${CIRCLE_BRANCH} https://${GITHUB_TOKEN}@github.com/splunk/security-content.git fi - run: *apt-install + - run: + name: install python dependencies + command: | + cd security-content + rm -rf venv + virtualenv --python=/usr/bin/python3 --clear venv + source venv/bin/activate + pip install -q -r requirements.txt + - save_cache: + key: virtualenv + paths: + - "/security-content/venv" + - run: + name: create baseline folder + command: | + cd security-content + source venv/bin/activate + python bin/create_baseline_folder.py - aws-cli/setup: profile-name: default - run: name: update api sources command: | cd security-content - aws s3 rm s3://security-content --recursive --exclude "*" --include "*.yml" - aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml" - aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml" - aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml" - aws s3 cp response_tasks s3://security-content/response_tasks --recursive --exclude "*" --include "*.yml" - aws s3 cp responses s3://security-content/responses --recursive --exclude "*" --include "*.yml" - aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.yml" - aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv" - aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml" - aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml" + aws s3 rm s3://security-content-tmp --recursive --exclude "*" --include "*.yml" + aws s3 cp stories s3://security-content-tmp/stories --recursive --exclude "*" --include "*.yml" + aws s3 cp baselines s3://security-content-tmp/baselines --recursive --exclude "*" --include "*.yml" + aws s3 cp detections s3://security-content-tmp/detections --recursive --exclude "*" --include "*.yml" + aws s3 cp response_tasks s3://security-content-tmp/response_tasks --recursive --exclude "*" --include "*.yml" + aws s3 cp responses s3://security-content-tmp/responses --recursive --exclude "*" --include "*.yml" + aws s3 cp lookups s3://security-content-tmp/lookups --recursive --exclude "*" --include "*.yml" + aws s3 cp lookups s3://security-content-tmp/lookups --recursive --exclude "*" --include "*.csv" + aws s3 cp macros s3://security-content-tmp/macros --recursive --exclude "*" --include "*.yml" + aws s3 cp deployments s3://security-content-tmp/deployments --recursive --exclude "*" --include "*.yml" - run: name: security content api smoke test command: | @@ -574,8 +592,6 @@ workflows: filters: tags: only: /^v.*/ - branches: - ignore: /.*/ detection-testing: jobs: diff --git a/bin/create_baseline_folder.py b/bin/create_baseline_folder.py new file mode 100644 index 0000000000..4ee38ef7a8 --- /dev/null +++ b/bin/create_baseline_folder.py @@ -0,0 +1,52 @@ +#!/usr/bin/python + +import glob +import yaml +import os +from os import path +import sys + + +def load_objects(file_path, REPO_PATH): + files = [] + manifest_files = path.join(path.expanduser(REPO_PATH), file_path) + for file in sorted(glob.glob(manifest_files)): + files.append(load_file(file)) + return files + + +def load_file(file_path): + with open(file_path, 'r', encoding="utf-8") as stream: + try: + file = list(yaml.safe_load_all(stream))[0] + except yaml.YAMLError as exc: + print(exc) + sys.exit("ERROR: reading {0}".format(file_path)) + return file + + +def main(args): + print("copy baselines into it's own folder") + + # process all detections + REPO_PATH = os.path.join(os.path.dirname(__file__), '../') + detections = [] + detections = load_objects("detections/application/*.yml", REPO_PATH) + detections.extend(load_objects("detections/cloud/*.yml", REPO_PATH)) + detections.extend(load_objects("detections/endpoint/*.yml", REPO_PATH)) + detections.extend(load_objects("detections/network/*.yml", REPO_PATH)) + detections.extend(load_objects("detections/web/*.yml", REPO_PATH)) + + baselines = [] + os.mkdir('baselines') + + for detection in detections: + if detection['type'] == 'Baseline': + baseline_file_name = detection['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower() + file = open("baselines/" + baseline_file_name + ".yml", "w") + yaml.dump(detection, file) + file.close() + + +if __name__ == "__main__": + main(sys.argv[1:]) \ No newline at end of file diff --git a/bin/reporting.py b/bin/reporting.py index 189f932470..8280aa4c1d 100644 --- a/bin/reporting.py +++ b/bin/reporting.py @@ -47,22 +47,26 @@ def main(args): # detections_all.extend(load_objects("detections/deprecated/*.yml", REPO_PATH)) # detections_all.extend(load_objects("detections/experimental/*/*.yml", REPO_PATH)) count_detections_all = len(detections_all) - print("detection count: {}".format(count_detections_all)) tests = load_objects("tests/*/*.yml", REPO_PATH) - print("test count: {}".format(len(tests))) counter_tests=0 counter_detection=0 for detection in detections: - counter_detection=counter_detection+1 + if detection['type'] != 'Baseline': + counter_detection=counter_detection+1 for test in tests: counter_tests=counter_tests+1 - detection_coverage = "{:.0%}".format(counter_detection/counter_tests) + detection_coverage_tmp = counter_detection/counter_tests + if detection_coverage_tmp > 1: + detection_coverage_tmp = 1 + detection_coverage = "{:.0%}".format(detection_coverage_tmp) + print("detection count: {}".format(counter_detection)) + print("test count: {}".format(counter_tests)) print("detection_coverage {}".format(detection_coverage)) TEMPLATE_PATH = os.path.join(os.path.dirname(__file__), 'jinja2_templates') diff --git a/bin/reporting/detection_count.svg b/bin/reporting/detection_count.svg index 34dd27b7c5..13cc1e0941 100644 --- a/bin/reporting/detection_count.svg +++ b/bin/reporting/detection_count.svg @@ -13,6 +13,6 @@ detections - 368 + 458 \ No newline at end of file From ca8565c0346f4ed02a90873761f7e7d90f3c40d4 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 21 Jul 2021 16:09:28 +0200 Subject: [PATCH 14/21] test circleci --- .circleci/config.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index d107a952be..4635af2e1f 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -11,7 +11,7 @@ version: 2.1 orbs: - aws-cli: circleci/aws-cli@0.1.19 + aws-cli: circleci/aws-cli@2.0.3 dependencies: cache_directories: From 8b1e40a5463178d3da05a1a0fa49517561b4bf4c Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 21 Jul 2021 16:21:45 +0200 Subject: [PATCH 15/21] update type --- .../endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml | 2 +- detections/endpoint/net_profiler_uac_bypass.yml | 2 +- detections/endpoint/office_product_spawn_cmd_process.yml | 2 +- detections/endpoint/sdclt_uac_bypass.yml | 2 +- detections/endpoint/silentcleanup_uac_bypass.yml | 2 +- detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml | 2 +- detections/endpoint/wsreset_uac_bypass.yml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 70d2ed0d8e..b83eb213fb 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -3,7 +3,7 @@ id: 4aa5d062-e893-11eb-9eb2-acde48001122 version: 1 date: '2021-07-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index b6c3c29363..d9a4abaa6b 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -3,7 +3,7 @@ id: 0252ca80-e30d-11eb-8aa3-acde48001122 version: 1 date: '2021-07-12' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect modification of registry to bypass UAC windows feature. diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index e2f5457bb2..9a0d1818e9 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -3,7 +3,7 @@ id: b8b19420-e892-11eb-9244-acde48001122 version: 1 date: '2021-07-19' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: this search is to detect a suspicious office product process that spawn cmd child process. diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index f7168f419b..46c40a464f 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -3,7 +3,7 @@ id: d71efbf6-da63-11eb-8c6e-acde48001122 version: 1 date: '2021-07-01' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious sdclt.exe registry modification. diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index 24af016178..c1e2ef750e 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -3,7 +3,7 @@ id: 56d7cfcc-da63-11eb-92d4-acde48001122 version: 1 date: '2021-07-01' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious modification of registry that may related to UAC bypassed. diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml index 6854c70af1..11cec34fd4 100644 --- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml +++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml @@ -3,7 +3,7 @@ id: 7f04349c-e30d-11eb-bc7f-acde48001122 version: 1 date: '2021-07-12' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious loaded unsigned dll by MMC.exe diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index e8af32da9d..f527f9de21 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -3,7 +3,7 @@ id: 8b5901bc-da63-11eb-be43-acde48001122 version: 1 date: '2021-07-01' author: Teoderick Contreras, Splunk -type: batch +type: TTP datamodel: - Endpoint description: This search is to detect a suspicious modification of registry related to UAC bypass. From 0c5aeec30ca690476c49d1877a0b2aa7d84244e6 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Wed, 21 Jul 2021 16:38:01 +0200 Subject: [PATCH 16/21] update circle ci --- .circleci/config.yml | 22 ++++++++++++---------- 1 file changed, 12 insertions(+), 10 deletions(-) diff --git a/.circleci/config.yml b/.circleci/config.yml index 4635af2e1f..496844116d 100644 --- a/.circleci/config.yml +++ b/.circleci/config.yml @@ -389,16 +389,16 @@ jobs: name: update api sources command: | cd security-content - aws s3 rm s3://security-content-tmp --recursive --exclude "*" --include "*.yml" - aws s3 cp stories s3://security-content-tmp/stories --recursive --exclude "*" --include "*.yml" - aws s3 cp baselines s3://security-content-tmp/baselines --recursive --exclude "*" --include "*.yml" - aws s3 cp detections s3://security-content-tmp/detections --recursive --exclude "*" --include "*.yml" - aws s3 cp response_tasks s3://security-content-tmp/response_tasks --recursive --exclude "*" --include "*.yml" - aws s3 cp responses s3://security-content-tmp/responses --recursive --exclude "*" --include "*.yml" - aws s3 cp lookups s3://security-content-tmp/lookups --recursive --exclude "*" --include "*.yml" - aws s3 cp lookups s3://security-content-tmp/lookups --recursive --exclude "*" --include "*.csv" - aws s3 cp macros s3://security-content-tmp/macros --recursive --exclude "*" --include "*.yml" - aws s3 cp deployments s3://security-content-tmp/deployments --recursive --exclude "*" --include "*.yml" + aws s3 rm s3://security-content --recursive --exclude "*" --include "*.yml" + aws s3 cp stories s3://security-content/stories --recursive --exclude "*" --include "*.yml" + aws s3 cp baselines s3://security-content/baselines --recursive --exclude "*" --include "*.yml" + aws s3 cp detections s3://security-content/detections --recursive --exclude "*" --include "*.yml" + aws s3 cp response_tasks s3://security-content/response_tasks --recursive --exclude "*" --include "*.yml" + aws s3 cp responses s3://security-content/responses --recursive --exclude "*" --include "*.yml" + aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.yml" + aws s3 cp lookups s3://security-content/lookups --recursive --exclude "*" --include "*.csv" + aws s3 cp macros s3://security-content/macros --recursive --exclude "*" --include "*.yml" + aws s3 cp deployments s3://security-content/deployments --recursive --exclude "*" --include "*.yml" - run: name: security content api smoke test command: | @@ -592,6 +592,8 @@ workflows: filters: tags: only: /^v.*/ + branches: + ignore: /.*/ detection-testing: jobs: From c69b8c105314dbf84cbf142ba0b3b7c407477240 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Fri, 23 Jul 2021 19:34:01 +0200 Subject: [PATCH 17/21] response tasks into investigations --- bin/jinja2_templates/savedsearches.j2 | 74 +- bin/validate.py | 6 +- .../cloud/detect_shared_ec2_snapshot.yml | 2 +- .../endpoint}/all_backup_logs_for_host.yml | 10 +- ...f_shadowcopy_with_script_block_logging.yml | 2 +- dist/escu/default/analytic_stories.conf | 18 +- dist/escu/default/collections.conf | 2 +- dist/escu/default/macros.conf | 40 +- dist/escu/default/savedsearches.conf | 3893 ++++++++--------- dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 104 +- 11 files changed, 1934 insertions(+), 2219 deletions(-) rename {response_tasks => detections/endpoint}/all_backup_logs_for_host.yml (73%) diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index f6b8641208..ea93a252d1 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -8,13 +8,12 @@ ### ESCU DETECTIONS ### {% for detection in detections %} +{% if (detection.type == 'TTP' or detection.type == 'Anomaly' or detection.type == 'Hunting' or detection.type == 'Correlation') %} [ESCU - {{ detection.name }} - Rule] action.escu = 0 action.escu.enabled = 1 description = {{ detection.description }} -{% if detection.mappings is defined %} action.escu.mappings = {{ detection.mappings | tojson }} -{% endif %} {% if detection.data_model is defined %} action.escu.data_models = [{{ detection.data_model | tojson }}] {% else %} @@ -34,13 +33,8 @@ action.escu.known_false_positives = None action.escu.creation_date = {{ detection.date }} action.escu.modification_date = {{ detection.date }} action.escu.confidence = high -{% if detection.type == "Baseline" %} -action.escu.full_search_name = ESCU - {{ detection.name }} -action.escu.search_type = support -{% else %} -action.escu.full_search_name = ESCU - {{ detection.name }} - Rule +action.escu.full_search_name = ESCU - {{ detection.name }} - Rule action.escu.search_type = detection -{% endif %} {% if detection.product is defined %} action.escu.product = {{ detection.product | tojson }} {% endif %} @@ -68,9 +62,9 @@ dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }} dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }} action.correlationsearch.enabled = 1 {% if detection.deprecated is defined %} -action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule +action.correlationsearch.label = ESCU - Deprecated - {{ detection.name }} - Rule {% else %} -action.correlationsearch.label = ESCU - {{ detection.name }} - Rule +action.correlationsearch.label = ESCU - {{ detection.name }} - Rule {% endif %} action.correlationsearch.annotations = {{ detection.savedsearch_annotations | tojson }} {% if detection.deployment.scheduling.schedule_window is defined %} @@ -80,11 +74,11 @@ schedule_window = {{ detection.deployment.scheduling.schedule_window }} {% if detection.deployment.alert_action.notable is defined %} action.notable = 1 {% if detection.nes_fields is defined %} -action.notable.param.nes_fields = {{ detection.nes_fields }} +action.notable.param.nes_fields = {{ detection.nes_fields }} {% endif %} action.notable.param.rule_description = {{ detection.deployment.alert_action.notable.rule_description | custom_jinja2_enrichment_filter(detection) }} action.notable.param.rule_title = {{ detection.deployment.alert_action.notable.rule_title | custom_jinja2_enrichment_filter(detection) }} -action.notable.param.security_domain = {{ detection.tags.security_domain }} +action.notable.param.security_domain = {{ detection.tags.security_domain }} action.notable.param.severity = high {% endif %} {% if detection.deployment.alert_action.email is defined %} @@ -107,12 +101,65 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = {{ detection.search }} +search = {{ detection.search }} +{% endif %} {% endfor %} ### END ESCU DETECTIONS ### +### ESCU BASELINES ### + +{% for detection in detections %} +{% if (detection.type == 'Baseline') %} +[ESCU - {{ detection.name }}] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - {{ detection.name }} +description = {{ detection.description }} +action.escu.creation_date = {{ detection.date }} +action.escu.modification_date = {{ detection.date }} +{% if detection.tags.analytic_story is defined %} +action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }} +{% else %} +action.escu.analytic_story = [] +{% endif %} +{% if detection.data_model is defined %} +action.escu.data_models = [{{ detection.data_model | tojson }}] +{% else %} +action.escu.data_models = [] +{% endif %} +cron_schedule = {{ detection.deployment.scheduling.cron_schedule }} +enableSched = 1 +dispatch.earliest_time = {{ detection.deployment.scheduling.earliest_time }} +dispatch.latest_time = {{ detection.deployment.scheduling.latest_time }} +{% if detection.deployment.scheduling.schedule_window is defined %} +schedule_window = {{ detection.deployment.scheduling.schedule_window }} +{% endif %} +{% if detection.providing_technologies is defined %} +action.escu.providing_technologies = {{ detection.providing_technologies | tojson }} +{% else %} +action.escu.providing_technologies = [] +{% endif %} +action.escu.eli5 = {{ detection.description }} +{% if detection.how_to_implement is defined %} +action.escu.how_to_implement = {{ detection.how_to_implement }} +{% else %} +action.escu.how_to_implement = none +{% endif %} +{% if detection.disabled is defined %} +disabled = false +{% else %} +disabled = true +{% endif %} +is_visible = false +search = {{ detection.search }} + +{% endif %} +{% endfor %} + + ### ESCU RESPONSE TASKS ### {% for response_task in response_tasks %} @@ -223,3 +270,4 @@ search = index=_audit sourcetype="audittrail" \ | table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=* ### END OF USAGE DASHBOARD CONFIGURATIONS ### + diff --git a/bin/validate.py b/bin/validate.py index e68a772f34..987cae2ed9 100644 --- a/bin/validate.py +++ b/bin/validate.py @@ -184,12 +184,12 @@ def validate_standard_fields(object, uuids): def validate_detection_search(object, macros): errors = [] - if not object['type'] == "Baseline": + if not (object['type'] == "Baseline" or object['type'] == "Investigation"): if not '_filter' in object['search']: errors.append("ERROR: Missing filter for detection: " + object['name']) - else: + elif object['type'] == "Baseline": if not 'deployments' in object['tags']: - errors.append("ERROR: Baseline need a ccorresponsing deployments: " + object['name']) + errors.append("ERROR: Baseline need a corresponsing deployments: " + object['name']) filter_macro = re.search("([a-z0-9_]*_filter)", object['search']) diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml index 2fb3c3312a..3c29b3d140 100644 --- a/detections/cloud/detect_shared_ec2_snapshot.yml +++ b/detections/cloud/detect_shared_ec2_snapshot.yml @@ -3,7 +3,7 @@ id: 2a9b80d3-6340-4345-b5ad-290bf3d222c4 version: 2 date: '2021-07-20' author: Bhavin Patel, Splunk -type: batch +type: TTP datamodel: [] description: The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. diff --git a/response_tasks/all_backup_logs_for_host.yml b/detections/endpoint/all_backup_logs_for_host.yml similarity index 73% rename from response_tasks/all_backup_logs_for_host.yml rename to detections/endpoint/all_backup_logs_for_host.yml index 749a281a18..074fbae981 100644 --- a/response_tasks/all_backup_logs_for_host.yml +++ b/detections/endpoint/all_backup_logs_for_host.yml @@ -1,4 +1,5 @@ author: Rico Valdez, Splunk +datamodel: [] date: '2017-09-12' description: Retrieve the backup logs for the last 2 weeks for a specific host in order to investigate why backups are not completing successfully. @@ -7,12 +8,17 @@ how_to_implement: The successfully implement this search you must first send you id: bc91a8cf-aaaa-4bb2-8140-e756cc06fd72 inputs: - dest +known_false_positives: none name: All backup logs for host -search: '| search sourcetype="netbackup_logs" dest=$dest$' +search: '| search `netbackup` dest=$dest$' tags: analytic_story: - Monitor Backup Solution product: - Splunk Phantom -type: response + required_fields: + - _time + - dest + security_domain: endpoint +type: Investigation version: 1 diff --git a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml index 7ecacf0b50..0ff45e8e49 100644 --- a/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml +++ b/detections/endpoint/detect_copy_of_shadowcopy_with_script_block_logging.yml @@ -3,7 +3,7 @@ id: 9251299c-ea5b-11eb-a8de-acde48001122 version: 1 date: '2021-07-21' author: Michael Haag, Splunk -type: batch +type: TTP datamodel: [] description: 'The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index dbbce93190..2f775cd27f 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T10:40:21 UTC +# On Date: 2021-07-23T08:46:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -377,7 +377,7 @@ modification_date = 2020-02-04 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] -detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] +detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] support_searches = [] @@ -476,8 +476,8 @@ modification_date = 2020-10-21 id = 66b0fe0c-1351-11eb-adc1-0242ac120002 version = 1 reference = ["https://attack.mitre.org/tactics/TA0010/"] -detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"] -mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1041", "T1048", "T1048.003", "T1114", "T1114.001", "T1114.003"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS"]} +detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"] +mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1041", "T1048", "T1048.003", "T1114", "T1114.001", "T1114.003", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] data_models = ["Endpoint"] @@ -1273,8 +1273,8 @@ modification_date = 2020-08-25 id = 8168ca88-392e-42f4-85a2-767579c660ce version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] -detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule"] -mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} +detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule"] +mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"] data_models = ["Change"] @@ -1571,8 +1571,8 @@ modification_date = 2021-04-20 id = 16f93769-8342-44c0-9b1d-f131937cce8e version = 1 reference = ["https://en.wikipedia.org/wiki/Trickbot", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"] -detection_searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"] -mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Lateral Movement", "Reconnaissance"], "mitre_attack": ["T1021.002", "T1027", "T1053", "T1055", "T1059", "T1087.002", "T1218.011", "T1562.001", "T1566.001", "T1590.005"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} +detection_searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"] +mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Lateral Movement", "Reconnaissance"], "mitre_attack": ["T1021.002", "T1027", "T1053", "T1055", "T1059", "T1087.002", "T1218.005", "T1218.011", "T1562.001", "T1566.001", "T1590.005"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = [] support_searches = [] data_models = ["Endpoint"] @@ -1689,7 +1689,7 @@ modification_date = 2018-05-31 id = 56e24a28-5003-4047-b2db-e8f3c4618064 version = 1 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"] -detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] +detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 21ac1dbc12..d2a10ea65c 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T10:40:21 UTC +# On Date: 2021-07-23T08:46:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index be4ff23cfc..2202c7f443 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T10:40:21 UTC +# On Date: 2021-07-23T08:46:11 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -143,7 +143,7 @@ definition = eventtype="osquery-process" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [powershell] -definition = sourcetype=wineventlog OR source=WinEventLog:Microsoft-Windows-PowerShell/Operational +definition = (source=WinEventLog:Microsoft-Windows-PowerShell/Operational OR source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational") description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. [previously_seen_cloud_api_calls_per_user_role_forget_window] @@ -815,6 +815,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_copy_of_shadowcopy_with_script_block_logging_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_credential_dumping_through_lsass_access_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1123,6 +1127,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[detect_shared_ec2_snapshot_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [detect_web_traffic_to_dynamic_domain_providers_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1591,6 +1599,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[mshta_spawning_rundll32_or_regsvr32_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [msmpeng_application_dll_side_loading_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1635,6 +1647,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[net_profiler_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [nltest_domain_trust_discovery_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1715,6 +1731,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[office_product_spawn_cmd_process_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [office_product_spawning_bitsadmin_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2147,6 +2167,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[sdclt_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [searchprotocolhost_with_no_command_line_with_network_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2175,6 +2199,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[silentcleanup_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [single_letter_process_on_endpoint_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2371,6 +2399,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[uac_bypass_mmc_load_unsigned_dll_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [usn_journal_deletion_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -2439,6 +2471,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[wsreset_uac_bypass_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [wbemprox_com_object_execution_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 1580a7340c..58c0ba6504 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T10:40:21 UTC +# On Date: 2021-07-23T08:46:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -1418,41 +1418,6 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Processes.process) as process values(Processes.parent_process) as parent_process values(Processes.process_id) as process_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name="net.exe" OR Processes.process_name="net1.exe" AND (Processes.process="*user*" OR Processes.process="*config*" OR Processes.process="*view /all*") by Processes.process_name Processes.dest Processes.user Processes.parent_process_name | where count >=5 | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `account_discovery_with_net_app_filter` -[ESCU - Add Prohibited Processes to Enterprise Security - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. -action.escu.how_to_implement = This search should be run on each new install of ESCU. -action.escu.known_false_positives = none -action.escu.creation_date = 2017-09-15 -action.escu.modification_date = 2017-09-15 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Add Prohibited Processes to Enterprise Security -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Monitor for Unauthorized Software", "SamSam Ransomware"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Deprecated - Add Prohibited Processes to Enterprise Security - Rule -action.correlationsearch.annotations = {"analytic_story": ["Emotet Malware DHS Report TA18-201A ", "Monitor for Unauthorized Software", "SamSam Ransomware"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | inputlookup prohibited_processes | search note!=ESCU* | inputlookup append=T prohibited_processes | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup prohibited_processes | stats count - [ESCU - Allow File And Printing Sharing In Firewall - Rule] action.escu = 0 action.escu.enabled = 1 @@ -2238,502 +2203,6 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=bitsadmin.exe Processes.process=*transfer* by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `bitsadmin_download_file_filter` -[ESCU - Baseline Of Cloud Infrastructure API Calls Per User - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-09-07 -action.escu.modification_date = 2020-09-07 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline Of Cloud Infrastructure API Calls Per User -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -cron_schedule = 0 2 * * 0 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline Of Cloud Infrastructure API Calls Per User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true - -[ESCU - Baseline Of Cloud Instances Destroyed - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. -action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-08-25 -action.escu.modification_date = 2020-08-25 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Destroyed -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"] -cron_schedule = 0 2 * * 0 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline Of Cloud Instances Destroyed - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true - -[ESCU - Baseline Of Cloud Instances Launched - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-08-14 -action.escu.modification_date = 2020-08-14 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Launched -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] -cron_schedule = 0 2 * * 0 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline Of Cloud Instances Launched - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true - -[ESCU - Baseline Of Cloud Security Group API Calls Per User - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. -action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-09-07 -action.escu.modification_date = 2020-09-07 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline Of Cloud Security Group API Calls Per User -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -cron_schedule = 0 2 * * 0 -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline Of Cloud Security Group API Calls Per User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend | eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true - -[ESCU - Baseline of API Calls per User ARN - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-04-09 -action.escu.modification_date = 2018-04-09 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline of API Calls per User ARN -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS User Monitoring"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline of API Calls per User ARN - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count - -[ESCU - Baseline of Command Line Length - MLTK - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. -action.escu.how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -action.escu.known_false_positives = none -action.escu.creation_date = 2019-05-08 -action.escu.modification_date = 2019-05-08 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline of Command Line Length - MLTK -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline of Command Line Length - MLTK - Rule -action.correlationsearch.annotations = {"analytic_story": ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel - -[ESCU - Baseline of DNS Query Length - MLTK - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. -action.escu.mappings = {} -action.escu.data_models = ["Network_Resolution"] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. -action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -action.escu.known_false_positives = none -action.escu.creation_date = 2019-05-08 -action.escu.modification_date = 2019-05-08 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline of DNS Query Length - MLTK -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline of DNS Query Length - MLTK - Rule -action.correlationsearch.annotations = {"analytic_story": ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel - -[ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ -In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -action.escu.known_false_positives = none -action.escu.creation_date = 2019-11-14 -action.escu.modification_date = 2019-11-14 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_launched by _time src_user | fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1 - -[ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ -In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -action.escu.known_false_positives = none -action.escu.creation_date = 2019-11-14 -action.escu.modification_date = 2019-11-14 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious AWS EC2 Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS EC2 Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_terminated by _time src_user | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1 - -[ESCU - Baseline of Network ACL Activity by ARN - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-05-21 -action.escu.modification_date = 2018-05-21 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline of Network ACL Activity by ARN -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS Network ACL Activity"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline of Network ACL Activity by ARN - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats count - -[ESCU - Baseline of S3 Bucket deletion activity by ARN - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-07-17 -action.escu.modification_date = 2018-07-17 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline of S3 Bucket deletion activity by ARN -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious AWS S3 Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline of S3 Bucket deletion activity by ARN - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count - -[ESCU - Baseline of SMB Traffic - MLTK - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. -action.escu.mappings = {} -action.escu.data_models = ["Network_Traffic"] -action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. -action.escu.how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -action.escu.known_false_positives = none -action.escu.creation_date = 2019-05-08 -action.escu.modification_date = 2019-05-08 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline of SMB Traffic - MLTK -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline of SMB Traffic - MLTK - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction count by "HourOfDay,DayOfWeek" into smb_pdfmodel - -[ESCU - Baseline of Security Group Activity by ARN - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-04-17 -action.escu.modification_date = 2018-04-17 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline of Security Group Activity by ARN -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS User Monitoring"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline of Security Group Activity by ARN - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats count - -[ESCU - Baseline of blocked outbound traffic from AWS - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-05-07 -action.escu.modification_date = 2018-05-07 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Baseline of blocked outbound traffic from AWS -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Baseline of blocked outbound traffic from AWS - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections | stats count - [ESCU - Batch File Write to System32 - Rule] action.escu = 0 action.escu.enabled = 1 @@ -3960,76 +3429,6 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-m local*" OR Processes.process = "*-m net*" OR Processes.process = "*-m all*" OR Processes.process = "*-nomutex*" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `conti_common_exec_parameter_filter` -[ESCU - Count of Unique IPs Connecting to Ports - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. -action.escu.mappings = {} -action.escu.data_models = ["Network_Traffic"] -action.escu.eli5 = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. -action.escu.how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. -action.escu.known_false_positives = none -action.escu.creation_date = 2017-09-13 -action.escu.modification_date = 2017-09-13 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Count of Unique IPs Connecting to Ports -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = [] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Count of Unique IPs Connecting to Ports - Rule -action.correlationsearch.annotations = {} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` | sort - count - -[ESCU - Count of assets by category - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search shows you every asset category you have and the assets that belong to those categories. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search shows you every asset category you have and the assets that belong to those categories. -action.escu.how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. -action.escu.known_false_positives = none -action.escu.creation_date = 2017-09-13 -action.escu.modification_date = 2017-09-13 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Count of assets by category -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Asset Tracking"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Count of assets by category - Rule -action.correlationsearch.annotations = {"analytic_story": ["Asset Tracking"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | from datamodel Identity_Management.All_Assets | stats count values(nt_host) by category | sort -count - [ESCU - Create Remote Thread into LSASS - Rule] action.escu = 0 action.escu.enabled = 1 @@ -4126,41 +3525,6 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_system` EventCode=7045 Service_File_Name = "*\.exe" NOT (Service_File_Name IN ("C:\\Windows\\*", "C:\\Program File*", "C:\\Programdata\\*", "%systemroot%\\*")) Service_Type = "user mode service" | stats count min(_time) as firstTime max(_time) as lastTime by EventCode Service_File_Name Service_Name Service_Start_Type Service_Type | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `create_service_in_suspicious_file_path_filter` -[ESCU - Create a list of approved AWS service accounts - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-12-03 -action.escu.modification_date = 2018-12-03 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Create a list of approved AWS service accounts -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS User Monitoring"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Create a list of approved AWS service accounts - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` errorCode=success | rename userName as identity | search NOT [inputlookup identity_lookup_expanded | fields identity] | stats count by identity | table identity | outputlookup aws_service_accounts | stats count - [ESCU - Create local admin accounts using net exe - Rule] action.escu = 0 action.escu.enabled = 1 @@ -4773,41 +4137,6 @@ realtime_schedule = 0 is_visible = false search = | inputlookup discovered_dns_records | rename answer as discovered_answer | join domain[|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as current_answer values(DNS.src) as src from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query | where query!="unknown" | rex field=query "(?\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer | makemv delim=" " type | sort -count | table count,src,domain,type,query,current_answer,discovered_answer | makemv current_answer | mvexpand current_answer | makemv discovered_answer | eval n=mvfind(discovered_answer, current_answer) | where isnull(n) | `dns_record_changed_filter` -[ESCU - DNSTwist Domain Names - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. -action.escu.how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-10-08 -action.escu.modification_date = 2018-10-08 -action.escu.confidence = high -action.escu.full_search_name = ESCU - DNSTwist Domain Names -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - DNSTwist Domain Names - Rule -action.correlationsearch.annotations = {"analytic_story": ["Brand Monitoring", "Suspicious Emails"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse="true" | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count - [ESCU - DSQuery Domain Discovery - Rule] action.escu = 0 action.escu.enabled = 1 @@ -7520,7 +6849,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe) | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_psexec_filter` +search = `sysmon` EventID=1 (OriginalFileName=psexec.c process_name!=psexec.exe process_name!=PsExec64.exe) | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_psexec_filter` [ESCU - Detect Renamed RClone - Rule] action.escu = 0 @@ -7616,7 +6945,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = `sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_winrar_filter` +search = `sysmon` EventID=1 (Product=WinRAR OR OriginalFileName=WinRAR.exe) process_name!=rar.exe process_name!=winrar.exe | stats count min(_time) as firstTime max(_time) as lastTime by Computer, User, parent_process_name, process_name, OriginalFileName, process_path, CommandLine Product | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_renamed_winrar_filter` [ESCU - Detect Rogue DHCP Server - Rule] action.escu = 0 @@ -10097,41 +9426,6 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System\\DisableTaskMgr" Registry.registry_value_name = "DWORD (0x00000001)" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `disabling_task_manager_filter` -[ESCU - Discover DNS records - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup -action.escu.mappings = {} -action.escu.data_models = ["Network_Resolution"] -action.escu.eli5 = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup -action.escu.how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation -action.escu.known_false_positives = none -action.escu.creation_date = 2019-02-14 -action.escu.modification_date = 2019-02-14 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Discover DNS records -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["DNS Hijacking"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Discover DNS records - Rule -action.correlationsearch.annotations = {"analytic_story": ["DNS Hijacking"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, "\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query | where query!="unknown" | rex field=query "(?\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer | makemv delim=" " type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records - [ESCU - Download Files Using Telegram - Rule] action.escu = 0 action.escu.enabled = 1 @@ -12628,111 +11922,6 @@ realtime_schedule = 0 is_visible = false search = | from datamodel Identity_Management.All_Identities | eval empStatus=case((now()-startDate)<604800, "Accounts created in last week") | search empStatus="Accounts created in last week"| `security_content_ctime(endDate)` | `security_content_ctime(startDate)`| table identity empStatus endDate startDate | `identify_new_user_accounts_filter` -[ESCU - Identify Systems Creating Remote Desktop Traffic - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search counts the numbers of times the system has generated remote desktop traffic. -action.escu.mappings = {} -action.escu.data_models = ["Network_Traffic"] -action.escu.eli5 = This search counts the numbers of times the system has generated remote desktop traffic. -action.escu.how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. -action.escu.known_false_positives = none -action.escu.creation_date = 2017-09-15 -action.escu.modification_date = 2017-09-15 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Identify Systems Creating Remote Desktop Traffic -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = [] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Identify Systems Creating Remote Desktop Traffic - Rule -action.correlationsearch.annotations = {} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.src | `drop_dm_object_name("All_Traffic")` | sort - count - -[ESCU - Identify Systems Receiving Remote Desktop Traffic - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search counts the numbers of times the system has created remote desktop traffic -action.escu.mappings = {} -action.escu.data_models = ["Network_Traffic"] -action.escu.eli5 = This search counts the numbers of times the system has created remote desktop traffic -action.escu.how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. -action.escu.known_false_positives = none -action.escu.creation_date = 2017-09-15 -action.escu.modification_date = 2017-09-15 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Identify Systems Receiving Remote Desktop Traffic -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = [] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Identify Systems Receiving Remote Desktop Traffic - Rule -action.correlationsearch.annotations = {} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name("All_Traffic")` | sort - count - -[ESCU - Identify Systems Using Remote Desktop - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. -action.escu.mappings = {} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. -action.escu.how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity. -action.escu.known_false_positives = none -action.escu.creation_date = 2019-04-01 -action.escu.modification_date = 2019-04-01 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Identify Systems Using Remote Desktop -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = [] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Identify Systems Using Remote Desktop - Rule -action.correlationsearch.annotations = {} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name | `drop_dm_object_name(Processes)` | sort - count - [ESCU - Kerberoasting spn request with RC4 encryption - Rule] action.escu = 0 action.escu.enabled = 1 @@ -14227,76 +13416,6 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Registry where Registry.action=modified AND Registry.registry_path="*CurrentControlSet\\Control\\Print\\Monitors*" by Registry.dest, Registry.registry_key_name Registry.user Registry.registry_path Registry.registry_value_name Registry.action | `drop_dm_object_name(Registry)` | `monitor_registry_keys_for_print_monitors_filter` -[ESCU - Monitor Successful Backups - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. -action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs. -action.escu.known_false_positives = none -action.escu.creation_date = 2017-09-12 -action.escu.modification_date = 2017-09-12 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Monitor Successful Backups -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Monitor Backup Solution"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Monitor Successful Backups - Rule -action.correlationsearch.annotations = {"analytic_story": ["Monitor Backup Solution"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `netbackup` "Disk/Partition backup completed successfully." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE - -[ESCU - Monitor Unsuccessful Backups - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. -action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs. -action.escu.known_false_positives = none -action.escu.creation_date = 2017-09-12 -action.escu.modification_date = 2017-09-12 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Monitor Unsuccessful Backups -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Monitor Backup Solution"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Monitor Unsuccessful Backups - Rule -action.correlationsearch.annotations = {"analytic_story": ["Monitor Backup Solution"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `netbackup` "An error occurred, failed to backup." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE - [ESCU - Monitor Web Traffic For Brand Abuse - Rule] action.escu = 0 action.escu.enabled = 1 @@ -14338,6 +13457,54 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(Web.url) as urls min(_time) as firstTime from datamodel=Web by Web.src | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `brand_abuse_web` | `monitor_web_traffic_for_brand_abuse_filter` +[ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed mshta.exe may be used. +action.escu.known_false_positives = limitted. this anomaly behavior is not commonly seen in clean host. +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 56 +action.risk.param._risk_message = a mshta parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["source:endpoint", {"stage": "executions"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload. +action.notable.param.rule_title = Mshta spawning Rundll32 OR Regsvr32 Process +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.parent_process_name = "mshta.exe" (Processes.process_name=rundll32.exe OR Processes.process_name=regsvr32.exe) by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `mshta_spawning_rundll32_or_regsvr32_process_filter` + [ESCU - Msmpeng Application DLL Side Loading - Rule] action.escu = 0 action.escu.enabled = 1 @@ -14914,6 +14081,54 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_security` EventCode=4625 Logon_Type=3 Source_Network_Address!="-" | bucket span=2m _time | eval Destination_Account = mvindex(Account_Name, 1) | stats dc(Destination_Account) AS unique_accounts values(Destination_Account) as tried_accounts by _time, Source_Network_Address, ComputerName | eventstats avg(unique_accounts) as comp_avg , stdev(unique_accounts) as comp_std by Source_Network_Address, ComputerName | eval upperBound=(comp_avg+comp_std*3) | eval isOutlier=if(unique_accounts > 10 and unique_accounts >= upperBound, 1, 0) | search isOutlier=1 | `multiple_users_remotely_failing_to_authenticate_from_host_filter` +[ESCU - NET Profiler UAC bypass - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +action.escu.known_false_positives = limited false positive. It may trigger by some windows update that will modify this registry. +action.escu.creation_date = 2021-07-12 +action.escu.modification_date = 2021-07-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - NET Profiler UAC bypass - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - NET Profiler UAC bypass - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed. +action.notable.param.rule_title = NET Profiler UAC bypass +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\COR_PROFILER_PATH" Registry.registry_value_name = "*.dll" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `net_profiler_uac_bypass_filter` + [ESCU - NLTest Domain Trust Discovery - Rule] action.escu = 0 action.escu.enabled = 1 @@ -15797,6 +15012,54 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode=1 parent_process_name IN ("powerpnt.exe", "winword.exe", "excel.exe", "visio.exe") process_name = "*.exe" cmdline IN ("*http:*","*https:*") NOT(OriginalFileName IN("firefox.exe", "chrome.exe","iexplore.exe","msedge.exe")) | stats min(_time) as firstTime max(_time) as lastTime count by parent_process_name process_name parent_process cmdline process_id OriginalFileName ProcessGuid Computer EventCode | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `office_document_spawned_child_process_to_download_filter` +[ESCU - Office Product Spawn CMD Process - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload. +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = IT or network admin may create an document automation that will run shell script. +action.escu.creation_date = 2021-07-19 +action.escu.modification_date = 2021-07-19 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Office Product Spawn CMD Process - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Trickbot"] +action.risk = 1 +action.risk.param._risk_object = user +action.risk.param._risk_object_type = user +action.risk.param._risk_score = 56 +action.risk.param._risk_message = an office product parent process $parent_process_name$ spawn child process $process_name$ in host $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 56}, {"risk_object_field": "user", "risk_object_type": "user", "risk_score": 56}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Office Product Spawn CMD Process - Rule +action.correlationsearch.annotations = {"analytic_story": ["Trickbot"], "confidence": 80, "context": ["source:endpoint", {"stage": "executions"}], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}, {"name": "user", "role": ["Victim"], "type": "user"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['user', 'dest'] +action.notable.param.rule_description = this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload. +action.notable.param.rule_title = Office Product Spawn CMD Process +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.parent_process_name = "winword.exe" OR Processes.parent_process_name= "excel.exe" OR Processes.parent_process_name = "powerpnt.exe") Processes.process_name=cmd.exe by Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.process_guid Processes.user Processes.dest | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `office_product_spawn_cmd_process_filter` + [ESCU - Office Product Spawning BITSAdmin - Rule] action.escu = 0 action.escu.enabled = 1 @@ -16964,1161 +16227,6 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name = "bcdedit.exe" Processes.process = "*bootstatuspolicy*" Processes.process = "*ignoreallfailures*" by Processes.parent_process_name Processes.parent_process Processes.process_name Processes.process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)`| `prevent_automatic_repair_mode_using_bcdedit_filter` -[ESCU - Previously Seen AWS Cross Account Activity - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-06-04 -action.escu.modification_date = 2018-06-04 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS Cross Account Activity"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen AWS Cross Account Activity - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Cross Account Activity"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | stats count - -[ESCU - Previously Seen AWS Cross Account Activity - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.mappings = {} -action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-08-15 -action.escu.modification_date = 2020-08-15 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] -cron_schedule = 0 1 1 1,4,7,10 * -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen AWS Cross Account Activity - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity - -[ESCU - Previously Seen AWS Cross Account Activity - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.mappings = {} -action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-08-15 -action.escu.modification_date = 2020-08-15 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Update -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen AWS Cross Account Activity - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId | outputlookup previously_seen_aws_cross_account_activity - -[ESCU - Previously Seen AWS Provisioning Activity Sources - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-03-16 -action.escu.modification_date = 2018-03-16 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen AWS Provisioning Activity Sources -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen AWS Provisioning Activity Sources - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Suspicious Provisioning Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv | stats count - -[ESCU - Previously Seen AWS Regions - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-01-08 -action.escu.modification_date = 2018-01-08 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen AWS Regions -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen AWS Regions - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count - -[ESCU - Previously Seen Cloud API Calls Per User Role - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. -action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-09-03 -action.escu.modification_date = 2020-09-03 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -cron_schedule = 0 1 1 1,4,7,10 * -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud API Calls Per User Role - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role - -[ESCU - Previously Seen Cloud API Calls Per User Role - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search updates the table of the first and last times seen for every user role and command combination. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search updates the table of the first and last times seen for every user role and command combination. -action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-09-03 -action.escu.modification_date = 2020-09-03 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Update -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud User Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud API Calls Per User Role - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud User Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | table user, command, firstTimeSeen, lastTimeSeen | inputlookup previously_seen_cloud_api_calls_per_user_role append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role - -[ESCU - Previously Seen Cloud Compute Creations By User - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen users that have launched a cloud compute instance. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search builds a table of previously seen users that have launched a cloud compute instance. -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-08-15 -action.escu.modification_date = 2020-08-15 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cloud Cryptomining"] -cron_schedule = 55 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Creations By User - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count - -[ESCU - Previously Seen Cloud Compute Creations By User - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen users that have launched a cloud compute instance. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search builds a table of previously seen users that have launched a cloud compute instance. -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-08-15 -action.escu.modification_date = 2020-08-15 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Update -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cloud Cryptomining"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Creations By User - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), "-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user - -[ESCU - Previously Seen Cloud Compute Images - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen images used to launch cloud compute instances -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated -action.escu.known_false_positives = none -action.escu.creation_date = 2020-10-08 -action.escu.modification_date = 2020-10-08 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cloud Cryptomining"] -cron_schedule = 0 1 1 1,4,7,10 * -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Images - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images - -[ESCU - Previously Seen Cloud Compute Images - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen images used to launch cloud compute instances -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -action.escu.known_false_positives = none -action.escu.creation_date = 2020-08-12 -action.escu.modification_date = 2020-08-12 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Update -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cloud Cryptomining"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Images - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images - -[ESCU - Previously Seen Cloud Compute Instance Types - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen cloud compute instance types -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search builds a table of previously seen cloud compute instance types -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-9-03 -action.escu.modification_date = 2020-9-03 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cloud Cryptomining"] -cron_schedule = 0 1 1 1,4,7,10 * -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Instance Types - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types - -[ESCU - Previously Seen Cloud Compute Instance Types - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen cloud compute instance types -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search builds a table of previously seen cloud compute instance types -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -action.escu.known_false_positives = none -action.escu.creation_date = 2020-9-03 -action.escu.modification_date = 2020-9-03 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Update -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cloud Cryptomining"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Compute Instance Types - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | inputlookup append=t previously_seen_cloud_compute_instance_types | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types - -[ESCU - Previously Seen Cloud Instance Modifications By User - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen users that have modified a cloud instance. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search builds a table of previously seen users that have modified a cloud instance. -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-07-29 -action.escu.modification_date = 2020-07-29 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] -cron_schedule = 0 1 1 1,4,7,10 * -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Instance Modifications By User - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user - -[ESCU - Previously Seen Cloud Instance Modifications By User - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search updates a table of previously seen Cloud Instance modifications that have been made by a user -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search updates a table of previously seen Cloud Instance modifications that have been made by a user -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-07-29 -action.escu.modification_date = 2020-07-29 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Update -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Instance Modifications By User - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user - -[ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. -action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-08-19 -action.escu.modification_date = 2020-08-19 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] -cron_schedule = 0 1 1 1,4,7,10 * -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources - -[ESCU - Previously Seen Cloud Provisioning Activity Sources - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. -action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-08-20 -action.escu.modification_date = 2020-08-20 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Update -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Provisioning Activity Sources - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Provisioning Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen, City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources - -[ESCU - Previously Seen Cloud Regions - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-09-02 -action.escu.modification_date = 2020-09-02 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cloud Cryptomining"] -cron_schedule = 0 1 1 1,4,7,10 * -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Regions - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions - -[ESCU - Previously Seen Cloud Regions - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -action.escu.mappings = {} -action.escu.data_models = ["Change"] -action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-09-02 -action.escu.modification_date = 2020-09-02 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Update -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Cloud Cryptomining"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Cloud Regions - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Cloud Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count - -[ESCU - Previously Seen EC2 AMIs - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen AMIs used to launch EC2 instances -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search builds a table of previously seen AMIs used to launch EC2 instances -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-03-12 -action.escu.modification_date = 2018-03-12 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen EC2 AMIs -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS Cryptomining"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen EC2 AMIs - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID | outputlookup previously_seen_ec2_amis.csv | stats count - -[ESCU - Previously Seen EC2 Instance Types - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen EC2 instance types -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search builds a table of previously seen EC2 instance types -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-03-08 -action.escu.modification_date = 2018-03-08 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen EC2 Instance Types -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS Cryptomining"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen EC2 Instance Types - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time) as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv | stats count - -[ESCU - Previously Seen EC2 Launches By User - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen ARNs that have launched a EC2 instance. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search builds a table of previously seen ARNs that have launched a EC2 instance. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-03-15 -action.escu.modification_date = 2018-03-15 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen EC2 Launches By User -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen EC2 Launches By User - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS Cryptomining", "Suspicious AWS EC2 Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | stats count - -[ESCU - Previously Seen EC2 Modifications By User - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search builds a table of previously seen ARNs that have launched a EC2 instance. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search builds a table of previously seen ARNs that have launched a EC2 instance. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-04-05 -action.escu.modification_date = 2018-04-05 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen EC2 Modifications By User -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Unusual AWS EC2 Modifications"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen EC2 Modifications By User - Rule -action.correlationsearch.annotations = {"analytic_story": ["Unusual AWS EC2 Modifications"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count - -[ESCU - Previously Seen Running Windows Services - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This collects the services that have been started across your entire enterprise. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This collects the services that have been started across your entire enterprise. -action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-06-23 -action.escu.modification_date = 2020-06-23 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] -cron_schedule = 0 1 1 1,4,7,10 * -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Running Windows Services - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | outputlookup previously_seen_running_windows_services - -[ESCU - Previously Seen Running Windows Services - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. -action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-06-23 -action.escu.modification_date = 2020-06-23 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - Update -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] -cron_schedule = 55 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Running Windows Services - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by service | where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`") | outputlookup previously_seen_running_windows_services - -[ESCU - Previously Seen Users In CloudTrail - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -action.escu.mappings = {} -action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-05-28 -action.escu.modification_date = 2020-05-28 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Users In CloudTrail - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins - -[ESCU - Previously Seen Users in CloudTrail - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. -action.escu.mappings = {} -action.escu.data_models = ["Authentication"] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. -action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-05-28 -action.escu.modification_date = 2020-05-28 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Users in CloudTrail - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] -cron_schedule = 0 1 1 1,4,7,10 * -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Users in CloudTrail - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Authentication Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count - -[ESCU - Previously Seen Zoom Child Processes - Initial - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. -action.escu.mappings = {} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. -action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-05-20 -action.escu.modification_date = 2020-05-20 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Initial -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Zoom Child Processes"] -cron_schedule = 0 1 1 1,4,7,10 * -dispatch.earliest_time = -90d@d -dispatch.latest_time = -1d@d -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Zoom Child Processes - Initial - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Zoom Child Processes"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table dest, process_name, firstTimeSeen, lastTimeSeen | outputlookup zoom_first_time_child_process - -[ESCU - Previously Seen Zoom Child Processes - Update - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. -action.escu.mappings = {} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. -action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. -action.escu.known_false_positives = none -action.escu.creation_date = 2020-05-20 -action.escu.modification_date = 2020-05-20 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Update -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Zoom Child Processes"] -cron_schedule = 55 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously Seen Zoom Child Processes - Update - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Zoom Child Processes"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name, dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") | outputlookup zoom_first_time_child_process - -[ESCU - Previously seen API call per user roles in CloudTrail - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-04-16 -action.escu.modification_date = 2018-04-16 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously seen API call per user roles in CloudTrail -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["AWS User Monitoring"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously seen API call per user roles in CloudTrail - Rule -action.correlationsearch.annotations = {"analytic_story": ["AWS User Monitoring"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole | stats earliest(_time) as earliest latest(_time) as latest by userName eventName | outputlookup previously_seen_api_calls_from_user_roles | stats count - -[ESCU - Previously seen S3 bucket access by remote IP - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-06-28 -action.escu.modification_date = 2018-06-28 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously seen S3 bucket access by remote IP -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious AWS S3 Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously seen S3 bucket access by remote IP - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS S3 Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `aws_s3_accesslogs` http_status=200 | stats earliest(_time) as earliest latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip | stats count - -[ESCU - Previously seen command line arguments - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. -action.escu.mappings = {} -action.escu.data_models = ["Endpoint"] -action.escu.eli5 = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. -action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. -action.escu.known_false_positives = none -action.escu.creation_date = 2019-03-01 -action.escu.modification_date = 2019-03-01 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously seen command line arguments -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously seen command line arguments - Rule -action.correlationsearch.annotations = {"analytic_story": ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)` - -[ESCU - Previously seen users in CloudTrail - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-04-30 -action.escu.modification_date = 2018-04-30 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Previously seen users in CloudTrail -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious AWS Login Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Previously seen users in CloudTrail - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail | stats count - [ESCU - Print Spooler Adding A Printer Driver - Rule] action.escu = 0 action.escu.enabled = 1 @@ -20414,6 +18522,54 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `script_execution_via_wmi_filter` +[ESCU - Sdclt UAC Bypass - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +action.escu.known_false_positives = Limited to no false positives are expected. +action.escu.creation_date = 2021-07-01 +action.escu.modification_date = 2021-07-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Sdclt UAC Bypass - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Sdclt UAC Bypass - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed. +action.notable.param.rule_title = Sdclt UAC Bypass +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where (Registry.registry_path= "*\\Windows\\CurrentVersion\\App Paths\\control.exe*" OR Registry.registry_path= "*\\exefile\\shell\\runas\\command\\*") (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "IsolatedCommand") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `sdclt_uac_bypass_filter` + [ESCU - SearchProtocolHost with no Command Line with Network - Rule] action.escu = 0 action.escu.enabled = 1 @@ -20750,6 +18906,54 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` values(All_Changes.result_id) as result_id count min(_time) as firstTime max(_time) as lastTime from datamodel=Change where All_Changes.result_id=4720 OR All_Changes.result_id=4726 by _time span=4h All_Changes.user All_Changes.dest | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("All_Changes")` | search result_id = 4720 result_id=4726 | transaction user connected=false maxspan=240m | table firstTime lastTime count user dest result_id | `short_lived_windows_accounts_filter` +[ESCU - SilentCleanup UAC Bypass - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-07-01 +action.escu.modification_date = 2021-07-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - SilentCleanup UAC Bypass - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - SilentCleanup UAC Bypass - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account. +action.notable.param.rule_title = SilentCleanup UAC Bypass +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\Environment\\windir" Registry.registry_value_name = "*.exe*" by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `silentcleanup_uac_bypass_filter` + [ESCU - Single Letter Process On Endpoint - Rule] action.escu = 0 action.escu.enabled = 1 @@ -22895,41 +21099,6 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes where Processes.process_path !="C:\\Windows\\System32*" Processes.process_path !="C:\\Windows\\SysWOW64*" by Processes.dest Processes.user Processes.parent_process Processes.process_name Processes.process Processes.process_id Processes.parent_process_id Processes.process_hash | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)`| `is_windows_system_file` | `system_processes_run_from_unexpected_locations_filter` -[ESCU - Systems Ready for Spectre-Meltdown Windows Patch - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. -action.escu.how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-01-08 -action.escu.modification_date = 2018-01-08 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Systems Ready for Spectre-Meltdown Windows Patch -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Spectre And Meltdown Vulnerabilities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Systems Ready for Spectre-Meltdown Windows Patch - Rule -action.correlationsearch.annotations = {"analytic_story": ["Spectre And Meltdown Vulnerabilities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry AND (All_Changes.object_path="HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat*") by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object, All_Changes.object_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("All_Changes")` - [ESCU - TOR Traffic - Rule] action.escu = 0 action.escu.enabled = 1 @@ -23017,6 +21186,53 @@ realtime_schedule = 0 is_visible = false search = `sysmon` EventCode IN (17,18) PipeName="\\pipe\\*lacesomepipe" | stats min(_time) as firstTime max(_time) as lastTime count by Computer user_id EventCode PipeName signature Image process_id | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `trickbot_named_pipe_filter` +[ESCU - UAC Bypass MMC Load Unsigned Dll - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.data_models = [] +action.escu.eli5 = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path +action.escu.how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +action.escu.known_false_positives = unknown. all of the dll loaded by mmc.exe is microsoft signed dll. +action.escu.creation_date = 2021-07-12 +action.escu.modification_date = 2021-07-12 +action.escu.confidence = high +action.escu.full_search_name = ESCU - UAC Bypass MMC Load Unsigned Dll - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = Computer +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious unsigned $ImageLoaded$ loaded by $Image$ on endpoint $Computer$ with EventCode $EventCode$ +action.risk.param._risk = [{"risk_object_field": "Computer", "risk_object_type": "system", "risk_score": 63}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - UAC Bypass MMC Load Unsigned Dll - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence,", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "Computer", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path +action.notable.param.rule_title = UAC Bypass MMC Load Unsigned Dll +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `sysmon` EventCode=7 ImageLoaded = "*.dll" Image = "*\\mmc.exe" Signed=false Company != "Microsoft Corporation" | stats count min(_time) as firstTime max(_time) as lastTime by Image ImageLoaded Signed ProcessId OriginalFileName Computer EventCode Company | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `uac_bypass_mmc_load_unsigned_dll_filter` + [ESCU - USN Journal Deletion - Rule] action.escu = 0 action.escu.enabled = 1 @@ -23465,41 +21681,6 @@ realtime_schedule = 0 is_visible = false search = `stream_http` | eval cs_content_type_length = len(cs_content_type) | where cs_content_type_length > 100 | table endtime src_ip dest_ip cs_content_type_length cs_content_type url | `unusually_long_content_type_length_filter` -[ESCU - Update previously seen users in CloudTrail - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. -action.escu.known_false_positives = none -action.escu.creation_date = 2018-04-30 -action.escu.modification_date = 2018-04-30 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Update previously seen users in CloudTrail -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious AWS Login Activities"] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Update previously seen users in CloudTrail - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious AWS Login Activities"]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region Country | inputlookup append=t previously_seen_users_console_logins_cloudtrail | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail - [ESCU - W3WP Spawning Shell - Rule] action.escu = 0 action.escu.enabled = 1 @@ -23787,6 +21968,54 @@ realtime_schedule = 0 is_visible = false search = `wmi` EventCode=5860 Temporary | rex field=Message "NotificationQuery =\s+(?[^;|^$]+)" | search query!="SELECT * FROM Win32_ProcessStartTrace WHERE ProcessName = 'wsmprovhost.exe'" AND query!="SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'" | stats count min(_time) as firstTime max(_time) as lastTime by ComputerName, query | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `wmi_temporary_event_subscription_filter` +[ESCU - WSReset UAC Bypass - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +action.escu.data_models = ["Endpoint"] +action.escu.eli5 = This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control. +action.escu.how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +action.escu.known_false_positives = unknown +action.escu.creation_date = 2021-07-01 +action.escu.modification_date = 2021-07-01 +action.escu.confidence = high +action.escu.full_search_name = ESCU - WSReset UAC Bypass - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Windows Defense Evasion Tactics"] +action.risk = 1 +action.risk.param._risk_object = dest +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 63 +action.risk.param._risk_message = Suspicious modification of registry $registry_path$ with possible payload path $registry_value_name$ in $dest$ +action.risk.param._risk = [{"risk_object_field": "dest", "risk_object_type": "system", "risk_score": 63}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - WSReset UAC Bypass - Rule +action.correlationsearch.annotations = {"analytic_story": ["Windows Defense Evasion Tactics"], "confidence": 90, "context": ["Source:Endpoint", "Stage:Persistence", "Stage:Privilege Escalation", "Stage:Defense Evasion", "Scope:Incoming"], "impact": 70, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"], "observable": [{"name": "dest", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.nes_fields = ['dest'] +action.notable.param.rule_description = This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control. +action.notable.param.rule_title = WSReset UAC Bypass +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\AppX82a6gwre4fdg3bt635tn5ctqjf8msdd2\\Shell\\open\\command*" (Registry.registry_key_name = "(Default)" OR Registry.registry_key_name = "DelegateExecute") by Registry.registry_path Registry.registry_key_name Registry.registry_value_name Registry.dest | `drop_dm_object_name(Registry)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `wsreset_uac_bypass_filter` + [ESCU - Wbemprox COM Object Execution - Rule] action.escu = 0 action.escu.enabled = 1 @@ -24483,76 +22712,6 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes WHERE ("Processes.process_name"="net*.exe" "Processes.process"="*stop \"samss\"*") BY "Processes.dest", "Processes.user", "Processes.process" | `drop_dm_object_name(Processes)` | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `windows_security_account_manager_stopped_filter` -[ESCU - Windows Updates Install Failures - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. -action.escu.how_to_implement = You must be ingesting your Windows Update Logs -action.escu.known_false_positives = none -action.escu.creation_date = 2017-09-14 -action.escu.modification_date = 2017-09-14 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Windows Updates Install Failures -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = [] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Windows Updates Install Failures - Rule -action.correlationsearch.annotations = {} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure by _time span=1d - -[ESCU - Windows Updates Install Successes - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. -action.escu.mappings = {} -action.escu.data_models = [] -action.escu.eli5 = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. -action.escu.how_to_implement = You must be ingesting your Windows Update Logs -action.escu.known_false_positives = none -action.escu.creation_date = 2017-09-14 -action.escu.modification_date = 2017-09-14 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Windows Updates Install Successes -action.escu.search_type = support -action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = [] -cron_schedule = 10 0 * * * -dispatch.earliest_time = -1450m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Windows Updates Install Successes - Rule -action.correlationsearch.annotations = {} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed by _time span=1d - [ESCU - Windows connhost exe started forcefully - Rule] action.escu = 0 action.escu.enabled = 1 @@ -25117,6 +23276,1380 @@ search = `google_gcp_pubsub_message` type.googleapis.com/google.cloud.audit.Audi ### END ESCU DETECTIONS ### +### ESCU BASELINES ### + +[ESCU - Add Prohibited Processes to Enterprise Security] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Add Prohibited Processes to Enterprise Security +description = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. +action.escu.creation_date = 2017-09-15 +action.escu.modification_date = 2017-09-15 +action.escu.analytic_story = ["Emotet Malware DHS Report TA18-201A ", "Monitor for Unauthorized Software", "SamSam Ransomware"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. +action.escu.how_to_implement = This search should be run on each new install of ESCU. +disabled = true +is_visible = false +search = | inputlookup prohibited_processes | search note!=ESCU* | inputlookup append=T prohibited_processes | fillnull value=* dest dest_pci_domain | fillnull value=false is_required is_secure | fillnull value=true is_prohibited | outputlookup prohibited_processes | stats count + +[ESCU - Baseline Of Cloud Infrastructure API Calls Per User] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline Of Cloud Infrastructure API Calls Per User +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +action.escu.creation_date = 2020-09-07 +action.escu.modification_date = 2020-09-07 +action.escu.analytic_story = ["Suspicious Cloud User Activities"] +action.escu.data_models = ["Change"] +cron_schedule = 0 2 * * 0 +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. +disabled = true +is_visible = false +search = | tstats count as api_calls from datamodel=Change where All_Changes.user!=unknown All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time api_calls, user, HourOfDay, isWeekend | eventstats dc(api_calls) as api_calls by user, HourOfDay, isWeekend | where api_calls >= 1 | fit DensityFunction api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_api_calls_v1 dist=norm show_density=true + +[ESCU - Baseline Of Cloud Instances Destroyed] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Destroyed +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. +action.escu.creation_date = 2020-08-25 +action.escu.modification_date = 2020-08-25 +action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Cloud Cryptomining"] +action.escu.data_models = ["Change"] +cron_schedule = 0 2 * * 0 +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. +action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +disabled = true +is_visible = false +search = | tstats count as instances_destroyed from datamodel=Change where All_Changes.action=deleted AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_destroyed=coalesce(instances_destroyed, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_destroyed, HourOfDay, isWeekend | fit DensityFunction instances_destroyed by "HourOfDay,isWeekend" into cloud_excessive_instances_destroyed_v1 dist=expon show_density=true + +[ESCU - Baseline Of Cloud Instances Launched] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline Of Cloud Instances Launched +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +action.escu.creation_date = 2020-08-14 +action.escu.modification_date = 2020-08-14 +action.escu.analytic_story = ["Cloud Cryptomining", "Suspicious Cloud Instance Activities"] +action.escu.data_models = ["Change"] +cron_schedule = 0 2 * * 0 +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. +action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +disabled = true +is_visible = false +search = | tstats count as instances_launched from datamodel=Change where (All_Changes.action=created) AND All_Changes.status=success AND All_Changes.object_category=instance by _time span=1h | makecontinuous span=1h _time | eval instances_launched=coalesce(instances_launched, (random()%2)*0.0000000001) | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time instances_launched, HourOfDay, isWeekend | fit DensityFunction instances_launched by "HourOfDay,isWeekend" into cloud_excessive_instances_created_v1 dist=expon show_density=true + +[ESCU - Baseline Of Cloud Security Group API Calls Per User] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline Of Cloud Security Group API Calls Per User +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. +action.escu.creation_date = 2020-09-07 +action.escu.modification_date = 2020-09-07 +action.escu.analytic_story = ["Suspicious Cloud User Activities"] +action.escu.data_models = ["Change"] +cron_schedule = 0 2 * * 0 +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. +action.escu.how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. +disabled = true +is_visible = false +search = | tstats count as security_group_api_calls from datamodel=Change where All_Changes.object_category=firewall All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | table _time security_group_api_calls, user, HourOfDay, isWeekend | eventstats dc(security_group_api_calls) as security_group_api_calls by user, HourOfDay, isWeekend | where security_group_api_calls >= 1 | fit DensityFunction security_group_api_calls by "user,HourOfDay,isWeekend" into cloud_excessive_security_group_api_calls_v1 dist=norm show_density=true + +[ESCU - Baseline of API Calls per User ARN] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline of API Calls per User ARN +description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.creation_date = 2018-04-09 +action.escu.modification_date = 2018-04-09 +action.escu.analytic_story = ["AWS User Monitoring"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +disabled = true +is_visible = false +search = `cloudtrail` eventType=AwsApiCall | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup api_call_by_user_baseline | stats count + +[ESCU - Baseline of Command Line Length - MLTK] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline of Command Line Length - MLTK +description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. +action.escu.creation_date = 2019-05-08 +action.escu.modification_date = 2019-05-08 +action.escu.analytic_story = ["Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Ransomware", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity", "Unusual Processes"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. +action.escu.how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as start_time max(_time) as end_time FROM datamodel=Endpoint.Processes by Processes.user Processes.dest Processes.process_name Processes.process | `drop_dm_object_name(Processes)` | search user!=unknown | `security_content_ctime(start_time)`| `security_content_ctime(end_time)`| eval processlen=len(process) | fit DensityFunction processlen by user into cmdline_pdfmodel + +[ESCU - Baseline of DNS Query Length - MLTK] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline of DNS Query Length - MLTK +description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. +action.escu.creation_date = 2019-05-08 +action.escu.modification_date = 2019-05-08 +action.escu.analytic_story = ["Command and Control", "Hidden Cobra Malware", "Suspicious DNS Traffic"] +action.escu.data_models = ["Network_Resolution"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. +action.escu.how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Network_Resolution by DNS.query DNS.record_type | search DNS.record_type=* | `drop_dm_object_name("DNS")` | eval query_length = len(query) | fit DensityFunction query_length by record_type into dns_query_pdfmodel + +[ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. +action.escu.creation_date = 2019-11-14 +action.escu.modification_date = 2019-11-14 +action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ +In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +disabled = true +is_visible = false +search = `cloudtrail` eventName=RunInstances errorCode=success `ec2_excessive_runinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_launched by _time src_user | fit DensityFunction instances_launched threshold=0.0005 into ec2_excessive_runinstances_v1 + +[ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK +description = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. +action.escu.creation_date = 2019-11-14 +action.escu.modification_date = 2019-11-14 +action.escu.analytic_story = ["Suspicious AWS EC2 Activities"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ +In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ +More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +disabled = true +is_visible = false +search = `cloudtrail` eventName=TerminateInstances errorCode=success `ec2_excessive_terminateinstances_mltk_input_filter` | bucket span=10m _time | stats count as instances_terminated by _time src_user | fit DensityFunction instances_terminated threshold=0.0005 into ec2_excessive_terminateinstances_v1 + +[ESCU - Baseline of Network ACL Activity by ARN] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline of Network ACL Activity by ARN +description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.creation_date = 2018-05-21 +action.escu.modification_date = 2018-05-21 +action.escu.analytic_story = ["AWS Network ACL Activity"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. +disabled = true +is_visible = false +search = `cloudtrail` `network_acl_events` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup network_acl_activity_baseline | stats count + +[ESCU - Baseline of S3 Bucket deletion activity by ARN] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline of S3 Bucket deletion activity by ARN +description = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.creation_date = 2018-07-17 +action.escu.modification_date = 2018-07-17 +action.escu.analytic_story = ["Suspicious AWS S3 Activities"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +disabled = true +is_visible = false +search = `cloudtrail` eventName=DeleteBucket | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup s3_deletion_baseline | stats count + +[ESCU - Baseline of SMB Traffic - MLTK] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline of SMB Traffic - MLTK +description = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. +action.escu.creation_date = 2019-05-08 +action.escu.modification_date = 2019-05-08 +action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Emotet Malware DHS Report TA18-201A ", "Hidden Cobra Malware", "Netsh Abuse", "Ransomware"] +action.escu.data_models = ["Network_Traffic"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. +action.escu.how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=139 OR All_Traffic.dest_port=445 OR All_Traffic.app=smb by _time span=10m, All_Traffic.src | eval HourOfDay=strftime(_time, "%H") | eval DayOfWeek=strftime(_time, "%A") | `drop_dm_object_name("All_Traffic")` | fit DensityFunction count by "HourOfDay,DayOfWeek" into smb_pdfmodel + +[ESCU - Baseline of Security Group Activity by ARN] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline of Security Group Activity by ARN +description = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.creation_date = 2018-04-17 +action.escu.modification_date = 2018-04-17 +action.escu.analytic_story = ["AWS User Monitoring"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. +disabled = true +is_visible = false +search = `cloudtrail` `security_group_api_calls` | spath output=arn path=userIdentity.arn | bucket _time span=1h | stats count as apiCalls by _time, arn | stats count(apiCalls) as numDataPoints, latest(apiCalls) as latestCount, avg(apiCalls) as avgApiCalls, stdev(apiCalls) as stdevApiCalls by arn | table arn, latestCount, numDataPoints, avgApiCalls, stdevApiCalls | outputlookup security_group_activity_baseline | stats count + +[ESCU - Baseline of blocked outbound traffic from AWS] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Baseline of blocked outbound traffic from AWS +description = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. +action.escu.creation_date = 2018-05-07 +action.escu.modification_date = 2018-05-07 +action.escu.analytic_story = ["AWS Network ACL Activity", "Command and Control", "Suspicious AWS Traffic"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. +disabled = true +is_visible = false +search = `cloudwatchlogs_vpcflow` action=blocked (src_ip=10.0.0.0/8 OR src_ip=172.16.0.0/12 OR src_ip=192.168.0.0/16) ( dest_ip!=10.0.0.0/8 AND dest_ip!=172.16.0.0/12 AND dest_ip!=192.168.0.0/16) | bucket _time span=1h | stats count as numberOfBlockedConnections by _time, src_ip | stats count(numberOfBlockedConnections) as numDataPoints, latest(numberOfBlockedConnections) as latestCount, avg(numberOfBlockedConnections) as avgBlockedConnections, stdev(numberOfBlockedConnections) as stdevBlockedConnections by src_ip | table src_ip, latestCount, numDataPoints, avgBlockedConnections, stdevBlockedConnections | outputlookup baseline_blocked_outbound_connections | stats count + +[ESCU - Count of Unique IPs Connecting to Ports] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Count of Unique IPs Connecting to Ports +description = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. +action.escu.creation_date = 2017-09-13 +action.escu.modification_date = 2017-09-13 +action.escu.analytic_story = [] +action.escu.data_models = ["Network_Traffic"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. +action.escu.how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` count dc(All_Traffic.src) as numberOfUniqueHosts from datamodel=Network_Traffic by All_Traffic.dest_port | `drop_dm_object_name("All_Traffic")` | sort - count + +[ESCU - Count of assets by category] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Count of assets by category +description = This search shows you every asset category you have and the assets that belong to those categories. +action.escu.creation_date = 2017-09-13 +action.escu.modification_date = 2017-09-13 +action.escu.analytic_story = ["Asset Tracking"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search shows you every asset category you have and the assets that belong to those categories. +action.escu.how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. +disabled = true +is_visible = false +search = | from datamodel Identity_Management.All_Assets | stats count values(nt_host) by category | sort -count + +[ESCU - Create a list of approved AWS service accounts] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Create a list of approved AWS service accounts +description = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. +action.escu.creation_date = 2018-12-03 +action.escu.modification_date = 2018-12-03 +action.escu.analytic_story = ["AWS User Monitoring"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. +disabled = true +is_visible = false +search = `cloudtrail` errorCode=success | rename userName as identity | search NOT [inputlookup identity_lookup_expanded | fields identity] | stats count by identity | table identity | outputlookup aws_service_accounts | stats count + +[ESCU - DNSTwist Domain Names] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - DNSTwist Domain Names +description = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. +action.escu.creation_date = 2018-10-08 +action.escu.modification_date = 2018-10-08 +action.escu.analytic_story = ["Brand Monitoring", "Suspicious Emails"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. +action.escu.how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. +disabled = true +is_visible = false +search = | dnstwist domainlist=domains.csv | `remove_valid_domains` | eval domain_abuse="true" | table domain, domain_abuse | outputlookup brandMonitoring_lookup | stats count + +[ESCU - Discover DNS records] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Discover DNS records +description = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup +action.escu.creation_date = 2019-02-14 +action.escu.modification_date = 2019-02-14 +action.escu.analytic_story = ["DNS Hijacking"] +action.escu.data_models = ["Network_Resolution"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup +action.escu.how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation +disabled = true +is_visible = false +search = | inputlookup cim_corporate_email_domains.csv | inputlookup append=T cim_corporate_web_domains.csv | inputlookup append=T cim_cloud_domains.csv | eval domain = trim(replace(domain, "\*", "")) | join domain [|tstats `security_content_summariesonly` count values(DNS.record_type) as type, values(DNS.answer) as answer from datamodel=Network_Resolution where DNS.message_type=RESPONSE DNS.answer!="unknown" DNS.answer!="" by DNS.query | rename DNS.query as query | where query!="unknown" | rex field=query "(?\w+\.\w+?)(?:$|/)"] | makemv delim=" " answer | makemv delim=" " type | sort -count | table count,domain,type,query,answer | outputlookup createinapp=true discovered_dns_records + +[ESCU - Identify Systems Creating Remote Desktop Traffic] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Identify Systems Creating Remote Desktop Traffic +description = This search counts the numbers of times the system has generated remote desktop traffic. +action.escu.creation_date = 2017-09-15 +action.escu.modification_date = 2017-09-15 +action.escu.analytic_story = [] +action.escu.data_models = ["Network_Traffic"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search counts the numbers of times the system has generated remote desktop traffic. +action.escu.how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.src | `drop_dm_object_name("All_Traffic")` | sort - count + +[ESCU - Identify Systems Receiving Remote Desktop Traffic] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Identify Systems Receiving Remote Desktop Traffic +description = This search counts the numbers of times the system has created remote desktop traffic +action.escu.creation_date = 2017-09-15 +action.escu.modification_date = 2017-09-15 +action.escu.analytic_story = [] +action.escu.data_models = ["Network_Traffic"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search counts the numbers of times the system has created remote desktop traffic +action.escu.how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Network_Traffic where All_Traffic.dest_port=3389 by All_Traffic.dest | `drop_dm_object_name("All_Traffic")` | sort - count + +[ESCU - Identify Systems Using Remote Desktop] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Identify Systems Using Remote Desktop +description = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. +action.escu.creation_date = 2019-04-01 +action.escu.modification_date = 2019-04-01 +action.escu.analytic_story = [] +action.escu.data_models = ["Endpoint"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. +action.escu.how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` count from datamodel=Endpoint.Processes where Processes.process_name="*mstsc.exe*" by Processes.dest Processes.process_name | `drop_dm_object_name(Processes)` | sort - count + +[ESCU - Monitor Successful Backups] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Monitor Successful Backups +description = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. +action.escu.creation_date = 2017-09-12 +action.escu.modification_date = 2017-09-12 +action.escu.analytic_story = ["Monitor Backup Solution"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. +action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs. +disabled = true +is_visible = false +search = `netbackup` "Disk/Partition backup completed successfully." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE + +[ESCU - Monitor Unsuccessful Backups] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Monitor Unsuccessful Backups +description = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. +action.escu.creation_date = 2017-09-12 +action.escu.modification_date = 2017-09-12 +action.escu.analytic_story = ["Monitor Backup Solution"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. +action.escu.how_to_implement = To successfully implement this search you must be ingesting your backup logs. +disabled = true +is_visible = false +search = `netbackup` "An error occurred, failed to backup." | bucket _time span=1d | stats dc(COMPUTERNAME) as count values(COMPUTERNAME) as dest by _time, MESSAGE + +[ESCU - Previously Seen AWS Cross Account Activity] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity +description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.creation_date = 2018-06-04 +action.escu.modification_date = 2018-06-04 +action.escu.analytic_story = ["AWS Cross Account Activity"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +disabled = true +is_visible = false +search = `cloudtrail` eventName=AssumeRole | spath output=requestingAccountId path=userIdentity.accountId | spath output=requestedAccountId path=resources{}.accountId | search requestingAccountId=* | where requestingAccountId!=requestedAccountId | stats earliest(_time) as firstTime latest(_time) as lastTime by requestingAccountId, requestedAccountId | outputlookup previously_seen_aws_cross_account_activity | stats count + +[ESCU - Previously Seen AWS Cross Account Activity - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Initial +description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.creation_date = 2020-08-15 +action.escu.modification_date = 2020-08-15 +action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] +action.escu.data_models = ["Authentication"] +cron_schedule = 0 1 1 1,4,7,10 * +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | table requestingAccountId requestedAccountId firstTime lastTime | outputlookup previously_seen_aws_cross_account_activity + +[ESCU - Previously Seen AWS Cross Account Activity - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen AWS Cross Account Activity - Update +description = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.creation_date = 2020-08-15 +action.escu.modification_date = 2020-08-15 +action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] +action.escu.data_models = ["Authentication"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=AssumeRole by Authentication.vendor_account Authentication.user Authentication.src Authentication.user_role | `drop_dm_object_name(Authentication)` | rex field=user_role "arn:aws:sts:*:(?.*):" | where vendor_account != dest_account | rename vendor_account as requestingAccountId dest_account as requestedAccountId | inputlookup append=t previously_seen_aws_cross_account_activity | stats min(firstTime) as firstTime max(lastTime) as lastTime by requestingAccountId requestedAccountId | outputlookup previously_seen_aws_cross_account_activity + +[ESCU - Previously Seen AWS Provisioning Activity Sources] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen AWS Provisioning Activity Sources +description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. +action.escu.creation_date = 2018-03-16 +action.escu.modification_date = 2018-03-16 +action.escu.analytic_story = ["AWS Suspicious Provisioning Activities"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. +disabled = true +is_visible = false +search = `cloudtrail` (eventName=Run* OR eventName=Create*) | iplocation sourceIPAddress | stats earliest(_time) as firstTime, latest(_time) as lastTime by sourceIPAddress, City, Region, Country | outputlookup previously_seen_provisioning_activity_src.csv | stats count + +[ESCU - Previously Seen AWS Regions] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen AWS Regions +description = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days +action.escu.creation_date = 2018-01-08 +action.escu.modification_date = 2018-01-08 +action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +disabled = true +is_visible = false +search = `cloudtrail` StartInstances | stats earliest(_time) as earliest latest(_time) as latest by awsRegion | outputlookup previously_seen_aws_regions.csv | stats count + +[ESCU - Previously Seen Cloud API Calls Per User Role - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Initial +description = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. +action.escu.creation_date = 2020-09-03 +action.escu.modification_date = 2020-09-03 +action.escu.analytic_story = ["Suspicious Cloud User Activities"] +action.escu.data_models = ["Change"] +cron_schedule = 0 1 1 1,4,7,10 * +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. +action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role + +[ESCU - Previously Seen Cloud API Calls Per User Role - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud API Calls Per User Role - Update +description = This search updates the table of the first and last times seen for every user role and command combination. +action.escu.creation_date = 2020-09-03 +action.escu.modification_date = 2020-09-03 +action.escu.analytic_story = ["Suspicious Cloud User Activities"] +action.escu.data_models = ["Change"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search updates the table of the first and last times seen for every user role and command combination. +action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, All_Changes.command | `drop_dm_object_name("All_Changes")` | table user, command, firstTimeSeen, lastTimeSeen | inputlookup previously_seen_cloud_api_calls_per_user_role append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by user, command | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_api_calls_per_user_role_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table user, command, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_api_calls_per_user_role + +[ESCU - Previously Seen Cloud Compute Creations By User - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Initial +description = This search builds a table of previously seen users that have launched a cloud compute instance. +action.escu.creation_date = 2020-08-15 +action.escu.modification_date = 2020-08-15 +action.escu.analytic_story = ["Cloud Cryptomining"] +action.escu.data_models = ["Change"] +cron_schedule = 55 * * * * +enableSched = 1 +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen users that have launched a cloud compute instance. +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user | `drop_dm_object_name("All_Changes")` | outputlookup previously_seen_cloud_compute_creations_by_user | stats count + +[ESCU - Previously Seen Cloud Compute Creations By User - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Creations By User - Update +description = This search builds a table of previously seen users that have launched a cloud compute instance. +action.escu.creation_date = 2020-08-15 +action.escu.modification_date = 2020-08-15 +action.escu.analytic_story = ["Cloud Cryptomining"] +action.escu.data_models = ["Change"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen users that have launched a cloud compute instance. +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created AND All_Changes.object_category=instance by All_Changes.user| `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_compute_creations_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), "-90d@d") | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_creations_by_user + +[ESCU - Previously Seen Cloud Compute Images - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Initial +description = This search builds a table of previously seen images used to launch cloud compute instances +action.escu.creation_date = 2020-10-08 +action.escu.modification_date = 2020-10-08 +action.escu.analytic_story = ["Cloud Cryptomining"] +action.escu.data_models = ["Change"] +cron_schedule = 0 1 1 1,4,7,10 * +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images + +[ESCU - Previously Seen Cloud Compute Images - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Images - Update +description = This search builds a table of previously seen images used to launch cloud compute instances +action.escu.creation_date = 2020-08-12 +action.escu.modification_date = 2020-08-12 +action.escu.analytic_story = ["Cloud Cryptomining"] +action.escu.data_models = ["Change"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen images used to launch cloud compute instances +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.image_id | `drop_dm_object_name("All_Changes")` | `drop_dm_object_name("Instance_Changes")` | where image_id != "unknown" | inputlookup append=t previously_seen_cloud_compute_images | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by image_id | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_images + +[ESCU - Previously Seen Cloud Compute Instance Types - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Initial +description = This search builds a table of previously seen cloud compute instance types +action.escu.creation_date = 2020-9-03 +action.escu.modification_date = 2020-9-03 +action.escu.analytic_story = ["Cloud Cryptomining"] +action.escu.data_models = ["Change"] +cron_schedule = 0 1 1 1,4,7,10 * +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen cloud compute instance types +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types + +[ESCU - Previously Seen Cloud Compute Instance Types - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Compute Instance Types - Update +description = This search builds a table of previously seen cloud compute instance types +action.escu.creation_date = 2020-9-03 +action.escu.modification_date = 2020-9-03 +action.escu.analytic_story = ["Cloud Cryptomining"] +action.escu.data_models = ["Change"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen cloud compute instance types +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type | `drop_dm_object_name("All_Changes.Instance_Changes")` | where instance_type != "unknown" | inputlookup append=t previously_seen_cloud_compute_instance_types | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by instance_type | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_instance_type_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_compute_instance_types + +[ESCU - Previously Seen Cloud Instance Modifications By User - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Initial +description = This search builds a table of previously seen users that have modified a cloud instance. +action.escu.creation_date = 2020-07-29 +action.escu.modification_date = 2020-07-29 +action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] +action.escu.data_models = ["Change"] +cron_schedule = 0 1 1 1,4,7,10 * +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen users that have modified a cloud instance. +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 c=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user + +[ESCU - Previously Seen Cloud Instance Modifications By User - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Instance Modifications By User - Update +description = This search updates a table of previously seen Cloud Instance modifications that have been made by a user +action.escu.creation_date = 2020-07-29 +action.escu.modification_date = 2020-07-29 +action.escu.analytic_story = ["Suspicious Cloud Instance Activities"] +action.escu.data_models = ["Change"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search updates a table of previously seen Cloud Instance modifications that have been made by a user +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=modified All_Changes.change_type=EC2 All_Changes.status=success by All_Changes.user | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_instance_modifications_by_user | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by user | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_compute_images_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | outputlookup previously_seen_cloud_instance_modifications_by_user + +[ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial +description = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. +action.escu.creation_date = 2020-08-19 +action.escu.modification_date = 2020-08-19 +action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] +action.escu.data_models = ["Change"] +cron_schedule = 0 1 1 1,4,7,10 * +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. +action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources + +[ESCU - Previously Seen Cloud Provisioning Activity Sources - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Provisioning Activity Sources - Update +description = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. +action.escu.creation_date = 2020-08-20 +action.escu.modification_date = 2020-08-20 +action.escu.analytic_story = ["Suspicious Cloud Provisioning Activities"] +action.escu.data_models = ["Change"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. +action.escu.how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where (All_Changes.action=started OR All_Changes.action=created) All_Changes.status=success by All_Changes.src | `drop_dm_object_name("All_Changes")` | iplocation src | where isnotnull(Country) | table src, firstTimeSeen, lastTimeSeen, City, Country, Region | inputlookup previously_seen_cloud_provisioning_activity_sources append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by src, City, Country, Region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_provisioning_activity_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-7d@d"), 1, 0) | table src, City, Country, Region, firstTimeSeen, lastTimeSeen, enough_data | outputlookup previously_seen_cloud_provisioning_activity_sources + +[ESCU - Previously Seen Cloud Regions - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Initial +description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days +action.escu.creation_date = 2020-09-02 +action.escu.modification_date = 2020-09-02 +action.escu.analytic_story = ["Cloud Cryptomining"] +action.escu.data_models = ["Change"] +cron_schedule = 0 1 1 1,4,7,10 * +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions + +[ESCU - Previously Seen Cloud Regions - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Cloud Regions - Update +description = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days +action.escu.creation_date = 2020-09-02 +action.escu.modification_date = 2020-09-02 +action.escu.analytic_story = ["Cloud Cryptomining"] +action.escu.data_models = ["Change"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days +action.escu.how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen from datamodel=Change where All_Changes.action=created by All_Changes.vendor_region | `drop_dm_object_name("All_Changes")` | inputlookup append=t previously_seen_cloud_regions | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by vendor_region | where lastTimeSeen > relative_time(now(), `previously_seen_cloud_region_forget_window`) | eventstats min(firstTimeSeen) as globalFirstTime | eval enough_data = if(globalFirstTime <= relative_time(now(), "-14d@d"), 1, 0) | outputlookup previously_seen_cloud_regions | stats count + +[ESCU - Previously Seen EC2 AMIs] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen EC2 AMIs +description = This search builds a table of previously seen AMIs used to launch EC2 instances +action.escu.creation_date = 2018-03-12 +action.escu.modification_date = 2018-03-12 +action.escu.analytic_story = ["AWS Cryptomining"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen AMIs used to launch EC2 instances +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +disabled = true +is_visible = false +search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instancesSet.items{}.imageId as amiID | stats earliest(_time) as firstTime latest(_time) as lastTime by amiID | outputlookup previously_seen_ec2_amis.csv | stats count + +[ESCU - Previously Seen EC2 Instance Types] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen EC2 Instance Types +description = This search builds a table of previously seen EC2 instance types +action.escu.creation_date = 2018-03-08 +action.escu.modification_date = 2018-03-08 +action.escu.analytic_story = ["AWS Cryptomining"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen EC2 instance types +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +disabled = true +is_visible = false +search = `cloudtrail` eventName=RunInstances errorCode=success | rename requestParameters.instanceType as instanceType | fillnull value="m1.small" instanceType | stats earliest(_time) as earliest latest(_time) as latest by instanceType | outputlookup previously_seen_ec2_instance_types.csv | stats count + +[ESCU - Previously Seen EC2 Launches By User] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen EC2 Launches By User +description = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.escu.creation_date = 2018-03-15 +action.escu.modification_date = 2018-03-15 +action.escu.analytic_story = ["AWS Cryptomining", "Suspicious AWS EC2 Activities"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. +disabled = true +is_visible = false +search = `cloudtrail` eventName=RunInstances errorCode=success | rename userIdentity.arn as arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_launches_by_user.csv | stats count + +[ESCU - Previously Seen EC2 Modifications By User] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen EC2 Modifications By User +description = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.escu.creation_date = 2018-04-05 +action.escu.modification_date = 2018-04-05 +action.escu.analytic_story = ["Unusual AWS EC2 Modifications"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search builds a table of previously seen ARNs that have launched a EC2 instance. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. +disabled = true +is_visible = false +search = `cloudtrail` `ec2_modification_api_calls` errorCode=success | spath output=arn userIdentity.arn | stats earliest(_time) as firstTime latest(_time) as lastTime by arn | outputlookup previously_seen_ec2_modifications_by_user | stats count + +[ESCU - Previously Seen Running Windows Services - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - Initial +description = This collects the services that have been started across your entire enterprise. +action.escu.creation_date = 2020-06-23 +action.escu.modification_date = 2020-06-23 +action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] +action.escu.data_models = [] +cron_schedule = 0 1 1 1,4,7,10 * +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This collects the services that have been started across your entire enterprise. +action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. +disabled = true +is_visible = false +search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | outputlookup previously_seen_running_windows_services + +[ESCU - Previously Seen Running Windows Services - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Running Windows Services - Update +description = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. +action.escu.creation_date = 2020-06-23 +action.escu.modification_date = 2020-06-23 +action.escu.analytic_story = ["Orangeworm Attack Group", "Windows Service Abuse", "NOBELIUM Group"] +action.escu.data_models = [] +cron_schedule = 55 * * * * +enableSched = 1 +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. +action.escu.how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. +disabled = true +is_visible = false +search = `wineventlog_system` EventCode=7036 | rex field=Message "The (?[-\(\)\s\w]+) service entered the (?\w+) state" | where state="running" | stats earliest(_time) as firstTimeSeen, latest(_time) as lastTimeSeen by service | inputlookup previously_seen_running_windows_services append=t | stats min(firstTimeSeen) as firstTimeSeen, max(lastTimeSeen) as lastTimeSeen by service | where lastTimeSeen > relative_time(now(), "`previously_seen_windows_service_forget_window`") | outputlookup previously_seen_running_windows_services + +[ESCU - Previously Seen Users In CloudTrail - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Users In CloudTrail - Update +description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. +action.escu.creation_date = 2020-05-28 +action.escu.modification_date = 2020-05-28 +action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] +action.escu.data_models = ["Authentication"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | inputlookup append=t previously_seen_users_console_logins | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins + +[ESCU - Previously Seen Users in CloudTrail - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Users in CloudTrail - Initial +description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. +action.escu.creation_date = 2020-05-28 +action.escu.modification_date = 2020-05-28 +action.escu.analytic_story = ["Suspicious Cloud Authentication Activities"] +action.escu.data_models = ["Authentication"] +cron_schedule = 0 1 1 1,4,7,10 * +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. +action.escu.how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. +disabled = true +is_visible = false +search = | tstats earliest(_time) as firstTime latest(_time) as lastTime from datamodel=Authentication where Authentication.signature=ConsoleLogin by Authentication.user Authentication.src | iplocation Authentication.src | rename Authentication.user as user Authentication.src as src | table user src City Region Country firstTime lastTime | outputlookup previously_seen_users_console_logins | stats count + +[ESCU - Previously Seen Zoom Child Processes - Initial] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Initial +description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. +action.escu.creation_date = 2020-05-20 +action.escu.modification_date = 2020-05-20 +action.escu.analytic_story = ["Suspicious Zoom Child Processes"] +action.escu.data_models = ["Endpoint"] +cron_schedule = 0 1 1 1,4,7,10 * +enableSched = 1 +dispatch.earliest_time = -90d@d +dispatch.latest_time = -1d@d +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. +action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table dest, process_name, firstTimeSeen, lastTimeSeen | outputlookup zoom_first_time_child_process + +[ESCU - Previously Seen Zoom Child Processes - Update] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously Seen Zoom Child Processes - Update +description = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. +action.escu.creation_date = 2020-05-20 +action.escu.modification_date = 2020-05-20 +action.escu.analytic_story = ["Suspicious Zoom Child Processes"] +action.escu.data_models = ["Endpoint"] +cron_schedule = 55 * * * * +enableSched = 1 +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. +action.escu.how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` min(_time) as firstTimeSeen max(_time) as lastTimeSeen from datamodel=Endpoint.Processes where (Processes.parent_process_name=zoom.exe OR Processes.parent_process_name=zoom.us) by Processes.process_name Processes.dest| `drop_dm_object_name(Processes)` | table firstTimeSeen, lastTimeSeen, process_name, dest | inputlookup zoom_first_time_child_process append=t | stats min(firstTimeSeen) as firstTimeSeen max(lastTimeSeen) as lastTimeSeen by process_name, dest | where lastTimeSeen > relative_time(now(), "`previously_seen_zoom_child_processes_forget_window`") | outputlookup zoom_first_time_child_process + +[ESCU - Previously seen API call per user roles in CloudTrail] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously seen API call per user roles in CloudTrail +description = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. +action.escu.creation_date = 2018-04-16 +action.escu.modification_date = 2018-04-16 +action.escu.analytic_story = ["AWS User Monitoring"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. +disabled = true +is_visible = false +search = `cloudtrail` eventType=AwsApiCall errorCode=success userIdentity.type=AssumedRole | stats earliest(_time) as earliest latest(_time) as latest by userName eventName | outputlookup previously_seen_api_calls_from_user_roles | stats count + +[ESCU - Previously seen S3 bucket access by remote IP] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously seen S3 bucket access by remote IP +description = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" +action.escu.creation_date = 2018-06-28 +action.escu.modification_date = 2018-06-28 +action.escu.analytic_story = ["Suspicious AWS S3 Activities"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. +disabled = true +is_visible = false +search = `aws_s3_accesslogs` http_status=200 | stats earliest(_time) as earliest latest(_time) as latest by bucket_name remote_ip | outputlookup previously_seen_S3_access_from_remote_ip | stats count + +[ESCU - Previously seen command line arguments] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously seen command line arguments +description = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. +action.escu.creation_date = 2019-03-01 +action.escu.modification_date = 2019-03-01 +action.escu.analytic_story = ["DHS Report TA18-074A", "Disabling Security Tools", "Hidden Cobra Malware", "Netsh Abuse", "Orangeworm Attack Group", "Possible Backdoor Activity Associated With MUDCARP Espionage Campaigns", "Suspicious Command-Line Executions", "Suspicious MSHTA Activity"] +action.escu.data_models = ["Endpoint"] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. +action.escu.how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=cmd.exe AND Processes.process="* /c *" by Processes.process | `drop_dm_object_name(Processes)` + +[ESCU - Previously seen users in CloudTrail] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Previously seen users in CloudTrail +description = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.escu.creation_date = 2018-04-30 +action.escu.modification_date = 2018-04-30 +action.escu.analytic_story = ["Suspicious AWS Login Activities"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. +disabled = true +is_visible = false +search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) as firstTime latest(_time) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail | stats count + +[ESCU - Systems Ready for Spectre-Meltdown Windows Patch] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Systems Ready for Spectre-Meltdown Windows Patch +description = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. +action.escu.creation_date = 2018-01-08 +action.escu.modification_date = 2018-01-08 +action.escu.analytic_story = ["Spectre And Meltdown Vulnerabilities"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. +action.escu.how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Change_Analysis.All_Changes where All_Changes.object_category=registry AND (All_Changes.object_path="HKLM\Software\Microsoft\Windows\CurrentVersion\QualityCompat*") by All_Changes.dest, All_Changes.command, All_Changes.user, All_Changes.object, All_Changes.object_path | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` | `drop_dm_object_name("All_Changes")` + +[ESCU - Update previously seen users in CloudTrail] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Update previously seen users in CloudTrail +description = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.escu.creation_date = 2018-04-30 +action.escu.modification_date = 2018-04-30 +action.escu.analytic_story = ["Suspicious AWS Login Activities"] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel +action.escu.how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. +disabled = true +is_visible = false +search = `cloudtrail` eventName=ConsoleLogin | rename userIdentity.arn as user | iplocation src | eval City=if(City LIKE "",src,City),Region=if(Region LIKE "",src,Region) | stats earliest(_time) AS firstTime latest(_time) AS lastTime by user src City Region Country | inputlookup append=t previously_seen_users_console_logins_cloudtrail | stats min(firstTime) as firstTime max(lastTime) as lastTime by user src City Region Country | outputlookup previously_seen_users_console_logins_cloudtrail + +[ESCU - Windows Updates Install Failures] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Windows Updates Install Failures +description = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. +action.escu.creation_date = 2017-09-14 +action.escu.modification_date = 2017-09-14 +action.escu.analytic_story = [] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. +action.escu.how_to_implement = You must be ingesting your Windows Update Logs +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=failure by _time span=1d + +[ESCU - Windows Updates Install Successes] +action.escu = 0 +action.escu.enabled = 1 +action.escu.search_type = support +action.escu.full_search_name = ESCU - Windows Updates Install Successes +description = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. +action.escu.creation_date = 2017-09-14 +action.escu.modification_date = 2017-09-14 +action.escu.analytic_story = [] +action.escu.data_models = [] +cron_schedule = 10 0 * * * +enableSched = 1 +dispatch.earliest_time = -1450m@m +dispatch.latest_time = -10m@m +schedule_window = auto +action.escu.providing_technologies = [] +action.escu.eli5 = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. +action.escu.how_to_implement = You must be ingesting your Windows Update Logs +disabled = true +is_visible = false +search = | tstats `security_content_summariesonly` dc(Updates.dest) as count FROM datamodel=Updates where Updates.vendor_product="Microsoft Windows" AND Updates.status=installed by _time span=1d + + + ### ESCU RESPONSE TASKS ### [ESCU - AWS Investigate Security Hub alerts by dest - Response Task] @@ -26180,4 +25713,4 @@ search = index=_audit sourcetype="audittrail" \ | rex field=search "\"(?.*)\""\ | table savedsearch_name count(search) usage user | join savedsearch_name max=0 type=left [search sourcetype="manifests" | spath searches{} | mvexpand searches{} | spath input=searches{} | table category search_name | rename search_name as savedsearch_name | dedup savedsearch_name] | search category=* -### END OF USAGE DASHBOARD CONFIGURATIONS ### \ No newline at end of file +### END OF USAGE DASHBOARD CONFIGURATIONS ### diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 32df446f25..26b66a37c6 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T10:40:21 UTC +# On Date: 2021-07-23T08:46:10 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index 04dcc3fe45..e68d2294f1 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-21T10:40:21 UTC +# On Date: 2021-07-23T08:46:11 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -263,7 +263,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -332,7 +332,7 @@ version = 1 references = ["https://attack.mitre.org/tactics/TA0010/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] description = The stealing of data by an adversary. narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. @@ -883,7 +883,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -1085,7 +1085,7 @@ version = 1 references = ["https://en.wikipedia.org/wiki/Trickbot", "https://blog.checkpoint.com/2021/03/11/february-2021s-most-wanted-malware-trickbot-takes-over-following-emotet-shutdown/"] maintainers = [{"company": "Teoderick Contreras, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"] +searches = ["ESCU - Account Discovery With Net App - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Cobalt Strike Named Pipes - Rule", "ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule", "ESCU - Office Application Spawn rundll32 process - Rule", "ESCU - Office Document Executing Macro Code - Rule", "ESCU - Office Product Spawn CMD Process - Rule", "ESCU - Powershell Remote Thread To Known Windows Process - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Suspicious Rundll32 StartW - Rule", "ESCU - Trickbot Named Pipe - Rule", "ESCU - Wermgr Process Connecting To IP Check Web Services - Rule", "ESCU - Wermgr Process Create Executable File - Rule", "ESCU - Wermgr Process Spawned CMD Or Powershell Process - Rule", "ESCU - Write Executable in SMB Share - Rule"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the trickbot banking trojan, including looking for file writes associated with its payload, process injection, shellcode execution and data collection even in LDAP environment. narrative = trickbot banking trojan campaigns targeting banks and other vertical sectors.This malware is known in Microsoft Windows OS where target security Microsoft Defender to prevent its detection and removal. steal Verizon credentials and targeting banks using its multi component modules that collect and exfiltrate data. @@ -1167,7 +1167,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -2584,6 +2584,18 @@ annotations = {"cis20": ["CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Ob known_false_positives = None thus far found providing_technologies = [] +[savedsearch://ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule] +type = detection +asset_type = +confidence = medium +explanation = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +known_false_positives = Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives. +providing_technologies = [] + [savedsearch://ESCU - Detect Credential Dumping through LSASS access - Rule] type = detection asset_type = Windows @@ -3384,6 +3396,16 @@ annotations = {"cis20": ["CIS 2"], "kill_chain_phases": ["Installation", "Comman known_false_positives = It is uncommon for normal users to execute a series of commands used for network discovery. System administrators often use scripts to execute these commands. These can generate false positives. providing_technologies = [] +[savedsearch://ESCU - Detect shared ec2 snapshot - Rule] +type = detection +asset_type = EC2 Snapshot +confidence = medium +explanation = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. +how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +annotations = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose. +providing_technologies = [] + [savedsearch://ESCU - Detect web traffic to dynamic domain providers - Rule] type = detection asset_type = Endpoint @@ -4564,6 +4586,16 @@ annotations = {"cis20": ["CIS 7"], "kill_chain_phases": ["Delivery"], "nist": [" known_false_positives = None at this time providing_technologies = [] +[savedsearch://ESCU - Mshta spawning Rundll32 OR Regsvr32 Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual trickbot payload. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. Tune and filter known instances where renamed mshta.exe may be used. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"]} +known_false_positives = limitted. this anomaly behavior is not commonly seen in clean host. +providing_technologies = [] + [savedsearch://ESCU - Msmpeng Application DLL Side Loading - Rule] type = detection asset_type = @@ -4698,6 +4730,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1110.00 known_false_positives = A host failing to authenticate with multiple valid users against a remote host is not a common behavior for legitimate systems. Possible false positive scenarios include but are not limited to vulnerability scanners, remote administration tools, missconfigyred systems, etc. providing_technologies = [] +[savedsearch://ESCU - NET Profiler UAC bypass - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring the registry key and values in the detection area. It may happened that windows update some dll related to mmc.exe and add dll path in this registry. In this case filtering is needed. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +known_false_positives = limited false positive. It may trigger by some windows update that will modify this registry. +providing_technologies = [] + [savedsearch://ESCU - NLTest Domain Trust Discovery - Rule] type = detection asset_type = Endpoint @@ -4900,6 +4942,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1566.00 known_false_positives = default browser not in the filter list providing_technologies = [] +[savedsearch://ESCU - Office Product Spawn CMD Process - Rule] +type = detection +asset_type = +confidence = medium +explanation = this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious code. This is seen in trickbot spear phishing doc where it execute shell cmd to run mshta payload. +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1218.005"]} +known_false_positives = IT or network admin may create an document automation that will run shell script. +providing_technologies = [] + [savedsearch://ESCU - Office Product Spawning BITSAdmin - Rule] type = detection asset_type = @@ -5998,6 +6050,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob known_false_positives = Although unlikely, administrators may use wmi to launch scripts for legitimate purposes. Filter as needed. providing_technologies = [] +[savedsearch://ESCU - Sdclt UAC Bypass - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with payload file path on it to be executed. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Processes` node. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +known_false_positives = Limited to no false positives are expected. +providing_technologies = [] + [savedsearch://ESCU - SearchProtocolHost with no Command Line with Network - Rule] type = detection asset_type = @@ -6068,6 +6130,16 @@ annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1136.001"], "nist": ["PR. known_false_positives = It is possible that an administrator created and deleted an account in a short time period. Verifying activity with an administrator is advised. providing_technologies = [] +[savedsearch://ESCU - SilentCleanup UAC Bypass - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User control account. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Single Letter Process On Endpoint - Rule] type = detection asset_type = Endpoint @@ -6576,6 +6648,16 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1055"]} known_false_positives = unknown providing_technologies = [] +[savedsearch://ESCU - UAC Bypass MMC Load Unsigned Dll - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry that will trigger the mmc.exe to load the dll path +how_to_implement = To successfully implement this search, you need to be ingesting logs with the process name and imageloaded executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +known_false_positives = unknown. all of the dll loaded by mmc.exe is microsoft signed dll. +providing_technologies = [] + [savedsearch://ESCU - USN Journal Deletion - Rule] type = detection asset_type = Endpoint @@ -6753,6 +6835,16 @@ annotations = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Ob known_false_positives = Some software may create WMI temporary event subscriptions for various purposes. The included search contains an exception for two of these that occur by default on Windows 10 systems. You may need to modify the search to create exceptions for other legitimate events. providing_technologies = [] +[savedsearch://ESCU - WSReset UAC Bypass - Rule] +type = detection +asset_type = +confidence = medium +explanation = This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User account Control. +how_to_implement = To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from your endpoints into the `Endpoint` datamodel in the `Registry` node. Also make sure that this registry was included in your config files ex. sysmon config to be monitored. +annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1548.002"]} +known_false_positives = unknown +providing_technologies = [] + [savedsearch://ESCU - Wbemprox COM Object Execution - Rule] type = detection asset_type = From 686b0b5ca4d523632c7ccaaca67bda1fcae3f3b7 Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 26 Jul 2021 13:39:17 +0200 Subject: [PATCH 18/21] converted response_task to investigations --- bin/generate.py | 140 ++-- bin/jinja2_templates/savedsearches.j2 | 28 +- bin/jinja2_templates/use_case_library.j2 | 12 +- bin/reporting.py | 2 +- bin/reporting/detection_count.svg | 2 +- bin/reporting/detection_coverage.svg | 2 +- ...azon_eks_kubernetes_activity_by_src_ip.yml | 17 +- ...nvestigate_security_hub_alerts_by_dest.yml | 20 +- ...stigate_user_activities_by_accesskeyid.yml | 16 +- ...aws_investigate_user_activities_by_arn.yml | 18 +- .../aws_network_acl_details_from_id.yml | 13 +- ...twork_interface_details_via_resourceid.yml | 16 +- .../aws_s3_bucket_details_via_bucketname.yml | 16 +- .../gcp_kubernetes_activity_by_src_ip.yml | 19 +- .../cloud}/get_all_aws_activity_from_city.yml | 16 +- .../get_all_aws_activity_from_country.yml | 16 +- .../get_all_aws_activity_from_ip_address.yml | 16 +- .../get_all_aws_activity_from_region.yml | 16 +- ...get_ec2_instance_details_by_instanceid.yml | 20 +- .../cloud}/get_ec2_launch_details.yml | 16 +- ...stigate_aws_activities_via_region_name.yml | 13 +- ...gate_aws_user_activities_by_user_field.yml | 18 +- .../investigate_okta_activity_by_app.yml | 20 +- ...nvestigate_okta_activity_by_ip_address.yml | 20 +- .../investigate_user_activities_in_okta.yml | 19 +- .../get_backup_logs_for_endpoint.yml | 11 +- ...ogon_rights_modifications_for_endpoint.yml | 12 +- ...et_logon_rights_modifications_for_user.yml | 12 +- .../endpoint}/get_notable_history.yml | 7 +- .../endpoint}/get_parent_process_info.yml | 14 +- .../endpoint}/get_process_file_activity.yml | 13 +- .../endpoint}/get_process_info.yml | 14 +- ..._process_information_for_port_activity.yml | 15 +- ...rocess_responsible_for_the_dns_traffic.yml | 16 +- .../get_sysmon_wmi_activity_for_host.yml | 20 +- ...ailed_logins_for_multiple_destinations.yml | 12 +- .../investigate_pass_the_hash_attempts.yml | 12 +- .../investigate_pass_the_ticket_attempts.yml | 10 +- .../investigate_previous_unseen_user.yml | 12 +- ...cessful_remote_desktop_authentications.yml | 15 +- .../get_certificate_logs_for_a_domain.yml | 14 +- .../get_dns_server_history_for_a_host.yml | 10 +- .../network}/get_dns_traffic_ratio.yml | 13 +- .../network}/get_email_info.yml | 8 +- .../get_emails_from_specific_sender.yml | 8 +- ...e_and_last_occurrence_of_a_mac_address.yml | 15 +- .../network}/get_history_of_email_sources.yml | 11 +- ...d_emails_to_hidden_cobra_threat_actors.yml | 12 +- ...web_session_information_via_session_id.yml | 13 +- ...nvestigate_network_traffic_from_src_ip.yml | 9 +- ...gate_suspicious_strings_in_http_header.yml | 13 +- .../investigate_web_posts_from_src.yml | 12 +- dist/escu/default/analytic_stories.conf | 166 ++-- dist/escu/default/collections.conf | 2 +- ...l_backup_logs_for_host___response_task.xml | 2 +- ...tes_activity_by_src_ip___response_task.xml | 2 +- ...ity_hub_alerts_by_dest___response_task.xml | 2 +- ...ivities_by_accesskeyid___response_task.xml | 2 +- ...user_activities_by_arn___response_task.xml | 2 +- ...rk_acl_details_from_id___response_task.xml | 2 +- ...details_via_resourceid___response_task.xml | 2 +- ...details_via_bucketname___response_task.xml | 2 +- ...tes_activity_by_src_ip___response_task.xml | 2 +- ...aws_activity_from_city___response_task.xml | 2 +- ..._activity_from_country___response_task.xml | 2 +- ...tivity_from_ip_address___response_task.xml | 2 +- ...s_activity_from_region___response_task.xml | 2 +- ...ckup_logs_for_endpoint___response_task.xml | 2 +- ...cate_logs_for_a_domain___response_task.xml | 2 +- ..._details_by_instanceid___response_task.xml | 2 +- ...get_ec2_launch_details___response_task.xml | 2 +- ...rence_of_a_mac_address___response_task.xml | 2 +- ...fications_for_endpoint___response_task.xml | 2 +- ...modifications_for_user___response_task.xml | 2 +- ...et_parent_process_info___response_task.xml | 2 +- ...panel_get_process_info___response_task.xml | 2 +- ..._wmi_activity_for_host___response_task.xml | 2 +- ...rmation_via_session_id___response_task.xml | 2 +- ...vities_via_region_name___response_task.xml | 2 +- ...tivities_by_user_field___response_task.xml | 2 +- ...e_okta_activity_by_app___response_task.xml | 2 +- ...activity_by_ip_address___response_task.xml | 2 +- ...strings_in_http_header___response_task.xml | 2 +- ...ser_activities_in_okta___response_task.xml | 2 +- dist/escu/default/es_investigations.conf | 2 +- dist/escu/default/macros.conf | 206 ++++- dist/escu/default/savedsearches.conf | 157 +++- dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 784 ++---------------- macros/aws_config.yml | 4 + macros/aws_description.yml | 4 + macros/aws_securityhub_firehose.yml | 4 + macros/notable.yml | 4 + 93 files changed, 1195 insertions(+), 1044 deletions(-) rename {response_tasks => detections/cloud}/amazon_eks_kubernetes_activity_by_src_ip.yml (73%) rename {response_tasks => detections/cloud}/aws_investigate_security_hub_alerts_by_dest.yml (70%) rename {response_tasks => detections/cloud}/aws_investigate_user_activities_by_accesskeyid.yml (72%) rename {response_tasks => detections/cloud}/aws_investigate_user_activities_by_arn.yml (78%) rename {response_tasks => detections/cloud}/aws_network_acl_details_from_id.yml (73%) rename {response_tasks => detections/cloud}/aws_network_interface_details_via_resourceid.yml (72%) rename {response_tasks => detections/cloud}/aws_s3_bucket_details_via_bucketname.yml (74%) rename {response_tasks => detections/cloud}/gcp_kubernetes_activity_by_src_ip.yml (68%) rename {response_tasks => detections/cloud}/get_all_aws_activity_from_city.yml (77%) rename {response_tasks => detections/cloud}/get_all_aws_activity_from_country.yml (77%) rename {response_tasks => detections/cloud}/get_all_aws_activity_from_ip_address.yml (79%) rename {response_tasks => detections/cloud}/get_all_aws_activity_from_region.yml (77%) rename {response_tasks => detections/cloud}/get_ec2_instance_details_by_instanceid.yml (82%) rename {response_tasks => detections/cloud}/get_ec2_launch_details.yml (68%) rename {response_tasks => detections/cloud}/investigate_aws_activities_via_region_name.yml (77%) rename {response_tasks => detections/cloud}/investigate_aws_user_activities_by_user_field.yml (72%) rename {response_tasks => detections/cloud}/investigate_okta_activity_by_app.yml (55%) rename {response_tasks => detections/cloud}/investigate_okta_activity_by_ip_address.yml (55%) rename {response_tasks => detections/cloud}/investigate_user_activities_in_okta.yml (55%) rename {response_tasks => detections/endpoint}/get_backup_logs_for_endpoint.yml (70%) rename {response_tasks => detections/endpoint}/get_logon_rights_modifications_for_endpoint.yml (72%) rename {response_tasks => detections/endpoint}/get_logon_rights_modifications_for_user.yml (72%) rename {response_tasks => detections/endpoint}/get_notable_history.yml (96%) rename {response_tasks => detections/endpoint}/get_parent_process_info.yml (85%) rename {response_tasks => detections/endpoint}/get_process_file_activity.yml (79%) rename {response_tasks => detections/endpoint}/get_process_info.yml (85%) rename {response_tasks => detections/endpoint}/get_process_information_for_port_activity.yml (84%) rename {response_tasks => detections/endpoint}/get_process_responsible_for_the_dns_traffic.yml (83%) rename {response_tasks => detections/endpoint}/get_sysmon_wmi_activity_for_host.yml (69%) rename {response_tasks => detections/endpoint}/investigate_failed_logins_for_multiple_destinations.yml (82%) rename {response_tasks => detections/endpoint}/investigate_pass_the_hash_attempts.yml (84%) rename {response_tasks => detections/endpoint}/investigate_pass_the_ticket_attempts.yml (88%) rename {response_tasks => detections/endpoint}/investigate_previous_unseen_user.yml (84%) rename {response_tasks => detections/endpoint}/investigate_successful_remote_desktop_authentications.yml (79%) rename {response_tasks => detections/network}/get_certificate_logs_for_a_domain.yml (74%) rename {response_tasks => detections/network}/get_dns_server_history_for_a_host.yml (87%) rename {response_tasks => detections/network}/get_dns_traffic_ratio.yml (83%) rename {response_tasks => detections/network}/get_email_info.yml (82%) rename {response_tasks => detections/network}/get_emails_from_specific_sender.yml (83%) rename {response_tasks => detections/network}/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml (73%) rename {response_tasks => detections/network}/get_history_of_email_sources.yml (86%) rename {response_tasks => detections/network}/get_outbound_emails_to_hidden_cobra_threat_actors.yml (85%) rename {response_tasks => detections/network}/get_web_session_information_via_session_id.yml (75%) rename {response_tasks => detections/network}/investigate_network_traffic_from_src_ip.yml (80%) rename {response_tasks => detections/network}/investigate_suspicious_strings_in_http_header.yml (85%) rename {response_tasks => detections/network}/investigate_web_posts_from_src.yml (82%) create mode 100644 macros/aws_config.yml create mode 100644 macros/aws_description.yml create mode 100644 macros/aws_securityhub_firehose.yml create mode 100644 macros/notable.yml diff --git a/bin/generate.py b/bin/generate.py index 5ae10636bd..e68e58758f 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -88,10 +88,9 @@ def generate_collections_conf(lookups, TEMPLATE_PATH, OUTPUT_PATH): return output_path -def generate_savedsearches_conf(detections, response_tasks, deployments, TEMPLATE_PATH, OUTPUT_PATH): +def generate_savedsearches_conf(detections, deployments, TEMPLATE_PATH, OUTPUT_PATH): ''' @param detections: input list of individual YAML detections in detections/ directory - @param response_tasks: @param deployments: @return: the savedsearches.conf file located in package/default/ ''' @@ -103,14 +102,14 @@ def generate_savedsearches_conf(detections, response_tasks, deployments, TEMPLAT j2_env.filters['custom_jinja2_enrichment_filter'] = custom_jinja2_enrichment_filter template = j2_env.get_template('savedsearches.j2') output_path = path.join(OUTPUT_PATH, 'default/savedsearches.conf') - output = template.render(detections=detections, response_tasks=response_tasks, time=utc_time) + output = template.render(detections=detections, time=utc_time) with open(output_path, 'w') as f: output = output.encode('ascii', 'ignore').decode('ascii') f.write(output) return output_path -def generate_analytic_story_conf(stories, detections, response_tasks, TEMPLATE_PATH, OUTPUT_PATH): +def generate_analytic_story_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH): utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat() j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), @@ -123,7 +122,7 @@ def generate_analytic_story_conf(stories, detections, response_tasks, TEMPLATE_P return output_path -def generate_use_case_library_conf(stories, detections, response_tasks, TEMPLATE_PATH, OUTPUT_PATH): +def generate_use_case_library_conf(stories, detections, TEMPLATE_PATH, OUTPUT_PATH): utc_time = datetime.datetime.utcnow().replace(microsecond=0).isoformat() j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), @@ -131,7 +130,6 @@ def generate_use_case_library_conf(stories, detections, response_tasks, TEMPLATE template = j2_env.get_template('use_case_library.j2') output_path = path.join(OUTPUT_PATH, 'default/use_case_library.conf') output = template.render(stories=stories, detections=detections, - response_tasks=response_tasks, time=utc_time) with open(output_path, 'w', encoding="utf-8") as f: f.write(output) @@ -165,23 +163,24 @@ def generate_macros_conf(macros, detections, TEMPLATE_PATH, OUTPUT_PATH): def generate_workbench_panels(response_tasks, stories, TEMPLATE_PATH, OUTPUT_PATH): workbench_panel_objects = [] for response_task in response_tasks: - if 'search' in response_task: - if 'inputs' in response_task: - response_file_name = response_task['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower() - response_file_name_xml = response_file_name + "___response_task.xml" - response_task['lowercase_name'] = response_file_name - workbench_panel_objects.append(response_task) - j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), - trim_blocks=True) - template = j2_env.get_template('panel.j2') - file_path = "default/data/ui/panels/workbench_panel_" + response_file_name_xml - output_path = path.join(OUTPUT_PATH, file_path) - response_task['search']= response_task['search'].replace(">",">") - response_task['search']= response_task['search'].replace("<","<") + if response_task['type'] == 'Investigation': + if 'search' in response_task: + if 'inputs' in response_task: + response_file_name = response_task['name'].replace(' ', '_').replace('-','_').replace('.','_').replace('/','_').lower() + response_file_name_xml = response_file_name + "___response_task.xml" + response_task['lowercase_name'] = response_file_name + workbench_panel_objects.append(response_task) + j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), + trim_blocks=True) + template = j2_env.get_template('panel.j2') + file_path = "default/data/ui/panels/workbench_panel_" + response_file_name_xml + output_path = path.join(OUTPUT_PATH, file_path) + response_task['search']= response_task['search'].replace(">",">") + response_task['search']= response_task['search'].replace("<","<") - output = template.render(search=response_task['search']) - with open(output_path, 'w') as f: - f.write(output) + output = template.render(search=response_task['search']) + with open(output_path, 'w') as f: + f.write(output) j2_env = Environment(loader=FileSystemLoader(TEMPLATE_PATH), trim_blocks=True) @@ -273,18 +272,19 @@ def get_nes_fields(search, deployment): def map_response_tasks_to_stories(response_tasks): sto_res = {} for response_task in response_tasks: - if 'tags' in response_task: - if 'analytic_story' in response_task['tags']: - for story in response_task['tags']['analytic_story']: - if 'type' in response_task.keys(): - if response_task['type'] == 'response': + if response_task['type'] == 'Investigation': + if 'tags' in response_task: + if 'analytic_story' in response_task['tags']: + for story in response_task['tags']['analytic_story']: + if 'type' in response_task.keys(): + if response_task['type'] == 'Investigation': + task_name = str('ESCU - ' + response_task['name'] + ' - Response Task') + else: task_name = str('ESCU - ' + response_task['name'] + ' - Response Task') - else: - task_name = str('ESCU - ' + response_task['name'] + ' - Response Task') - if not (story in sto_res): - sto_res[story] = {task_name} - else: - sto_res[story].add(task_name) + if not (story in sto_res): + sto_res[story] = {task_name} + else: + sto_res[story].add(task_name) return sto_res def map_baselines_to_stories(baselines): @@ -398,46 +398,38 @@ def prepare_detections(detections, deployments, OUTPUT_PATH): if data_model: detection['data_model'] = data_model - matched_deployment = get_deployments(detection, deployments) - detection['deployment'] = matched_deployment - nes_fields = get_nes_fields(detection['search'], detection['deployment']) - if len(nes_fields) > 0: - detection['nes_fields'] = nes_fields + if detection['type'] != 'Investigation': + matched_deployment = get_deployments(detection, deployments) + detection['deployment'] = matched_deployment + nes_fields = get_nes_fields(detection['search'], detection['deployment']) + if len(nes_fields) > 0: + detection['nes_fields'] = nes_fields - keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist'] - mappings = {} - for key in keys: - if key == 'mitre_attack': - if 'mitre_attack_id' in detection['tags']: - mappings[key] = detection['tags']['mitre_attack_id'] - else: - if key in detection['tags']: - mappings[key] = detection['tags'][key] - detection['mappings'] = mappings + keys = ['mitre_attack', 'kill_chain_phases', 'cis20', 'nist'] + mappings = {} + for key in keys: + if key == 'mitre_attack': + if 'mitre_attack_id' in detection['tags']: + mappings[key] = detection['tags']['mitre_attack_id'] + else: + if key in detection['tags']: + mappings[key] = detection['tags'][key] + detection['mappings'] = mappings - detection = add_annotations(detection) - detection = add_rba(detection) + detection = add_annotations(detection) + detection = add_rba(detection) - # add additional metadata - if 'product' in detection['tags']: - detection['product'] = detection['tags']['product'] + # add additional metadata + if 'product' in detection['tags']: + detection['product'] = detection['tags']['product'] - # turn all SAAWS detections - if (OUTPUT_PATH) == 'dist/saaws': - detection['disabled'] = 'false' + # turn all SAAWS detections + if (OUTPUT_PATH) == 'dist/saaws': + detection['disabled'] = 'false' return detections -def prepare_response_tasks(response_tasks): - for response_task in response_tasks: - if 'search' in response_task: - data_model = parse_data_models_from_search(response_task['search']) - if data_model: - response_task['data_model'] = data_model - - return response_tasks - -def prepare_stories(stories, detections, response_tasks): +def prepare_stories(stories, detections): # enrich stories with information from detections: data_models, mitre_ids, kill_chain_phases, nists sto_to_data_models = {} sto_to_mitre_attack_ids = {} @@ -495,7 +487,7 @@ def prepare_stories(stories, detections, response_tasks): else: sto_to_nists[story] = set(detection['tags']['nist']) - sto_res = map_response_tasks_to_stories(response_tasks) + sto_res = map_response_tasks_to_stories(detections) sto_bas = map_baselines_to_stories(baselines) for story in stories: @@ -567,7 +559,6 @@ def import_objects(VERBOSE, REPO_PATH): "macros": load_objects("macros/*.yml", VERBOSE, REPO_PATH), "lookups": load_objects("lookups/*.yml", VERBOSE, REPO_PATH), "responses": load_objects("responses/*.yml", VERBOSE, REPO_PATH), - "response_tasks": load_objects("response_tasks/*.yml", VERBOSE, REPO_PATH), "deployments": load_objects("deployments/*.yml", VERBOSE, REPO_PATH), "detections": load_objects("detections/*/*.yml", VERBOSE, REPO_PATH), } @@ -586,12 +577,10 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH): # only use ESCU stories to the configuration objects["stories"] = sorted(filter(lambda s: not 'Splunk Behavioral Analytics' in s['tags']['product'], objects["stories"]), key=lambda s: s['name']) - objects["response_tasks"] = sorted(objects["response_tasks"], key=lambda i: i['name']) objects["macros"] = sorted(objects["macros"], key=lambda m: m['name']) objects["detections"] = prepare_detections(objects["detections"], objects["deployments"], OUTPUT_PATH) - objects["response_tasks"] = prepare_response_tasks(objects["response_tasks"]) - objects["stories"] = prepare_stories(objects["stories"], objects["detections"], objects["response_tasks"]) + objects["stories"] = prepare_stories(objects["stories"], objects["detections"]) return objects @@ -618,15 +607,15 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE): lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH) lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH) - detection_path = generate_savedsearches_conf(objects["detections"], objects["response_tasks"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH) + detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH) - story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], objects["response_tasks"], TEMPLATE_PATH, OUTPUT_PATH) + story_path = generate_analytic_story_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) - use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], objects["response_tasks"], TEMPLATE_PATH, OUTPUT_PATH) + use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH) - workbench_panels_objects = generate_workbench_panels(objects["response_tasks"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH) + workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH) # calculate deprecation totals deprecated = [] @@ -638,7 +627,6 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE): print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), story_path)) print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path)) print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path)) - print("{0} response tasks have been successfully written to {1}".format(len(objects["response_tasks"]), detection_path)) print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path)) print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*")) print("security content generation completed..") diff --git a/bin/jinja2_templates/savedsearches.j2 b/bin/jinja2_templates/savedsearches.j2 index ea93a252d1..e18485fe00 100644 --- a/bin/jinja2_templates/savedsearches.j2 +++ b/bin/jinja2_templates/savedsearches.j2 @@ -162,37 +162,39 @@ search = {{ detection.search }} ### ESCU RESPONSE TASKS ### -{% for response_task in response_tasks %} -{% if response_task.search is defined %} -[ESCU - {{ response_task.name }} - Response Task] +{% for detection in detections %} +{% if (detection.type == 'Investigation') %} +{% if detection.search is defined %} +[ESCU - {{ detection.name }} - Response Task] action.escu = 0 action.escu.enabled = 1 action.escu.search_type = investigative -action.escu.full_search_name = ESCU - {{ response_task.name }} - Response Task -description = {{ response_task.description }} -action.escu.creation_date = {{ response_task.date }} -action.escu.modification_date = {{ response_task.date }} -{% if response_task.tags is defined %} -action.escu.analytic_story = {{ response_task.tags.analytic_story | tojson }} +action.escu.full_search_name = ESCU - {{ detection.name }} - Response Task +description = {{ detection.description }} +action.escu.creation_date = {{ detection.date }} +action.escu.modification_date = {{ detection.date }} +{% if detection.tags is defined %} +action.escu.analytic_story = {{ detection.tags.analytic_story | tojson }} {% else %} action.escu.analytic_story = [] {% endif %} action.escu.earliest_time_offset = 3600 action.escu.latest_time_offset = 86400 action.escu.providing_technologies = [] -{% if response_task.data_model is defined %} -action.escu.data_models = [{{ response_task.data_model | tojson}}] +{% if detection.data_model is defined %} +action.escu.data_models = [{{ detection.data_model | tojson}}] {% else %} action.escu.data_models = [] {% endif %} -action.escu.eli5 = {{ response_task.description }} +action.escu.eli5 = {{ detection.description }} action.escu.how_to_implement = none action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = {{ response_task.search }} +search = {{ detection.search }} +{% endif %} {% endif %} {% endfor %} diff --git a/bin/jinja2_templates/use_case_library.j2 b/bin/jinja2_templates/use_case_library.j2 index 3f453cb323..e889cb5d3c 100644 --- a/bin/jinja2_templates/use_case_library.j2 +++ b/bin/jinja2_templates/use_case_library.j2 @@ -27,6 +27,7 @@ narrative = {{ story.narrative }} ### DETECTIONS ### {% for detection in detections %} +{% if (detection.type == 'TTP' or detection.type == 'Anomaly' or detection.type == 'Hunting' or detection.type == 'Correlation') %} [savedsearch://ESCU - {{ detection.name }} - Rule] type = detection asset_type = {{ detection.tags.asset_type }} @@ -41,17 +42,19 @@ annotations = {{ detection.mappings | tojson }} known_false_positives = {{ detection.known_false_positives }} providing_technologies = [] +{% endif %} {% endfor %} ### END DETECTIONS ### ### RESPONSE TASKS ### -{% for response_task in response_tasks %} -[savedsearch://ESCU - {{ response_task.name }} - Response Task] +{% for detection in detections %} +{% if (detection.type == 'Investigation') %} +[savedsearch://ESCU - {{ detection.name }} - Response Task] type = investigation explanation = none -{% if response_task.how_to_implement is defined %} -how_to_implement = {{ response_task.how_to_implement }} +{% if detection.how_to_implement is defined %} +how_to_implement = {{ detection.how_to_implement }} {% else %} how_to_implement = none {% endif %} @@ -59,6 +62,7 @@ known_false_positives = not defined earliest_time_offset = 14400 latest_time_offset = 0 +{% endif %} {% endfor %} ### END RESPONSE TASKS ### diff --git a/bin/reporting.py b/bin/reporting.py index 8280aa4c1d..21b44d1841 100644 --- a/bin/reporting.py +++ b/bin/reporting.py @@ -54,7 +54,7 @@ def main(args): counter_detection=0 for detection in detections: - if detection['type'] != 'Baseline': + if detection['type'] != 'Baseline' and detection['type'] != 'Investigation': counter_detection=counter_detection+1 for test in tests: diff --git a/bin/reporting/detection_count.svg b/bin/reporting/detection_count.svg index 13cc1e0941..299a0c093f 100644 --- a/bin/reporting/detection_count.svg +++ b/bin/reporting/detection_count.svg @@ -13,6 +13,6 @@ detections - 458 + 514 \ No newline at end of file diff --git a/bin/reporting/detection_coverage.svg b/bin/reporting/detection_coverage.svg index c516490f8f..ed37733b35 100644 --- a/bin/reporting/detection_coverage.svg +++ b/bin/reporting/detection_coverage.svg @@ -13,6 +13,6 @@ coverage - 99% + 100% \ No newline at end of file diff --git a/response_tasks/amazon_eks_kubernetes_activity_by_src_ip.yml b/detections/cloud/amazon_eks_kubernetes_activity_by_src_ip.yml similarity index 73% rename from response_tasks/amazon_eks_kubernetes_activity_by_src_ip.yml rename to detections/cloud/amazon_eks_kubernetes_activity_by_src_ip.yml index 9d8fbb8257..6925e3d497 100644 --- a/response_tasks/amazon_eks_kubernetes_activity_by_src_ip.yml +++ b/detections/cloud/amazon_eks_kubernetes_activity_by_src_ip.yml @@ -1,4 +1,5 @@ author: Rod Soto, Splunk +datamodel: [] date: '2020-04-13' description: This search provides investigation data about requests via user agent, authentication request URI, verb and cluster name data against Kubernetes cluster @@ -9,16 +10,26 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late id: a636cca4-7434-4a15-a278-c70734938e39 inputs: - src_ip +known_false_positives: '' name: Amazon EKS Kubernetes activity by src ip -search: sourcetype="aws:cloudwatchlogs:eks" |rename sourceIPs{} as src_ip |search +search: '`aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision - src_ip + src_ip' tags: analytic_story: - Kubernetes Scanning Activity product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - sourceIPs{} + - user.username + - requestURI + - verb + - userAgent + - annotations.authorization.k8s.io/decision + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/aws_investigate_security_hub_alerts_by_dest.yml b/detections/cloud/aws_investigate_security_hub_alerts_by_dest.yml similarity index 70% rename from response_tasks/aws_investigate_security_hub_alerts_by_dest.yml rename to detections/cloud/aws_investigate_security_hub_alerts_by_dest.yml index 63c89f3282..8e2c651fa7 100644 --- a/response_tasks/aws_investigate_security_hub_alerts_by_dest.yml +++ b/detections/cloud/aws_investigate_security_hub_alerts_by_dest.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2020-06-08' description: This search retrieves the all the alerts created by AWS Security Hub for a specific dest(instance_id). @@ -8,12 +9,13 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late id: b0d2e6a8-75fa-4b1b-9486-3d32acadf822 inputs: - dest +known_false_positives: '' name: AWS Investigate Security Hub alerts by dest -search: sourcetype="aws:securityhub:firehose" "findings{}.Resources{}.Type"=AWSEC2Instance +search: '`aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState - Remediation + Remediation' tags: analytic_story: - Cloud Compute Instance @@ -23,5 +25,17 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - findings{}.Resources{}.Type + - findings{}.Resources{}.Id + - instance + - Remediation.Recommendation.Text + - Title + - ProductArn + - Description + - FirstObservedAt + - RecordState + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/aws_investigate_user_activities_by_accesskeyid.yml b/detections/cloud/aws_investigate_user_activities_by_accesskeyid.yml similarity index 72% rename from response_tasks/aws_investigate_user_activities_by_accesskeyid.yml rename to detections/cloud/aws_investigate_user_activities_by_accesskeyid.yml index ae51026b63..7669135fd5 100644 --- a/response_tasks/aws_investigate_user_activities_by_accesskeyid.yml +++ b/detections/cloud/aws_investigate_user_activities_by_accesskeyid.yml @@ -1,4 +1,5 @@ author: David Dorsey, Splunk +datamodel: [] date: '2018-06-08' description: This search retrieves the times, ARN, source IPs, AWS regions, event names, and the result of the event for specific credentials. @@ -8,8 +9,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late id: 703b65a4-a0ae-4171-965d-45507506c64f inputs: - accessKeyId +known_false_positives: '' name: AWS Investigate User Activities By AccessKeyId -search: '| search sourcetype=aws:cloudtrail | rename userIdentity.accessKeyId as accessKeyId| +search: '`cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage' @@ -20,5 +22,15 @@ tags: - Splunk Phantom - Splunk Security Analytics for AWS - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - userIdentity.accessKeyId + - userIdentity.arn + - sourceIPAddress + - awsRegion + - eventName + - errorCode + - errorMessage + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/aws_investigate_user_activities_by_arn.yml b/detections/cloud/aws_investigate_user_activities_by_arn.yml similarity index 78% rename from response_tasks/aws_investigate_user_activities_by_arn.yml rename to detections/cloud/aws_investigate_user_activities_by_arn.yml index 0d40755284..a3f63ebce5 100644 --- a/response_tasks/aws_investigate_user_activities_by_arn.yml +++ b/detections/cloud/aws_investigate_user_activities_by_arn.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2019-04-30' description: This search lists all the logged CloudTrail activities by a specific user ARN and will create a table containing the source of the user, the region of @@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late id: bc91a8cd-35e7-4bb2-6140-e756cc46fd72 inputs: - user +known_false_positives: '' name: AWS Investigate User Activities By ARN -search: '| search sourcetype=aws:cloudtrail | search user=$user$| table _time userIdentity.type +search: '`cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType' tags: analytic_story: @@ -31,5 +33,17 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - user + - userIdentity.type + - userIdentity.userName + - userIdentity.arn + - aws_account_id + - src + - awsRegion + - eventName + - eventType + security_domain: network +type: Investigation version: 2 diff --git a/response_tasks/aws_network_acl_details_from_id.yml b/detections/cloud/aws_network_acl_details_from_id.yml similarity index 73% rename from response_tasks/aws_network_acl_details_from_id.yml rename to detections/cloud/aws_network_acl_details_from_id.yml index d173a7356d..69dd8807f8 100644 --- a/response_tasks/aws_network_acl_details_from_id.yml +++ b/detections/cloud/aws_network_acl_details_from_id.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2017-01-22' description: This search queries AWS description logs and returns all the information about a specific network ACL via network ACL ID @@ -8,8 +9,9 @@ how_to_implement: In order to implement this search, you must install the AWS Ap id: f3fb4d1b-5f33-4b01-b541-c7ah9534c242 inputs: - networkAclId +known_false_positives: '' name: AWS Network ACL Details from ID -search: '| search sourcetype=aws:description| rename id as networkAclId | search networkAclId=$networkAclId$ +search: '`aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.*' tags: analytic_story: @@ -19,5 +21,12 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - id + - account_id + - vpc_id + - network_acl_entries{}.* + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/aws_network_interface_details_via_resourceid.yml b/detections/cloud/aws_network_interface_details_via_resourceid.yml similarity index 72% rename from response_tasks/aws_network_interface_details_via_resourceid.yml rename to detections/cloud/aws_network_interface_details_via_resourceid.yml index e7085dc747..abc8a1a402 100644 --- a/response_tasks/aws_network_interface_details_via_resourceid.yml +++ b/detections/cloud/aws_network_interface_details_via_resourceid.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2018-05-07' description: This search queries AWS configuration logs and returns the information about a specific network interface via network interface ID. The information will @@ -10,8 +11,9 @@ how_to_implement: In order to implement this search, you must install the AWS Ap id: f3fb4d1c-5f33-4b01-b541-c3ah9534c241 inputs: - resourceId +known_false_positives: '' name: AWS Network Interface details via resourceId -search: '| search sourcetype=aws:config resourceId=$resourceId$ | table _time ARN +search: '`aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp' tags: @@ -22,5 +24,15 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - resourceId + - ARN + - relationships{}.resourceType + - relationships{}.name + - relationships{}.resourceId + - configuration.privateIpAddresses{}.privateIpAddress + - configuration.privateIpAddresses{}.association.publicIp + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/aws_s3_bucket_details_via_bucketname.yml b/detections/cloud/aws_s3_bucket_details_via_bucketname.yml similarity index 74% rename from response_tasks/aws_s3_bucket_details_via_bucketname.yml rename to detections/cloud/aws_s3_bucket_details_via_bucketname.yml index aa1f182a77..48bb0b7ed0 100644 --- a/response_tasks/aws_s3_bucket_details_via_bucketname.yml +++ b/detections/cloud/aws_s3_bucket_details_via_bucketname.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2018-06-26' description: This search queries AWS configuration logs and returns the information about a specific S3 bucket. The information returned includes the time the S3 bucket @@ -11,8 +12,9 @@ how_to_implement: To implement this search, you must install the AWS App for Spl id: f3fb2q1c-5f33-4b01-b541-c2ah9534c242 inputs: - bucketName +known_false_positives: '' name: AWS S3 Bucket details via bucketName -search: '| search sourcetype=aws:config | rename resourceId as bucketName |search +search: '`aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList' tags: @@ -21,5 +23,15 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - resourceId + - bucketName + - resourceCreationTime + - vendor_region + - action + - aws_account_id + - supplementaryConfiguration.AccessControlList + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/gcp_kubernetes_activity_by_src_ip.yml b/detections/cloud/gcp_kubernetes_activity_by_src_ip.yml similarity index 68% rename from response_tasks/gcp_kubernetes_activity_by_src_ip.yml rename to detections/cloud/gcp_kubernetes_activity_by_src_ip.yml index 6135ae18ee..786fbfb400 100644 --- a/response_tasks/gcp_kubernetes_activity_by_src_ip.yml +++ b/detections/cloud/gcp_kubernetes_activity_by_src_ip.yml @@ -1,4 +1,5 @@ author: Rod Soto, Splunk +datamodel: [] date: '2020-04-13' description: This search provides investigation data about requests via user agent, authentication request URI, resource path and cluster name data against Kubernetes @@ -10,18 +11,30 @@ how_to_implement: You must install the GCP App for Splunk (version 2.0.0 or late id: c00e7626-92cc-4e06-9a51-b6db0a50bd1f inputs: - src_ip +known_false_positives: '' name: GCP Kubernetes activity by src ip -search: sourcetype="google:gcp:pubsub:message" | rename data.protoPayload.requestMetadata.callerIp +search: '`google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.callerIp as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name - data.resource.type + data.resource.type' tags: analytic_story: - Kubernetes Scanning Activity product: - Splunk Phantom -type: response + required_fields: + - _time + - data.protoPayload.requestMetadata.callerIp + - data.protoPayload.methodName + - data.protoPayload.resourceName + - data.protoPayload.requestMetadata.callerSuppliedUserAgent + - data.protoPayload.authenticationInfo.principalEmail + - data.protoPayload.status.message + - data.resource.labels.cluster_name + - data.resource.type + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_all_aws_activity_from_city.yml b/detections/cloud/get_all_aws_activity_from_city.yml similarity index 77% rename from response_tasks/get_all_aws_activity_from_city.yml rename to detections/cloud/get_all_aws_activity_from_city.yml index 1dfb6a57fc..c1c66c5a7a 100644 --- a/response_tasks/get_all_aws_activity_from_city.yml +++ b/detections/cloud/get_all_aws_activity_from_city.yml @@ -1,4 +1,5 @@ author: David Dorsey, Splunk +datamodel: [] date: '2018-03-19' description: This search retrieves all the activity from a specific city and will create a table containing the time, city, ARN, username, the type of user, the source @@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late id: 0abeeb40-1255-4b68-91d1-7a7eb410c4b8 inputs: - City +known_false_positives: '' name: Get All AWS Activity From City -search: '| search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search +search: '`cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, @@ -22,5 +24,15 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - sourceIPAddress + - userIdentity.arn + - userIdentity.userName + - userIdentity.type + - awsRegion + - eventName + - errorCode + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_all_aws_activity_from_country.yml b/detections/cloud/get_all_aws_activity_from_country.yml similarity index 77% rename from response_tasks/get_all_aws_activity_from_country.yml rename to detections/cloud/get_all_aws_activity_from_country.yml index c40c4738bc..e29eb07ecd 100644 --- a/response_tasks/get_all_aws_activity_from_country.yml +++ b/detections/cloud/get_all_aws_activity_from_country.yml @@ -1,4 +1,5 @@ author: David Dorsey, Splunk +datamodel: [] date: '2018-03-19' description: This search retrieves all the activity from a specific country and will create a table containing the time, country, ARN, username, the type of user, the @@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late id: e763cdb9-00da-41e0-9bda-444debc9501a inputs: - Country +known_false_positives: '' name: Get All AWS Activity From Country -search: '| search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search +search: '`cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, @@ -22,5 +24,15 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - sourceIPAddress + - userIdentity.arn + - userIdentity.userName + - userIdentity.type + - awsRegion + - eventName + - errorCode + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_all_aws_activity_from_ip_address.yml b/detections/cloud/get_all_aws_activity_from_ip_address.yml similarity index 79% rename from response_tasks/get_all_aws_activity_from_ip_address.yml rename to detections/cloud/get_all_aws_activity_from_ip_address.yml index 9103d9b92a..a192921748 100644 --- a/response_tasks/get_all_aws_activity_from_ip_address.yml +++ b/detections/cloud/get_all_aws_activity_from_ip_address.yml @@ -1,4 +1,5 @@ author: David Dorsey, Splunk +datamodel: [] date: '2018-03-19' description: This search retrieves all the activity from a specific IP address and will create a table containing the time, ARN, username, the type of user, the IP @@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late id: 446ec87a-85c6-40d4-b060-bea4498281d6 inputs: - src_ip +known_false_positives: '' name: Get All AWS Activity From IP Address -search: '| search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search +search: '`cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, @@ -27,5 +29,15 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - sourceIPAddress + - userIdentity.arn + - userIdentity.userName + - userIdentity.type + - awsRegion + - eventName + - errorCode + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_all_aws_activity_from_region.yml b/detections/cloud/get_all_aws_activity_from_region.yml similarity index 77% rename from response_tasks/get_all_aws_activity_from_region.yml rename to detections/cloud/get_all_aws_activity_from_region.yml index 8bc66897eb..899baa314e 100644 --- a/response_tasks/get_all_aws_activity_from_region.yml +++ b/detections/cloud/get_all_aws_activity_from_region.yml @@ -1,4 +1,5 @@ author: David Dorsey, Splunk +datamodel: [] date: '2018-03-19' description: This search retrieves all the activity from a specific geographic region and will create a table containing the time, geographic region, ARN, username, the @@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late id: 5b794bef-1743-4f6f-804a-43915a2702ff inputs: - Region +known_false_positives: '' name: Get All AWS Activity From Region -search: '| search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search +search: '`cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, @@ -22,5 +24,15 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - sourceIPAddress + - userIdentity.arn + - userIdentity.userName + - userIdentity.type + - awsRegion + - eventName + - errorCode + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_ec2_instance_details_by_instanceid.yml b/detections/cloud/get_ec2_instance_details_by_instanceid.yml similarity index 82% rename from response_tasks/get_ec2_instance_details_by_instanceid.yml rename to detections/cloud/get_ec2_instance_details_by_instanceid.yml index f136876519..152b9a378c 100644 --- a/response_tasks/get_ec2_instance_details_by_instanceid.yml +++ b/detections/cloud/get_ec2_instance_details_by_instanceid.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2018-02-12' description: This search queries AWS description logs and returns all the information about a specific instance via the instanceId field @@ -8,8 +9,9 @@ how_to_implement: In order to implement this search, you must install the AWS Ap id: f3db4d1b-5f33-4b01-c541-c7ah9514c242 inputs: - instanceId +known_false_positives: '' name: Get EC2 Instance Details by instanceId -search: '| search sourcetype="aws:description" source="*:ec2_instances"| dedup id +search: '`aws_description` | dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, @@ -28,5 +30,19 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - id + - ip_address + - tags + - aws_account_id + - placement + - instance_type + - key_name + - launch_time + - state + - vpc_id + - subnet_id + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_ec2_launch_details.yml b/detections/cloud/get_ec2_launch_details.yml similarity index 68% rename from response_tasks/get_ec2_launch_details.yml rename to detections/cloud/get_ec2_launch_details.yml index 6188898c8a..9374520bea 100644 --- a/response_tasks/get_ec2_launch_details.yml +++ b/detections/cloud/get_ec2_launch_details.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2018-03-12' description: This search returns some of the launch details for a EC2 instance. how_to_implement: In order to implement this search, you must install the AWS App @@ -7,8 +8,9 @@ how_to_implement: In order to implement this search, you must install the AWS Ap id: 0e40fe83-3edb-4d86-8206-8fed36529ca6 inputs: - dest +known_false_positives: '' name: Get EC2 Launch Details -search: '| search sourcetype=aws:cloudtrail dest=$dest$ |rename userIdentity.arn as +search: '`cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table @@ -22,5 +24,15 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - dest + - userIdentity.arn + - responseElements.instancesSet.items{}.instanceId + - responseElements.instancesSet.items{}.privateIpAddress + - responseElements.instancesSet.items{}.imageId + - responseElements.instancesSet.items{}.architecture + - responseElements.instancesSet.items{}.keyName + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/investigate_aws_activities_via_region_name.yml b/detections/cloud/investigate_aws_activities_via_region_name.yml similarity index 77% rename from response_tasks/investigate_aws_activities_via_region_name.yml rename to detections/cloud/investigate_aws_activities_via_region_name.yml index 49a29a7261..e853561221 100644 --- a/response_tasks/investigate_aws_activities_via_region_name.yml +++ b/detections/cloud/investigate_aws_activities_via_region_name.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2018-02-09' description: This search lists all the user activities logged by CloudTrail for a specific region in question and will create a table of the values of parameters @@ -9,8 +10,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late id: bc91a8cd-35e7-4bb2-6140-e756cc46fd11 inputs: - vendor_region +known_false_positives: '' name: Investigate AWS activities via region name -search: '| search sourcetype=aws:cloudtrail vendor_region=$vendor_region$| rename +search: '`cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region' tags: @@ -22,5 +24,12 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - vendor_region + - requestParameters.instancesSet.items{}.instanceId + - eventName + - user + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/investigate_aws_user_activities_by_user_field.yml b/detections/cloud/investigate_aws_user_activities_by_user_field.yml similarity index 72% rename from response_tasks/investigate_aws_user_activities_by_user_field.yml rename to detections/cloud/investigate_aws_user_activities_by_user_field.yml index e59ea6131f..55b254d592 100644 --- a/response_tasks/investigate_aws_user_activities_by_user_field.yml +++ b/detections/cloud/investigate_aws_user_activities_by_user_field.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2018-03-12' description: This search lists all the logged CloudTrail activities by a specific user and will create a table containing the source of the user, the region of the @@ -10,8 +11,9 @@ how_to_implement: You must install the AWS App for Splunk (version 5.1.0 or late id: bc91a8cd-35e7-4bb2-6140-e756cc46fd76 inputs: - user +known_false_positives: '' name: Investigate AWS User Activities by user field -search: '| search sourcetype=aws:cloudtrail user=$user$ | table _time userIdentity.type +search: '`cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType ' tags: analytic_story: @@ -20,5 +22,17 @@ tags: product: - Splunk Phantom - Splunk Security Analytics for AWS -type: response + required_fields: + - _time + - user + - userIdentity.type + - userIdentity.userName + - userIdentity.arn + - aws_account_id + - src + - awsRegion + - eventName + - eventType + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/investigate_okta_activity_by_app.yml b/detections/cloud/investigate_okta_activity_by_app.yml similarity index 55% rename from response_tasks/investigate_okta_activity_by_app.yml rename to detections/cloud/investigate_okta_activity_by_app.yml index 54e4d103aa..d14d2fd327 100644 --- a/response_tasks/investigate_okta_activity_by_app.yml +++ b/detections/cloud/investigate_okta_activity_by_app.yml @@ -1,18 +1,32 @@ author: Rico Valdez, Splunk +datamodel: [] date: '2020-04-02' description: This search returns all okta events associated with a specific app how_to_implement: You must be ingesting Okta logs id: 420eb1b8-2992-45d1-80cf-0b1b2759524d inputs: - app +known_false_positives: '' name: Investigate Okta Activity by app -search: eventtype=okta_log app=$app$ | rename client.geographicalContext.country as +search: '`okta` app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city - as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason + as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' tags: analytic_story: - Suspicious Okta Activity product: - Splunk Phantom -type: response + required_fields: + - _time + - app + - client.geographicalContext.country + - client.geographicalContext.state + - client.geographicalContext.city + - user + - displayMessage + - src_ip + - result + - outcome.reason + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/investigate_okta_activity_by_ip_address.yml b/detections/cloud/investigate_okta_activity_by_ip_address.yml similarity index 55% rename from response_tasks/investigate_okta_activity_by_ip_address.yml rename to detections/cloud/investigate_okta_activity_by_ip_address.yml index 7ccd7c7067..892a99a109 100644 --- a/response_tasks/investigate_okta_activity_by_ip_address.yml +++ b/detections/cloud/investigate_okta_activity_by_ip_address.yml @@ -1,18 +1,32 @@ author: Rico Valdez, Splunk +datamodel: [] date: '2020-04-02' description: This search returns all okta events from a specific IP address. how_to_implement: You must be ingesting Okta logs id: 56aae066-d619-477c-93e3-3fb83b2d23c3 inputs: - user +known_false_positives: '' name: Investigate Okta Activity by IP Address -search: eventtype=okta_log src_ip={src_ip} | rename client.geographicalContext.country +search: '`okta` src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city - as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason + as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' tags: analytic_story: - Suspicious Okta Activity product: - Splunk Phantom -type: response + required_fields: + - _time + - app + - client.geographicalContext.country + - client.geographicalContext.state + - client.geographicalContext.city + - user + - displayMessage + - src_ip + - result + - outcome.reason + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/investigate_user_activities_in_okta.yml b/detections/cloud/investigate_user_activities_in_okta.yml similarity index 55% rename from response_tasks/investigate_user_activities_in_okta.yml rename to detections/cloud/investigate_user_activities_in_okta.yml index c8d1a3223a..f3b67392a7 100644 --- a/response_tasks/investigate_user_activities_in_okta.yml +++ b/detections/cloud/investigate_user_activities_in_okta.yml @@ -1,18 +1,31 @@ author: Rico Valdez, Splunk +datamodel: [] date: '2020-04-02' description: This search returns all okta events by a specific user how_to_implement: You must be ingesting Okta logs id: 24ff145d-4d16-420a-b047-480f2a51c403 inputs: - user +known_false_positives: '' name: Investigate User Activities In Okta -search: eventtype=okta_log user=$user$ | rename client.geographicalContext.country +search: '`okta` user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city - as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason + as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason' tags: analytic_story: - Suspicious Okta Activity product: - Splunk Phantom -type: response + required_fields: + - _time + - client.geographicalContext.country + - client.geographicalContext.state + - client.geographicalContext.city + - user + - displayMessage + - src_ip + - result + - outcome.reason + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_backup_logs_for_endpoint.yml b/detections/endpoint/get_backup_logs_for_endpoint.yml similarity index 70% rename from response_tasks/get_backup_logs_for_endpoint.yml rename to detections/endpoint/get_backup_logs_for_endpoint.yml index 6201da7bdc..2fa5c53383 100644 --- a/response_tasks/get_backup_logs_for_endpoint.yml +++ b/detections/endpoint/get_backup_logs_for_endpoint.yml @@ -1,4 +1,5 @@ author: David Dorsey, Splunk +datamodel: [] date: '2017-09-14' description: This search will tell you the backup status from your netbackup_logs of a specific endpoint for the last week. @@ -6,8 +7,9 @@ how_to_implement: You must be ingesting your backup logs. id: fdcfb369-1725-4c24-824a-22972d7f0d44 inputs: - dest +known_false_positives: '' name: Get Backup Logs For Endpoint -search: '| search sourcetype="netbackup_logs" COMPUTERNAME=$dest$ | rename COMPUTERNAME +search: '`netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as signature | table _time, dest, signature' tags: analytic_story: @@ -15,5 +17,10 @@ tags: - SamSam Ransomware product: - Splunk Phantom -type: response + required_fields: + - _time + - COMPUTERNAME + - MESSAGE + security_domain: endpoint +type: Investigation version: 1 diff --git a/response_tasks/get_logon_rights_modifications_for_endpoint.yml b/detections/endpoint/get_logon_rights_modifications_for_endpoint.yml similarity index 72% rename from response_tasks/get_logon_rights_modifications_for_endpoint.yml rename to detections/endpoint/get_logon_rights_modifications_for_endpoint.yml index 7fb0ce4cc2..80d5b337e1 100644 --- a/response_tasks/get_logon_rights_modifications_for_endpoint.yml +++ b/detections/endpoint/get_logon_rights_modifications_for_endpoint.yml @@ -1,4 +1,5 @@ author: David Dorsey, Splunk +datamodel: [] date: '2017-09-12' description: This search allows you to retrieve any modifications to logon rights associated with a specific host. @@ -7,8 +8,9 @@ how_to_implement: To successfully implement this search you must be ingesting yo id: 03bffe94-ec7a-4cbe-b677-6af40d1c4505 inputs: - dest +known_false_positives: '' name: Get Logon Rights Modifications For Endpoint -search: '| search eventtype=wineventlog_security (signature_id=4718 OR signature_id=4717) +search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature' tags: @@ -16,5 +18,11 @@ tags: - Account Monitoring and Controls product: - Splunk Phantom -type: response + required_fields: + - _time + - signature_id + - dest + - user + security_domain: endpoint +type: Investigation version: 2 diff --git a/response_tasks/get_logon_rights_modifications_for_user.yml b/detections/endpoint/get_logon_rights_modifications_for_user.yml similarity index 72% rename from response_tasks/get_logon_rights_modifications_for_user.yml rename to detections/endpoint/get_logon_rights_modifications_for_user.yml index 91ce50d68d..4df9c5d786 100644 --- a/response_tasks/get_logon_rights_modifications_for_user.yml +++ b/detections/endpoint/get_logon_rights_modifications_for_user.yml @@ -1,4 +1,5 @@ author: David Dorsey, Splunk +datamodel: [] date: '2019-02-27' description: This search allows you to retrieve any modifications to logon rights for a specific user account. @@ -7,8 +8,9 @@ how_to_implement: To successfully implement this search you must be ingesting yo id: 552bc86c-f72c-4d44-b3f2-06ede13af7bb inputs: - user +known_false_positives: '' name: Get Logon Rights Modifications For User -search: '| search eventtype=wineventlog_security (signature_id=4718 OR signature_id=4717) +search: '`wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature' tags: @@ -16,5 +18,11 @@ tags: - Account Monitoring and Controls product: - Splunk Phantom -type: response + required_fields: + - _time + - signature_id + - dest + - user + security_domain: endpoint +type: Investigation version: 2 diff --git a/response_tasks/get_notable_history.yml b/detections/endpoint/get_notable_history.yml similarity index 96% rename from response_tasks/get_notable_history.yml rename to detections/endpoint/get_notable_history.yml index 1bd04fc26b..f012a8c097 100644 --- a/response_tasks/get_notable_history.yml +++ b/detections/endpoint/get_notable_history.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2017-09-20' description: This search queries the notable index and returns all the Notable Events for the particular destination host, giving the analyst an overview of the incidents @@ -8,6 +9,7 @@ how_to_implement: If you are using Enterprise Security you are likely already cr id: 3d6c3213-5fff-4a1e-b57d-b24c262171e7 inputs: - dest +known_false_positives: '' name: Get Notable History search: '| search `notable` | search dest=$dest$ | table _time, dest, rule_name, owner, priority, severity, status_description' @@ -84,5 +86,8 @@ tags: - Windows DNS SIGRed CVE-2020-1350 product: - Splunk Phantom -type: response + required_fields: + - _time + security_domain: endpoint +type: Investigation version: 2 diff --git a/response_tasks/get_parent_process_info.yml b/detections/endpoint/get_parent_process_info.yml similarity index 85% rename from response_tasks/get_parent_process_info.yml rename to detections/endpoint/get_parent_process_info.yml index 168b37e231..8d0c91233e 100644 --- a/response_tasks/get_parent_process_info.yml +++ b/detections/endpoint/get_parent_process_info.yml @@ -1,4 +1,6 @@ author: Bhavin Patel, Splunk +datamodel: +- Endpoint date: '2019-02-28' description: This search queries the Endpoint data model to give you details about the parent process of a process running on a host which is under investigation. @@ -11,8 +13,9 @@ id: fecf2918-670d-4f1c-872b-3d7317a41bf9 inputs: - parent_process_name - dest +known_false_positives: '' name: Get Parent Process Info -search: '| tstats `summariesonly` count values(Processes.process) as process min(_time) +search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` @@ -49,5 +52,12 @@ tags: - Windows Service Abuse product: - Splunk Phantom -type: response + required_fields: + - _time + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + security_domain: endpoint +type: Investigation version: 2 diff --git a/response_tasks/get_process_file_activity.yml b/detections/endpoint/get_process_file_activity.yml similarity index 79% rename from response_tasks/get_process_file_activity.yml rename to detections/endpoint/get_process_file_activity.yml index 2c532ae2ad..bb62bbe9a5 100644 --- a/response_tasks/get_process_file_activity.yml +++ b/detections/endpoint/get_process_file_activity.yml @@ -1,4 +1,6 @@ author: David Dorsey, Splunk +datamodel: +- Endpoint date: '2019-11-06' description: This search returns the file activity for a specific process on a specific endpoint @@ -8,6 +10,7 @@ id: 6a9ad4d9-6ef2-4b85-953f-a37ab256acd5 inputs: - process_name - dest +known_false_positives: '' name: Get Process File Activity search: '| tstats `security_content_summariesonly` values(Filesystem.file_name) as file_name values(Filesystem.dest) as dest, values(Filesystem.process_name) as process_name @@ -21,5 +24,13 @@ tags: - Suspicious Zoom Child Processes product: - Splunk Phantom -type: response + required_fields: + - _time + - Filesystem.file_name + - Filesystem.dest + - Filesystem.process_name + - Filesystem.file_path + - Filesystem.action + security_domain: endpoint +type: Investigation version: 2 diff --git a/response_tasks/get_process_info.yml b/detections/endpoint/get_process_info.yml similarity index 85% rename from response_tasks/get_process_info.yml rename to detections/endpoint/get_process_info.yml index 3cb9d60fe6..29963e4f99 100644 --- a/response_tasks/get_process_info.yml +++ b/detections/endpoint/get_process_info.yml @@ -1,4 +1,6 @@ author: Bhavin Patel, Splunk +datamodel: +- Endpoint date: '2019-04-01' description: This search queries the Endpoint data model to give you details about the process running on a host which is under investigation. To gather the process @@ -9,8 +11,9 @@ id: bc91a8cf-35e7-4bb2-8140-e756cc06fd71 inputs: - process_name - dest +known_false_positives: '' name: Get Process Info -search: '| tstats `summariesonly` count values(Processes.process) as process min(_time) +search: '| tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search process_name= $process_name$ | search dest = $dest$ | `security_content_ctime(firstTime)` @@ -49,5 +52,12 @@ tags: - Windows Service Abuse product: - Splunk Phantom -type: response + required_fields: + - _time + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.dest + security_domain: endpoint +type: Investigation version: 2 diff --git a/response_tasks/get_process_information_for_port_activity.yml b/detections/endpoint/get_process_information_for_port_activity.yml similarity index 84% rename from response_tasks/get_process_information_for_port_activity.yml rename to detections/endpoint/get_process_information_for_port_activity.yml index b53d7cd8db..9364c19a93 100644 --- a/response_tasks/get_process_information_for_port_activity.yml +++ b/detections/endpoint/get_process_information_for_port_activity.yml @@ -1,4 +1,6 @@ author: Bhavin Patel, Splunk +datamodel: +- Endpoint date: '2019-04-01' description: This search will return information about the process associated with observed network traffic to a specific destination port from a specific host. @@ -8,6 +10,7 @@ id: 9925d08f-561e-4faa-8912-e3888a842341 inputs: - dest_port - dest +known_false_positives: '' name: Get Process Information For Port Activity search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.process_name Processes.user @@ -31,5 +34,15 @@ tags: - Use of Cleartext Protocols product: - Splunk Phantom -type: response + required_fields: + - _time + - Processes.user + - Processes.process_id + - Processes.process_name + - Processes.dest + - Ports.process_id + - Ports.src + - Ports.dest_port + security_domain: endpoint +type: Investigation version: 2 diff --git a/response_tasks/get_process_responsible_for_the_dns_traffic.yml b/detections/endpoint/get_process_responsible_for_the_dns_traffic.yml similarity index 83% rename from response_tasks/get_process_responsible_for_the_dns_traffic.yml rename to detections/endpoint/get_process_responsible_for_the_dns_traffic.yml index 3028da57f7..c2461d884b 100644 --- a/response_tasks/get_process_responsible_for_the_dns_traffic.yml +++ b/detections/endpoint/get_process_responsible_for_the_dns_traffic.yml @@ -1,4 +1,6 @@ author: Bhavin Patel, Splunk +datamodel: +- Endpoint date: '2019-04-01' description: While investigating, an analyst will want to know what process and parent_process is responsible for generating suspicious DNS traffic. Use the following search and @@ -10,6 +12,7 @@ how_to_implement: You must be ingesting endpoint data that associates processes id: 910e6512-edc9-4f93-ba24-5b786f47a672 inputs: - dest +known_false_positives: '' name: Get Process Responsible For The DNS Traffic search: '| tstats `security_content_summariesonly` count min(_time) max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.parent_process Processes.process_name @@ -30,5 +33,16 @@ tags: - Suspicious DNS Traffic product: - Splunk Phantom -type: response + required_fields: + - _time + - Processes.user + - Processes.process_id + - Processes.process_name + - Processes.dest + - Processes.parent_process + - Ports.process_id + - Ports.src + - Ports.dest_port + security_domain: endpoint +type: Investigation version: 2 diff --git a/response_tasks/get_sysmon_wmi_activity_for_host.yml b/detections/endpoint/get_sysmon_wmi_activity_for_host.yml similarity index 69% rename from response_tasks/get_sysmon_wmi_activity_for_host.yml rename to detections/endpoint/get_sysmon_wmi_activity_for_host.yml index ad8ae0458f..b65961ddfb 100644 --- a/response_tasks/get_sysmon_wmi_activity_for_host.yml +++ b/detections/endpoint/get_sysmon_wmi_activity_for_host.yml @@ -1,4 +1,5 @@ author: Rico Valdez, Splunk +datamodel: [] date: '2018-10-23' description: This search queries Sysmon WMI events for the host of interest. how_to_implement: To successfully implement this search, you must be collecting Sysmon @@ -9,15 +10,28 @@ id: 155e0571-7db6-42f2-aa62-9a3a4cf35c94 inputs: - process - dest +known_false_positives: '' name: Get Sysmon WMI Activity for Host -search: sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode>18 +search: '`sysmon` EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, - Name, Operation, EventType, Type, Query, Consumer, Filter + Name, Operation, EventType, Type, Query, Consumer, Filter' tags: analytic_story: - Ransomware - Suspicious WMI Use product: - Splunk Phantom -type: response + required_fields: + - _time + - EventCode + - user + - Name + - Operation + - EventType + - Type + - Query + - Consumer + - Filter + security_domain: endpoint +type: Investigation version: 1 diff --git a/response_tasks/investigate_failed_logins_for_multiple_destinations.yml b/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml similarity index 82% rename from response_tasks/investigate_failed_logins_for_multiple_destinations.yml rename to detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml index 1c7c9b6440..e2aceebd93 100644 --- a/response_tasks/investigate_failed_logins_for_multiple_destinations.yml +++ b/detections/endpoint/investigate_failed_logins_for_multiple_destinations.yml @@ -1,4 +1,6 @@ author: Patrick Bareiss, Splunk +datamodel: +- Authentication date: '2019-12-10' description: This search returns failed logins to multiple destinations by user. how_to_implement: To successfully implement this search you need to be ingesting authentication @@ -6,6 +8,7 @@ how_to_implement: To successfully implement this search you need to be ingesting id: 097e8030-8662-4254-a735-bf0bdda696e3 inputs: - user +known_false_positives: '' name: Investigate Failed Logins for Multiple Destinations search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login dc(Authentication.dest) AS distinct_count_dest values(Authentication.dest) @@ -18,5 +21,12 @@ tags: - Credential Dumping product: - Splunk Phantom -type: response + required_fields: + - _time + - Authentication.dest + - Authentication.app + - Authentication.action + - Authentication.user + security_domain: endpoint +type: Investigation version: 1 diff --git a/response_tasks/investigate_pass_the_hash_attempts.yml b/detections/endpoint/investigate_pass_the_hash_attempts.yml similarity index 84% rename from response_tasks/investigate_pass_the_hash_attempts.yml rename to detections/endpoint/investigate_pass_the_hash_attempts.yml index 91a03da224..27075ae49b 100644 --- a/response_tasks/investigate_pass_the_hash_attempts.yml +++ b/detections/endpoint/investigate_pass_the_hash_attempts.yml @@ -1,4 +1,5 @@ author: Patrick Bareiss, Splunk +datamodel: [] date: '2019-12-10' description: This search hunts for dumped NTLM hashes used for pass the hash. how_to_implement: To successfully implement this search you need be ingesting windows @@ -10,6 +11,7 @@ how_to_implement: To successfully implement this search you need be ingesting wi id: ed3fff45-cba6-4990-983f-6fac72bee659 inputs: - dest +known_false_positives: '' name: Investigate Pass the Hash Attempts search: '`wineventlog_security` EventCode=4624 Logon_Type=9 AuthenticationPackageName=Negotiate | stats count earliest(_time) as first_login latest(_time) as last_login by src_user @@ -20,5 +22,13 @@ tags: - Credential Dumping product: - Splunk Phantom -type: response + required_fields: + - _time + - EventCode + - Logon_Type + - AuthenticationPackageName + - src_user + - dest + security_domain: endpoint +type: Investigation version: 1 diff --git a/response_tasks/investigate_pass_the_ticket_attempts.yml b/detections/endpoint/investigate_pass_the_ticket_attempts.yml similarity index 88% rename from response_tasks/investigate_pass_the_ticket_attempts.yml rename to detections/endpoint/investigate_pass_the_ticket_attempts.yml index 60686023d6..6a0fa5d016 100644 --- a/response_tasks/investigate_pass_the_ticket_attempts.yml +++ b/detections/endpoint/investigate_pass_the_ticket_attempts.yml @@ -1,4 +1,5 @@ author: Patrick Bareiss, Splunk +datamodel: [] date: '2019-12-10' description: This search hunts for dumped kerberos ticket from LSASS memory. how_to_implement: To successfully implement this search you need to be ingesting windows @@ -10,6 +11,7 @@ how_to_implement: To successfully implement this search you need to be ingesting id: 990007ad-d798-4b29-ab2f-f0034144c937 inputs: - dest +known_false_positives: '' name: Investigate Pass the Ticket Attempts search: '`wineventlog_security` EventCode=4768 OR EventCode=4769 | rex field=user "(?[^\@]+)" | stats count BY new_user, dest, EventCode | stats max(count) @@ -20,5 +22,11 @@ tags: - Credential Dumping product: - Splunk Phantom -type: response + required_fields: + - _time + - EventCode + - user + - dest + security_domain: endpoint +type: Investigation version: 1 diff --git a/response_tasks/investigate_previous_unseen_user.yml b/detections/endpoint/investigate_previous_unseen_user.yml similarity index 84% rename from response_tasks/investigate_previous_unseen_user.yml rename to detections/endpoint/investigate_previous_unseen_user.yml index 9155d639d7..914cd8a6db 100644 --- a/response_tasks/investigate_previous_unseen_user.yml +++ b/detections/endpoint/investigate_previous_unseen_user.yml @@ -1,4 +1,6 @@ author: Patrick Bareiss, Splunk +datamodel: +- Authentication date: '2019-12-10' description: This search returns previous unseen user, which didn't log in for 30 days. @@ -7,6 +9,7 @@ how_to_implement: To successfully implement this search you need to be ingesting id: 5de385bf-4f1e-404e-9b67-92d162ff8938ad inputs: - dest +known_false_positives: '' name: Investigate Previous Unseen User search: '| tstats count `security_content_summariesonly` earliest(_time) as first_login latest(_time) as last_login values(Authentication.dest) AS Authentication.dest values(Authentication.app) @@ -22,5 +25,12 @@ tags: - Credential Dumping product: - Splunk Phantom -type: response + required_fields: + - _time + - Authentication.dest + - Authentication.app + - Authentication.action + - Authentication.user + security_domain: endpoint +type: Investigation version: 1 diff --git a/response_tasks/investigate_successful_remote_desktop_authentications.yml b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml similarity index 79% rename from response_tasks/investigate_successful_remote_desktop_authentications.yml rename to detections/endpoint/investigate_successful_remote_desktop_authentications.yml index 1d8e9c3806..29030b5338 100644 --- a/response_tasks/investigate_successful_remote_desktop_authentications.yml +++ b/detections/endpoint/investigate_successful_remote_desktop_authentications.yml @@ -1,4 +1,6 @@ author: Jose Hernandez, Splunk +datamodel: +- Authentication date: '2018-12-14' description: 'This search returns the source, destination, and user for all successful remote-desktop authentications. A successful authentication after a brute-force @@ -8,6 +10,7 @@ how_to_implement: You must be populating the Authentication data model with secu id: b6618e8e-be04-40a0-a0b9-f0bd4b6c81bc inputs: - dest +known_false_positives: '' name: Investigate Successful Remote Desktop Authentications search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication where Authentication.signature_id=4624 @@ -23,5 +26,15 @@ tags: - SamSam Ransomware product: - Splunk Phantom -type: response + required_fields: + - _time + - Authentication.signature_id + - Authentication.app + - Authentication.src + - Authentication.dest + - Authentication.user + - Authentication.signature + - Authentication.src_nt_domain + security_domain: endpoint +type: Investigation version: 1 diff --git a/response_tasks/get_certificate_logs_for_a_domain.yml b/detections/network/get_certificate_logs_for_a_domain.yml similarity index 74% rename from response_tasks/get_certificate_logs_for_a_domain.yml rename to detections/network/get_certificate_logs_for_a_domain.yml index c3bfe3fbf9..fc0fc1df84 100644 --- a/response_tasks/get_certificate_logs_for_a_domain.yml +++ b/detections/network/get_certificate_logs_for_a_domain.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2019-04-29' description: This search queries the Certificates datamodel and give you all the information for a specific domain. Please note that the certificates issued by "Let's Encrypt" @@ -9,8 +10,9 @@ how_to_implement: You must be ingesting your certificates or SSL logs from your id: bc91a8cf-35e7-4bb2-2240-e756cc06fd73 inputs: - domain +known_false_positives: '' name: Get Certificate logs for a domain -search: '| tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime +search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` @@ -21,5 +23,13 @@ tags: - Common Phishing Frameworks product: - Splunk Phantom -type: response + required_fields: + - _time + - All_Certificates.SSL.ssl_subject_common_name + - All_Certificates.dest + - All_Certificates.src + - All_Certificates.SSL.ssl_issuer_common_name + - All_Certificates.SSL.ssl_hash + security_domain: network +type: Investigation version: 2 diff --git a/response_tasks/get_dns_server_history_for_a_host.yml b/detections/network/get_dns_server_history_for_a_host.yml similarity index 87% rename from response_tasks/get_dns_server_history_for_a_host.yml rename to detections/network/get_dns_server_history_for_a_host.yml index 674b861d5d..00d19efcaa 100644 --- a/response_tasks/get_dns_server_history_for_a_host.yml +++ b/detections/network/get_dns_server_history_for_a_host.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2017-11-09' description: While investigating any detections it is important to understand which and how many DNS servers a host has connected to in the past. This search uses data @@ -9,6 +10,7 @@ how_to_implement: To successfully implement this search, you must be ingesting y id: bc91a8cf-35e7-4bb2-8140-e756cc06fd72 inputs: - src_ip +known_false_positives: '' name: Get DNS Server History for a host search: '| search tag=dns src_ip=$src_ip$ dest_port=53 | streamstats time_window=1d count values(dest_ip) as dcip by src_ip | table date_mday src_ip dcip count | sort @@ -27,5 +29,11 @@ tags: - Suspicious DNS Traffic product: - Splunk Phantom -type: response + required_fields: + - _time + - src_ip + - dest_port + - dest_ip + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_dns_traffic_ratio.yml b/detections/network/get_dns_traffic_ratio.yml similarity index 83% rename from response_tasks/get_dns_traffic_ratio.yml rename to detections/network/get_dns_traffic_ratio.yml index a42f7b008f..80fb04f53b 100644 --- a/response_tasks/get_dns_traffic_ratio.yml +++ b/detections/network/get_dns_traffic_ratio.yml @@ -1,4 +1,6 @@ author: Bhavin Patel, Splunk +datamodel: +- Network_Traffic date: '2017-11-09' description: 'This search calculates the ratio of DNS traffic originating and coming from a host to a list of DNS servers over the last 24 hours. A high value of this @@ -10,6 +12,7 @@ id: bc91a8cf-35e7-4bb2-8140-e756cc06fd73 inputs: - src_ip - dest_ip +known_false_positives: '' name: Get DNS traffic ratio search: '| tstats allow_old_summaries=true sum(All_Traffic.bytes_out) as "bytes_out" sum(All_Traffic.bytes_in) as "bytes_in" from datamodel=Network_Traffic where nodename=All_Traffic @@ -27,5 +30,13 @@ tags: - Suspicious DNS Traffic product: - Splunk Phantom -type: response + required_fields: + - _time + - All_Traffic.bytes_out + - All_Traffic.bytes_in + - All_Traffic.dest_port + - All_Traffic.src + - All_Traffic.dest + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_email_info.yml b/detections/network/get_email_info.yml similarity index 82% rename from response_tasks/get_email_info.yml rename to detections/network/get_email_info.yml index 3e7980027e..452d6709d5 100644 --- a/response_tasks/get_email_info.yml +++ b/detections/network/get_email_info.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2017-11-09' description: This search returns all the information Splunk might have collected a specific email message over the last 2 hours. @@ -7,6 +8,7 @@ how_to_implement: To successfully implement this search you must be ingesting yo id: bc91a8cf-35e7-4bb2-8140-e756cc06fd75 inputs: - message_id +known_false_positives: '' name: Get Email Info search: '| from datamodel Email.All_Email | search message_id=$message_id$' tags: @@ -15,5 +17,9 @@ tags: - Suspicious Emails product: - Splunk Phantom -type: response + required_fields: + - _time + - message + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_emails_from_specific_sender.yml b/detections/network/get_emails_from_specific_sender.yml similarity index 83% rename from response_tasks/get_emails_from_specific_sender.yml rename to detections/network/get_emails_from_specific_sender.yml index d522b40bde..481a9c31aa 100644 --- a/response_tasks/get_emails_from_specific_sender.yml +++ b/detections/network/get_emails_from_specific_sender.yml @@ -1,4 +1,5 @@ author: David Dorsey, Splunk +datamodel: [] date: '2017-11-09' description: This search returns all the emails from a specific sender over the last 24 and next hours. @@ -8,6 +9,7 @@ how_to_implement: To successfully implement this search you must ingest your ema id: 5df39b3f-447d-4869-b673-8f45ad4616fe inputs: - src_user +known_false_positives: '' name: Get Emails From Specific Sender search: '| from datamodel Email.All_Email | search src_user=$src_user$' tags: @@ -17,5 +19,9 @@ tags: - Web Fraud Detection product: - Splunk Phantom -type: response + required_fields: + - _time + - src_user + security_domain: networks +type: Investigation version: 1 diff --git a/response_tasks/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml b/detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml similarity index 73% rename from response_tasks/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml rename to detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml index 03e1d288ec..fd1a8f2915 100644 --- a/response_tasks/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml +++ b/detections/network/get_first_occurrence_and_last_occurrence_of_a_mac_address.yml @@ -1,4 +1,6 @@ author: Bhavin Patel, Splunk +datamodel: +- Network_Sessions date: '2017-09-13' description: This search allows you to gather more context around a notable which has detected a new device connecting to your network. Use this search to determine @@ -9,15 +11,24 @@ how_to_implement: To successfully implement this search, you must be ingesting t id: bc91a8cf-35e7-4bb2-8140-e756cc06fd33 inputs: - src_mac +known_false_positives: '' name: Get First Occurrence and Last Occurrence of a MAC Address search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST - All_Sessions.All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user + All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)`' tags: analytic_story: - Asset Tracking product: - Splunk Phantom -type: response + required_fields: + - _time + - All_Sessions.DHCP + - All_Sessions.signature + - All_Sessions.src_mac + - All_Sessions.src_ip + - All_Sessions.user + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_history_of_email_sources.yml b/detections/network/get_history_of_email_sources.yml similarity index 86% rename from response_tasks/get_history_of_email_sources.yml rename to detections/network/get_history_of_email_sources.yml index 91b9be36ff..26d5036f82 100644 --- a/response_tasks/get_history_of_email_sources.yml +++ b/detections/network/get_history_of_email_sources.yml @@ -1,4 +1,6 @@ author: Rico Valdez, Splunk +datamodel: +- Email date: '2019-02-21' description: This search returns a list of all email sources seen in the 48 hours prior to the notable event to 24 hours after, and the number of emails from each @@ -9,6 +11,7 @@ how_to_implement: To successfully implement this search you must ingest your ema id: ddc7af28-c34d-4392-af93-7f29a4e8806c inputs: - src +known_false_positives: '' name: Get History Of Email Sources search: '|tstats `security_content_summariesonly` values(All_Email.dest) as dest values(All_Email.recipient) as recepient min(_time) as firstTime max(_time) as lastTime count from datamodel=Email.All_Email @@ -26,5 +29,11 @@ tags: - SamSam Ransomware product: - Splunk Phantom -type: response + required_fields: + - _time + - All_Email.dest + - All_Email.recipient + - All_Email.src + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_outbound_emails_to_hidden_cobra_threat_actors.yml b/detections/network/get_outbound_emails_to_hidden_cobra_threat_actors.yml similarity index 85% rename from response_tasks/get_outbound_emails_to_hidden_cobra_threat_actors.yml rename to detections/network/get_outbound_emails_to_hidden_cobra_threat_actors.yml index c057f9797f..951ee307a0 100644 --- a/response_tasks/get_outbound_emails_to_hidden_cobra_threat_actors.yml +++ b/detections/network/get_outbound_emails_to_hidden_cobra_threat_actors.yml @@ -1,4 +1,6 @@ author: Bhavin Patel, Splunk +datamodel: +- Email date: '2018-06-14' description: 'This search returns the information of the users that sent emails to the accounts controlled by the Hidden Cobra Threat Actors: specifically to `misswang8107@gmail.com`, @@ -10,6 +12,7 @@ id: 5df39b3f-347d-4869-b673-8r45ad4616fe inputs: - src_user - recipient +known_false_positives: '' name: Get Outbound Emails to Hidden Cobra Threat Actors search: '| from datamodel Email.All_Email | search recipient=misswang8107@gmail.com OR src_user=redhat@gmail.com | stats count earliest(_time) as firstTime, latest(_time) @@ -20,5 +23,12 @@ tags: - Hidden Cobra Malware product: - Splunk Phantom -type: response + required_fields: + - _time + - recipient + - src_user + - dest + - sec + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/get_web_session_information_via_session_id.yml b/detections/network/get_web_session_information_via_session_id.yml similarity index 75% rename from response_tasks/get_web_session_information_via_session_id.yml rename to detections/network/get_web_session_information_via_session_id.yml index 0037a709fc..240355d696 100644 --- a/response_tasks/get_web_session_information_via_session_id.yml +++ b/detections/network/get_web_session_information_via_session_id.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2018-10-08' description: This search helps an analyst investigate a notable event to find out more about a specific web session. The search looks for a specific web session ID @@ -10,13 +11,21 @@ how_to_implement: This search leverages data extracted from Stream:HTTP. You mus id: bc91a8cf-35e7-4bb2-1120-e756cc06fd89 inputs: - session_id +known_false_positives: '' name: Get Web Session Information via session id -search: '| search sourcetype=stream:http session_id = $session_id$ | stats values(url) +search: '`stream_http` session_id = $session_id$ | stats values(url) values(http_user_agent) by src_ip status' tags: analytic_story: - Web Fraud Detection product: - Splunk Phantom -type: response + required_fields: + - _time + - session_id + - http_user_agent + - src_ip + - status + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/investigate_network_traffic_from_src_ip.yml b/detections/network/investigate_network_traffic_from_src_ip.yml similarity index 80% rename from response_tasks/investigate_network_traffic_from_src_ip.yml rename to detections/network/investigate_network_traffic_from_src_ip.yml index 3ee19e85b5..e33961494a 100644 --- a/response_tasks/investigate_network_traffic_from_src_ip.yml +++ b/detections/network/investigate_network_traffic_from_src_ip.yml @@ -1,4 +1,6 @@ author: David Dorsey, Splunk +datamodel: +- Network_Traffic date: '2018-06-15' description: This search allows you to find all the network traffic from a specific IP address. @@ -7,6 +9,7 @@ how_to_implement: To successfully implement this search, you must be ingesting y id: 9df9ca9c-a02b-4f48-9eba-0bac55179050 inputs: - src_ip +known_false_positives: '' name: Investigate Network Traffic From src ip search: '| from datamodel Network_Traffic.All_Traffic | search src_ip=$src_ip$' tags: @@ -15,5 +18,9 @@ tags: - Splunk Enterprise Vulnerability CVE-2018-11409 product: - Splunk Phantom -type: response + required_fields: + - _time + - src_ip + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/investigate_suspicious_strings_in_http_header.yml b/detections/network/investigate_suspicious_strings_in_http_header.yml similarity index 85% rename from response_tasks/investigate_suspicious_strings_in_http_header.yml rename to detections/network/investigate_suspicious_strings_in_http_header.yml index db9b482aa9..eee30a5356 100644 --- a/response_tasks/investigate_suspicious_strings_in_http_header.yml +++ b/detections/network/investigate_suspicious_strings_in_http_header.yml @@ -1,4 +1,5 @@ author: Bhavin Patel, Splunk +datamodel: [] date: '2017-10-20' description: This search helps an analyst investigate a notable event related to a potential Apache Struts exploitation. To investigate, we will want to isolate and @@ -13,8 +14,9 @@ id: bc91a8cf-35e7-4bb2-8140-e756cc06fd89 inputs: - src_ip - dest_ip +known_false_positives: '' name: Investigate Suspicious Strings in HTTP Header -search: '| search sourcetype=stream:http | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ +search: '`stream_http` | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length > 100 | rex field="cs_content_type" (?cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") | rename suspicious_strings_found AS "Suspicious @@ -25,5 +27,12 @@ tags: - Apache Struts Vulnerability product: - Splunk Phantom -type: response + required_fields: + - _time + - src_ip + - dest_ip + - cs_content_type + - url + security_domain: network +type: Investigation version: 1 diff --git a/response_tasks/investigate_web_posts_from_src.yml b/detections/network/investigate_web_posts_from_src.yml similarity index 82% rename from response_tasks/investigate_web_posts_from_src.yml rename to detections/network/investigate_web_posts_from_src.yml index cef7a6b8f5..89654094b6 100644 --- a/response_tasks/investigate_web_posts_from_src.yml +++ b/detections/network/investigate_web_posts_from_src.yml @@ -1,4 +1,6 @@ author: Jose Hernandez, Splunk +datamodel: +- Web date: '2018-12-06' description: 'This investigative search retrieves POST requests from a specified source IP or hostname. Identifying the POST requests, as well as their associated destination @@ -8,6 +10,7 @@ how_to_implement: To successfully implement this search, you must be ingesting y id: f5c39fac-205c-4e07-9004-8fd61ea3431a inputs: - src +known_false_positives: '' name: Investigate Web POSTs From src search: '| tstats `security_content_summariesonly` values(Web.url) as url from datamodel=Web by Web.src,Web.http_user_agent,Web.http_method | `drop_dm_object_name("Web")`| search @@ -17,5 +20,12 @@ tags: - Apache Struts Vulnerability product: - Splunk Phantom -type: response + required_fields: + - _time + - Web.url + - Web.src + - Web.http_user_agent + - Web.http_method + security_domain: network +type: Investigation version: 1 diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index 2f775cd27f..8d1d346f03 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-23T08:46:10 UTC +# On Date: 2021-07-26T11:37:21 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ modification_date = 2018-06-04 id = 2f2f610a-d64d-48c2-b57c-967a2b49ab5a version = 1 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] -detection_searches = ["ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By AccessKeyId - Rule", "ESCU - Get Notable History - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule"] mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078", "T1550"]} investigative_searches = ["ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Previously Seen AWS Cross Account Activity"] @@ -51,11 +51,11 @@ modification_date = 2018-05-21 id = 2e8948a5-5239-406b-b56b-6c50ff268af4 version = 2 reference = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] -detection_searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"] mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1562.007"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of Network ACL Activity by ARN", "ESCU - Baseline of blocked outbound traffic from AWS"] -data_models = [] +data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -68,7 +68,7 @@ modification_date = 2020-08-04 id = 2f2f610a-d64d-48c2-b57c-96722b49ab5a version = 1 reference = ["https://aws.amazon.com/security-hub/features/"] -detection_searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule"] mappings = {"cis20": ["CIS 13"], "nist": ["DE.AE", "DE.DP"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] support_searches = [] @@ -85,7 +85,7 @@ modification_date = 2018-03-12 id = 2e8948a5-5239-406b-b56b-6c50f1269af3 version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] -detection_searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule"] +detection_searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule"] mappings = {"cis20": ["CIS 1", "CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1526"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] support_searches = ["ESCU - Baseline of API Calls per User ARN", "ESCU - Baseline of Security Group Activity by ARN", "ESCU - Create a list of approved AWS service accounts", "ESCU - Previously seen API call per user roles in CloudTrail"] @@ -124,11 +124,11 @@ modification_date = 2018-12-06 id = 2dcfd6a2-e7d2-4873-b6ba-adaf819d2a1e version = 1 reference = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] -detection_searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"] +detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Suspicious Strings in HTTP Header - Rule", "ESCU - Investigate Web POSTs From src - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule"] mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 3", "CIS 4", "CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT", "RS.MI"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] support_searches = [] -data_models = ["Endpoint"] +data_models = ["Endpoint", "Web"] providing_technologies = none description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ @@ -154,7 +154,7 @@ modification_date = 2017-09-13 id = 91c676cf-0b23-438d-abee-f6335e1fce77 version = 1 reference = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"] -detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule"] +detection_searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Rule", "ESCU - Get Notable History - Rule"] mappings = {"cis20": ["CIS 1"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Reconnaissance"], "nist": ["ID.AM", "PR.DS"]} investigative_searches = ["ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Count of assets by category"] @@ -205,11 +205,11 @@ modification_date = 2017-12-19 id = 91c676cf-0b23-438d-abee-f6335e1fce78 version = 1 reference = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] -detection_searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"] +detection_searches = ["ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule"] mappings = {"cis20": ["CIS 7"], "kill_chain_phases": ["Actions on Objectives", "Delivery"], "nist": ["PR.IP"]} investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - DNSTwist Domain Names"] -data_models = ["Email", "Network_Resolution", "Web"] +data_models = ["Email", "Endpoint", "Network_Resolution", "Web"] providing_technologies = none description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ @@ -241,7 +241,7 @@ modification_date = 2019-10-02 id = 3b96d13c-fdc7-45dd-b3ad-c132b31cdd2a version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] -detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule"] +detection_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP", "ID.AM"]} investigative_searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Compute Creations By User - Initial", "ESCU - Previously Seen Cloud Compute Creations By User - Update", "ESCU - Previously Seen Cloud Compute Images - Initial", "ESCU - Previously Seen Cloud Compute Images - Update", "ESCU - Previously Seen Cloud Compute Instance Types - Initial", "ESCU - Previously Seen Cloud Compute Instance Types - Update", "ESCU - Previously Seen Cloud Regions - Initial", "ESCU - Previously Seen Cloud Regions - Update"] @@ -304,7 +304,7 @@ modification_date = 2019-01-09 id = bd91a2bc-d20b-4f44-a982-1bea98e86390 version = 1 reference = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] -detection_searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"] +detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Network Traffic From src ip - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule"] mappings = {"cis20": ["CIS 4", "CIS 8"], "kill_chain_phases": ["Command and Control", "Installation"], "nist": ["DE.CM", "DE.DP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] support_searches = [] @@ -323,7 +323,7 @@ modification_date = 2020-02-03 id = 8e03c61e-13c4-4dcd-bfbe-5ce5a8dc031a version = 1 reference = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] -detection_searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"] +detection_searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule"] mappings = {"cis20": ["CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1036", "T1114.001", "T1114.002", "T1560.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -342,7 +342,7 @@ modification_date = 2018-06-01 id = 943773c6-c4de-4f38-89a8-0b92f98804d8 version = 1 reference = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] -detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] mappings = {"cis20": ["CIS 1", "CIS 11", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.001", "T1071.004", "T1095", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of blocked outbound traffic from AWS"] @@ -377,11 +377,11 @@ modification_date = 2020-02-04 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] -detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] +detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] support_searches = [] -data_models = ["Endpoint"] +data_models = ["Authentication", "Endpoint"] providing_technologies = none description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ @@ -396,7 +396,7 @@ modification_date = 2020-01-22 id = 0c016e5c-88be-4e2c-8c6c-c2b55b4fb4ef version = 2 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] -detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"] +detection_searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process File Activity - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 2", "CIS 3", "CIS 5", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Execution", "Exploitation", "Installation", "Lateral Movement"], "mitre_attack": ["T1021.002", "T1053.005", "T1059.001", "T1059.003", "T1071.002", "T1112", "T1136.001", "T1204.002", "T1543.003", "T1547.001", "T1562.004", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] @@ -416,7 +416,7 @@ modification_date = 2016-09-13 id = e8afd39e-3294-11e6-b39d-a45e60c6700 version = 1 reference = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://www.imperva.com/learn/application-security/dns-amplification/"] -detection_searches = ["ESCU - Large Volume of DNS ANY Queries - Rule"] +detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Large Volume of DNS ANY Queries - Rule"] mappings = {"cis20": ["CIS 11", "CIS 12"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1498.002"], "nist": ["DE.AE", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -434,9 +434,9 @@ modification_date = 2020-02-04 id = 8169f17b-ef68-4b59-aa28-586907301221 version = 1 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] -detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule"] +detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} -investigative_searches = ["ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task"] support_searches = ["ESCU - Discover DNS records"] data_models = ["Network_Resolution"] providing_technologies = none @@ -476,7 +476,7 @@ modification_date = 2020-10-21 id = 66b0fe0c-1351-11eb-adc1-0242ac120002 version = 1 reference = ["https://attack.mitre.org/tactics/TA0010/"] -detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"] +detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"] mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1041", "T1048", "T1048.003", "T1114", "T1114.001", "T1114.003", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -493,11 +493,11 @@ modification_date = 2017-09-14 id = 91c676cf-0b23-438d-abee-f6335e1fce33 version = 1 reference = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] -detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule"] +detection_searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1048.003", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = [] -data_models = ["Change_Analysis", "Network_Resolution"] +data_models = ["Change_Analysis", "Endpoint", "Network_Resolution", "Network_Traffic"] providing_technologies = none description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -527,7 +527,7 @@ modification_date = 2020-09-18 id = 5d14a962-569e-4578-939f-f386feb63ce4 version = 1 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] -detection_searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule"] +detection_searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Rule"] mappings = {"cis20": ["CIS 11", "CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1003.001", "T1190", "T1210"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -544,7 +544,7 @@ modification_date = 2020-02-04 id = fcc27099-46a0-46b0-a271-5c7dab56b6f1 version = 2 reference = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] -detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"] +detection_searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1112", "T1543.003", "T1553.004", "T1562.001", "T1562.004"], "nist": ["DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] @@ -578,11 +578,11 @@ modification_date = 2018-09-06 id = 8169f17b-ef68-4b59-aae8-586907301221 version = 2 reference = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] -detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule"] +detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = [] -data_models = ["Endpoint", "Network_Resolution", "Web"] +data_models = ["Endpoint", "Network_Resolution", "Network_Traffic", "Web"] providing_technologies = none description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and deny lists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified. @@ -595,7 +595,7 @@ modification_date = 2020-01-27 id = bb9f5ed2-916e-4364-bb6d-91c310efcf52 version = 1 reference = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] -detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] +detection_searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 2", "CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation", "Installation"], "mitre_attack": ["T1021.002", "T1059.003", "T1072", "T1547.001", "T1566.001"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security", "ESCU - Baseline of SMB Traffic - MLTK"] @@ -614,7 +614,7 @@ modification_date = 2020-08-02 id = 7678c968-d46e-11ea-87d0-0242ac130003 version = 1 reference = ["https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/", "https://support.f5.com/csp/article/K52145254", "https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/"] -detection_searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule"] +detection_searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get Notable History - Rule"] mappings = {"cis20": ["CIS 11", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1190"], "nist": ["DE.CM"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -631,7 +631,7 @@ modification_date = 2020-09-01 id = 0432039c-ef41-4b03-b157-450c25dad1e6 version = 1 reference = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] -detection_searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule"] +detection_searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - Get Notable History - Rule", "ESCU - gcp detect oauth token abuse - Rule"] mappings = {"kill_chain_phases": ["Lateral Movement"], "mitre_attack": ["T1078"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -669,11 +669,11 @@ modification_date = 2020-01-22 id = baf7580b-d4b4-4774-8173-7d198e9da335 version = 2 reference = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] -detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"] +detection_searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1021.001", "T1021.002", "T1048.003", "T1059.001", "T1059.003", "T1070.005", "T1071.002", "T1071.004"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] support_searches = ["ESCU - Baseline of DNS Query Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] -data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"] +data_models = ["Authentication", "Email", "Endpoint", "Network_Resolution", "Network_Traffic"] providing_technologies = none description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ @@ -706,7 +706,7 @@ modification_date = 2017-09-14 id = 1f5294cb-b85f-4c2d-9c58-ffcf248f52bd version = 1 reference = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"] -detection_searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule"] +detection_searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get Notable History - Rule"] mappings = {"cis20": ["CIS 12", "CIS 18", "CIS 4"], "kill_chain_phases": ["Delivery", "Reconnaissance"], "mitre_attack": ["T1082"], "nist": ["DE.AE", "DE.CM", "ID.RA", "PR.IP", "PR.MA", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -737,7 +737,7 @@ modification_date = 2020-04-15 id = a9ef59cf-e981-4e66-9eef-bb049f695c09 version = 1 reference = ["https://github.com/splunk/cloud-datamodel-security-research"] -detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"] +detection_searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes activity by src ip - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule"] mappings = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1526"]} investigative_searches = ["ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = [] @@ -754,7 +754,7 @@ modification_date = 2020-05-20 id = 2574e6d9-7254-4751-8925-0447deeec8ea version = 1 reference = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] -detection_searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule"] +detection_searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule"] mappings = {"kill_chain_phases": ["Lateral Movement"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -771,11 +771,11 @@ modification_date = 2020-02-04 id = 399d65dc-1f08-499b-a259-aad9051f38ad version = 2 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] -detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] +detection_searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Execution", "Exploitation", "Lateral Movement"], "mitre_attack": ["T1021.001", "T1021.002", "T1053.005", "T1550.002", "T1558.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] support_searches = [] -data_models = ["Endpoint", "Network_Traffic"] +data_models = ["Authentication", "Email", "Endpoint", "Network_Traffic"] providing_technologies = none description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ @@ -792,11 +792,11 @@ modification_date = 2017-08-23 id = 2c8ff66e-0b57-42af-8ad7-912438a403fc version = 5 reference = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] -detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule"] +detection_searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule"] mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation", "Installation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1003", "T1027", "T1027.005", "T1055", "T1059.001", "T1140", "T1562", "T1592"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] -data_models = ["Endpoint"] +data_models = ["Email", "Endpoint"] providing_technologies = none description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \ @@ -858,7 +858,7 @@ modification_date = 2017-09-15 id = 9ef8d677-7b52-4213-a038-99cfc7acc2d8 version = 1 reference = ["https://learn.cisecurity.org/20-controls-download"] -detection_searches = ["ESCU - No Windows Updates in a time frame - Rule"] +detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - No Windows Updates in a time frame - Rule"] mappings = {"cis20": ["CIS 18"], "nist": ["PR.MA", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -894,7 +894,7 @@ modification_date = 2017-01-05 id = 2b1800dd-92f9-47ec-a981-fdf1351e5f65 version = 1 reference = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] -detection_searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"] +detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1562.004"], "nist": ["DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of SMB Traffic - MLTK", "ESCU - Previously seen command line arguments"] @@ -929,11 +929,11 @@ modification_date = 2020-01-22 id = bb9f5ed2-916e-4364-bb6d-97c370efcf52 version = 2 reference = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] -detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] +detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Installation"], "mitre_attack": ["T1059.001", "T1059.003", "T1543.003", "T1569.002"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update", "ESCU - Previously seen command line arguments"] -data_models = ["Endpoint"] +data_models = ["Email", "Endpoint"] providing_technologies = none description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ @@ -949,11 +949,11 @@ modification_date = 2020-01-22 id = 988C59C5-0A1C-45B6-A555-0C62276E327E version = 1 reference = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] -detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] +detection_searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 3", "CIS 7", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "mitre_attack": ["T1059.001", "T1059.003", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"] -data_models = ["Endpoint"] +data_models = ["Email", "Endpoint"] providing_technologies = none description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ @@ -1015,7 +1015,7 @@ modification_date = 2017-09-11 id = 6d13121c-90f3-446d-8ac3-27efbbc65218 version = 1 reference = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] -detection_searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] +detection_searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule"] mappings = {"cis20": ["CIS 12", "CIS 13", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exploitation"], "mitre_attack": ["T1021", "T1021.001", "T1048", "T1048.003", "T1071.001", "T1189"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = [] @@ -1032,11 +1032,11 @@ modification_date = 2020-02-04 id = cf309d0d-d4aa-4fbb-963d-1e79febd3756 version = 1 reference = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] -detection_searches = ["ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"] +detection_searches = ["ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule"] mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 3", "CIS 5", "CIS 6", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Exfiltration", "Exploitation", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1020", "T1021.002", "T1027.005", "T1036.003", "T1047", "T1048", "T1053.005", "T1059.005", "T1069.001", "T1069.002", "T1070", "T1070.001", "T1070.004", "T1071.001", "T1087.001", "T1087.002", "T1112", "T1204", "T1218.003", "T1222", "T1482", "T1485", "T1489", "T1490", "T1491", "T1531", "T1547.001", "T1548", "T1562.001", "T1562.007", "T1569.002", "T1574.002", "T1592"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Baseline of SMB Traffic - MLTK"] -data_models = ["Endpoint", "Network_Traffic"] +data_models = ["Email", "Endpoint", "Network_Traffic"] providing_technologies = none description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -1049,7 +1049,7 @@ modification_date = 2020-10-27 id = f52f6c43-05f8-4b19-a9d3-5b8c56da91c2 version = 1 reference = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"] -detection_searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule"] +detection_searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get Notable History - Rule"] mappings = {"mitre_attack": ["T1486"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1083,7 +1083,7 @@ modification_date = 2017-09-12 id = 91c676cf-0b23-438d-abee-f6335e177e77 version = 1 reference = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] -detection_searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule"] +detection_searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Rule"] mappings = {"cis20": ["CIS 1", "CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Reconnaissance"], "mitre_attack": ["T1020.001", "T1200", "T1498", "T1542.005", "T1557", "T1557.002"], "nist": ["ID.AM", "PR.AC", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1101,7 +1101,7 @@ modification_date = 2020-11-06 id = 507edc74-13d5-4339-878e-b9744ded1f35 version = 1 reference = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] -detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule"] +detection_searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Get Notable History - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Lateral Movement", "Privilege Escalation", "Reconnaissance"], "mitre_attack": ["T1021.001", "T1053.005", "T1059.003", "T1482", "T1485", "T1486", "T1489", "T1490", "T1562.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1118,7 +1118,7 @@ modification_date = 2017-09-19 id = 4f6632f5-449c-4686-80df-57625f59bab3 version = 1 reference = ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"] -detection_searches = ["ESCU - SQL Injection with Long URLs - Rule"] +detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - SQL Injection with Long URLs - Rule"] mappings = {"cis20": ["CIS 13", "CIS 18", "CIS 4"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1190"], "nist": ["DE.CM", "ID.RA", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1136,11 +1136,11 @@ modification_date = 2018-12-13 id = c4b89506-fbcf-4cb7-bfd6-527e54789604 version = 1 reference = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] -detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] +detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule"] mappings = {"cis20": ["CIS 10", "CIS 12", "CIS 16", "CIS 18", "CIS 2", "CIS 3", "CIS 4", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Delivery", "Execution", "Exploitation", "Installation", "Lateral Movement", "Reconnaissance"], "mitre_attack": ["T1003", "T1021.001", "T1021.002", "T1036.005", "T1082", "T1204.002", "T1485", "T1486", "T1490", "T1569.002", "T1595"], "nist": ["DE.AE", "DE.CM", "ID.AM", "ID.RA", "PR.AC", "PR.DS", "PR.IP", "PR.MA", "PR.PT"]} investigative_searches = ["ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] support_searches = ["ESCU - Add Prohibited Processes to Enterprise Security"] -data_models = ["Endpoint", "Network_Traffic", "Web"] +data_models = ["Authentication", "Email", "Endpoint", "Network_Traffic", "Web"] providing_technologies = none description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ @@ -1199,7 +1199,7 @@ modification_date = 2019-05-01 id = 2e8948a5-5239-406b-b56b-6c59f1268af3 version = 1 reference = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] -detection_searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1535"], "nist": ["DE.AE", "DE.DP"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] support_searches = ["ESCU - Previously seen users in CloudTrail", "ESCU - Update previously seen users in CloudTrail"] @@ -1216,7 +1216,7 @@ modification_date = 2018-07-24 id = 2e8948a5-5239-406b-b56b-6c50w3168af3 version = 2 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] -detection_searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule"] mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] support_searches = ["ESCU - Baseline of S3 Bucket deletion activity by ARN", "ESCU - Previously seen S3 bucket access by remote IP"] @@ -1235,11 +1235,11 @@ modification_date = 2018-05-07 id = 2e8948a5-5239-406b-b56b-6c50f2168af3 version = 1 reference = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] -detection_searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"] mappings = {"cis20": ["CIS 11"], "kill_chain_phases": ["Actions on Objectives", "Command and Control"], "nist": ["DE.AE", "DE.CM", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of blocked outbound traffic from AWS"] -data_models = [] +data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ @@ -1255,7 +1255,7 @@ modification_date = 2020-06-04 id = 6380ebbb-55c5-4fce-b754-01fd565fb73c version = 1 reference = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] -detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule"] +detection_searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule"] mappings = {"cis20": ["CIS 16"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1535"], "nist": ["DE.AE", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] support_searches = ["ESCU - Previously Seen AWS Cross Account Activity - Initial", "ESCU - Previously Seen AWS Cross Account Activity - Update", "ESCU - Previously Seen Users In CloudTrail - Update", "ESCU - Previously Seen Users in CloudTrail - Initial"] @@ -1273,7 +1273,7 @@ modification_date = 2020-08-25 id = 8168ca88-392e-42f4-85a2-767579c660ce version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] -detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule"] mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"] @@ -1290,7 +1290,7 @@ modification_date = 2018-08-20 id = 51045ded-1575-4ba6-aef7-af6c73cffd86 version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] -detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule"] +detection_searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Rule"] mappings = {"cis20": ["CIS 1"], "mitre_attack": ["T1078"], "nist": ["ID.AM"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial", "ESCU - Previously Seen Cloud Provisioning Activity Sources - Update"] @@ -1308,7 +1308,7 @@ modification_date = 2020-09-04 id = 1ed5ce7d-5469-4232-92af-89d1a3595b39 version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] -detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"] +detection_searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule"] mappings = {"cis20": ["CIS 1", "CIS 16"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "mitre_attack": ["T1078", "T1078.004", "T1580"], "nist": ["DE.CM", "DE.DP", "ID.AM", "PR.AC"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Infrastructure API Calls Per User", "ESCU - Baseline Of Cloud Security Group API Calls Per User", "ESCU - Previously Seen Cloud API Calls Per User Role - Initial", "ESCU - Previously Seen Cloud API Calls Per User Role - Update"] @@ -1326,7 +1326,7 @@ modification_date = 2020-02-03 id = f4368ddf-d59f-4192-84f6-778ac5a3ffc7 version = 2 reference = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] -detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] +detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1036.003", "T1059.001", "T1059.003"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"] @@ -1363,11 +1363,11 @@ modification_date = 2017-09-18 id = 3c3835c0-255d-4f9e-ab84-e29ec9ec9b56 version = 1 reference = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] -detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule"] +detection_searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule"] mappings = {"cis20": ["CIS 1", "CIS 12", "CIS 13", "CIS 3", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Exploitation"], "mitre_attack": ["T1048", "T1048.003", "T1071.004", "T1189"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] support_searches = ["ESCU - Baseline of DNS Query Length - MLTK"] -data_models = ["Endpoint", "Network_Resolution"] +data_models = ["Endpoint", "Network_Resolution", "Network_Traffic"] providing_technologies = none description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -1380,7 +1380,7 @@ modification_date = 2020-01-27 id = 2b1800dd-92f9-47ec-a981-fdf1351e5d55 version = 1 reference = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] -detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] +detection_searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule"] mappings = {"cis20": ["CIS 12", "CIS 3", "CIS 7"], "kill_chain_phases": ["Delivery"], "mitre_attack": ["T1566", "T1566.001"], "nist": ["DE.AE", "PR.IP"]} investigative_searches = ["ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] support_searches = ["ESCU - DNSTwist Domain Names"] @@ -1401,7 +1401,7 @@ modification_date = 2020-08-05 id = 4d656b2e-d6be-11ea-87d0-0242ac130003 version = 1 reference = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] -detection_searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule"] +detection_searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Rule"] mappings = {"cis20": ["CIS 13", "CIS 14"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1530"], "nist": ["DE.CM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1418,7 +1418,7 @@ modification_date = 2021-01-20 id = 2b1800dd-92f9-47dd-a981-fdf13w1q5d55 version = 2 reference = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] -detection_searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"] +detection_searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1218.005", "T1547.001"], "nist": ["DE.AE", "DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK", "ESCU - Previously seen command line arguments"] @@ -1447,7 +1447,7 @@ modification_date = 2020-04-02 id = 9cbd34af-8f39-4476-a423-bacd126c750b version = 1 reference = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] -detection_searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"] +detection_searches = ["ESCU - Investigate Okta Activity by IP Address - Rule", "ESCU - Investigate Okta Activity by app - Rule", "ESCU - Investigate User Activities In Okta - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule"] mappings = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.001"], "nist": ["DE.CM"]} investigative_searches = ["ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] support_searches = [] @@ -1517,7 +1517,7 @@ modification_date = 2018-10-23 id = c8ddc5be-69bc-4202-b3ab-4010b27d7ad5 version = 2 reference = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] -detection_searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"] +detection_searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1047", "T1546.003"], "nist": ["PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] support_searches = [] @@ -1534,7 +1534,7 @@ modification_date = 2018-05-31 id = 2b1800dd-92f9-47dd-a981-fdf1351e5d55 version = 1 reference = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] -detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] +detection_searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1546.001", "T1546.011", "T1546.012", "T1547.001", "T1547.010", "T1548.002", "T1564.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1553,7 +1553,7 @@ modification_date = 2020-04-13 id = aa3749a6-49c7-491e-a03f-4eaee5fe0258 version = 1 reference = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/", "https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/"] -detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule"] +detection_searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get Process File Activity - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1059.003", "T1068"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Process File Activity - Response Task"] support_searches = ["ESCU - Previously Seen Zoom Child Processes - Initial", "ESCU - Previously Seen Zoom Child Processes - Update"] @@ -1636,7 +1636,7 @@ modification_date = 2020-02-04 id = f4368e3f-d59f-4192-84f6-748ac5a3ddb6 version = 2 reference = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] -detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"] +detection_searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule"] mappings = {"cis20": ["CIS 2", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Command and Control", "Denial of Service", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1003", "T1016", "T1036.003", "T1036.005", "T1190", "T1204.002", "T1218.011", "T1595"], "nist": ["DE.CM", "ID.AM", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Baseline of Command Line Length - MLTK"] @@ -1655,11 +1655,11 @@ modification_date = 2017-09-15 id = 826e6431-aeef-41b4-9fc0-6d0985d65a21 version = 1 reference = ["https://www.monkey.org/~dugsong/dsniff/"] -detection_searches = ["ESCU - Protocols passing authentication in cleartext - Rule"] +detection_searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Protocols passing authentication in cleartext - Rule"] mappings = {"cis20": ["CIS 14", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Reconnaissance"], "nist": ["DE.AE", "PR.AC", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] support_searches = [] -data_models = ["Network_Traffic"] +data_models = ["Endpoint", "Network_Traffic"] providing_technologies = none description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems. @@ -1672,7 +1672,7 @@ modification_date = 2020-07-28 id = 36dbb206-d073-11ea-87d0-0242ac130003 version = 1 reference = ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"] -detection_searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule"] +detection_searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History - Rule"] mappings = {"cis20": ["CIS 12", "CIS 16", "CIS 8"], "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1203"], "nist": ["DE.CM"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1689,7 +1689,7 @@ modification_date = 2018-05-31 id = 56e24a28-5003-4047-b2db-e8f3c4618064 version = 1 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"] -detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] +detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1706,7 +1706,7 @@ modification_date = 2018-01-26 id = 30552a76-ac78-48e4-b3c0-de4e34e9563d version = 1 reference = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] -detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] +detection_searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Changes to File Associations - Rule"] mappings = {"cis20": ["CIS 3", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1036.003", "T1546.001"], "nist": ["DE.CM", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1727,7 +1727,7 @@ modification_date = 2017-09-12 id = b6db2c60-a281-48b4-95f1-2cd99ed56835 version = 2 reference = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] -detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"] +detection_searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule"] mappings = {"cis20": ["CIS 10", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1070", "T1070.001", "T1490"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1745,7 +1745,7 @@ modification_date = 2018-05-31 id = 30874d4f-20a1-488f-85ec-5d52ef74e3f9 version = 2 reference = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] -detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"] +detection_searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule"] mappings = {"cis20": ["CIS 3", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation", "Privilege Escalation"], "mitre_attack": ["T1053", "T1053.005", "T1222.001", "T1543.003", "T1546.011", "T1547.001", "T1547.010", "T1564.001", "T1574.009", "T1574.011"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.AT", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1762,7 +1762,7 @@ modification_date = 2020-02-04 id = 644e22d3-598a-429c-a007-16fdb802cae5 version = 2 reference = ["https://attack.mitre.org/tactics/TA0004/"] -detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"] +detection_searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule"] mappings = {"cis20": ["CIS 2", "CIS 5", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation"], "mitre_attack": ["T1068", "T1204.002", "T1546.008", "T1546.012"], "nist": ["DE.CM", "ID.AM", "PR.AC", "PR.DS", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] @@ -1779,7 +1779,7 @@ modification_date = 2017-11-02 id = 6dbd810e-f66d-414b-8dfc-e46de55cbfe2 version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] -detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] +detection_searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule"] mappings = {"cis20": ["CIS 2", "CIS 3", "CIS 5", "CIS 8", "CIS 9"], "kill_chain_phases": ["Actions on Objectives", "Installation"], "mitre_attack": ["T1543.003", "T1569.002", "T1574.011"], "nist": ["DE.AE", "DE.CM", "ID.AM", "PR.AC", "PR.AT", "PR.DS", "PR.IP", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = ["ESCU - Previously Seen Running Windows Services - Initial", "ESCU - Previously Seen Running Windows Services - Update"] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index d2a10ea65c..1995e14408 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-23T08:46:10 UTC +# On Date: 2021-07-26T11:37:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml index 1ff29ae929..ff600822c3 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_all_backup_logs_for_host___response_task.xml @@ -1,7 +1,7 @@ - | search sourcetype="netbackup_logs" dest=$dest$ + | search `netbackup` dest=$dest$ diff --git a/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml index 5a9db32262..cfe74bbb0c 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_amazon_eks_kubernetes_activity_by_src_ip___response_task.xml @@ -1,7 +1,7 @@
- sourcetype="aws:cloudwatchlogs:eks" |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip + `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml index df87f688e6..aa83fac529 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_security_hub_alerts_by_dest___response_task.xml @@ -1,7 +1,7 @@
- sourcetype="aws:securityhub:firehose" "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation + `aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?<instance>.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml index f01b872f1a..63e01d294e 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_accesskeyid___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage + `cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml index d74a469805..15cf90672f 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_investigate_user_activities_by_arn___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType + `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml index eb4a9caf31..b2f195cebe 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_acl_details_from_id___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:description| rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.* + `aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.* diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml index 804d19a1d0..e9e385a4e7 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_network_interface_details_via_resourceid___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:config resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp + `aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp diff --git a/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml index 2c13d1e52c..f5173a4552 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_aws_s3_bucket_details_via_bucketname___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:config | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList + `aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList diff --git a/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml index da040084d3..7e26b67a72 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_gcp_kubernetes_activity_by_src_ip___response_task.xml @@ -1,7 +1,7 @@
- sourcetype="google:gcp:pubsub:message" | rename data.protoPayload.requestMetadata.callerIp as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type + `google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.callerIp as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml index 000cfe9942..ceea0d7351 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_city___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode + `cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml index 9830b3459d..a50f7b59ba 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_country___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode + `cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml index 27fd51c436..cacfa09bdd 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_ip_address___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode + `cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml index 4a7a1cdb76..4b8751652c 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_all_aws_activity_from_region___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode + `cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml index afdbeba57d..ae1d493be1 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_backup_logs_for_endpoint___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype="netbackup_logs" COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as signature | table _time, dest, signature + `netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as signature | table _time, dest, signature diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml index 2b6d49308a..8c08f47588 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_certificate_logs_for_a_domain___response_task.xml @@ -1,7 +1,7 @@
- | tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml index 88f40dece4..55376f7d16 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_instance_details_by_instanceid___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype="aws:description" source="*:ec2_instances"| dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC + `aws_description` | dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml index efae076cb2..9f9c47d148 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_ec2_launch_details___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName + `cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml index e92d6d3f65..8934821532 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_first_occurrence_and_last_occurrence_of_a_mac_address___response_task.xml @@ -1,7 +1,7 @@
- | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST All_Sessions.All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` + | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml index a3068ae9c1..2c3198ad6d 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_endpoint___response_task.xml @@ -1,7 +1,7 @@
- | search eventtype=wineventlog_security (signature_id=4718 OR signature_id=4717) dest=$dest$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature + `wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml index 3c8c81230b..5351bbe732 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_logon_rights_modifications_for_user___response_task.xml @@ -1,7 +1,7 @@
- | search eventtype=wineventlog_security (signature_id=4718 OR signature_id=4717) user=$user$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature + `wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml index 6be7c26681..31ec59b69b 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_parent_process_info___response_task.xml @@ -1,7 +1,7 @@
- | tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml index c2d0913683..be61cc5bf4 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_process_info___response_task.xml @@ -1,7 +1,7 @@
- | tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search process_name= $process_name$ | search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` + | tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search process_name= $process_name$ | search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml index 0af768ae8d..ea423ee3e4 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_sysmon_wmi_activity_for_host___response_task.xml @@ -1,7 +1,7 @@
- sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter + `sysmon` EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter diff --git a/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml index b49c0abf4a..6bf51e95b3 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_get_web_session_information_via_session_id___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=stream:http session_id = $session_id$ | stats values(url) values(http_user_agent) by src_ip status + `stream_http` session_id = $session_id$ | stats values(url) values(http_user_agent) by src_ip status diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml index 48065cee78..5d4532640b 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_activities_via_region_name___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region + `cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml index a4b65f0856..a1d5f61415 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_aws_user_activities_by_user_field___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=aws:cloudtrail user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType + `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml index b7e6637221..68b6518ba8 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_app___response_task.xml @@ -1,7 +1,7 @@
- eventtype=okta_log app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason + `okta` app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml index f702ab0a9b..a914cbe1e5 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_okta_activity_by_ip_address___response_task.xml @@ -1,7 +1,7 @@
- eventtype=okta_log src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason + `okta` src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml index 278c16dd3e..65c5a85271 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_suspicious_strings_in_http_header___response_task.xml @@ -1,7 +1,7 @@
- | search sourcetype=stream:http | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length > 100 | rex field="cs_content_type" (?<suspicious_strings>cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") | rename suspicious_strings_found AS "Suspicious Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url + `stream_http` | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length > 100 | rex field="cs_content_type" (?<suspicious_strings>cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") | rename suspicious_strings_found AS "Suspicious Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url diff --git a/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml b/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml index 0adc7b4f9c..da8f2f9beb 100644 --- a/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml +++ b/dist/escu/default/data/ui/panels/workbench_panel_investigate_user_activities_in_okta___response_task.xml @@ -1,7 +1,7 @@
- eventtype=okta_log user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason + `okta` user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason diff --git a/dist/escu/default/es_investigations.conf b/dist/escu/default/es_investigations.conf index ca2fb6e15f..7f475e8acb 100644 --- a/dist/escu/default/es_investigations.conf +++ b/dist/escu/default/es_investigations.conf @@ -158,7 +158,7 @@ label = DNS Hijacking description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. disabled = 0 -panels = ["panel://workbench_panel_dns_hijack_enrichment___response_task", "panel://workbench_panel_get_dns_server_history_for_a_host___response_task"] +panels = ["panel://workbench_panel_get_dns_server_history_for_a_host___response_task"] [panel_group://workbench_panel_group_darkside_ransomware] label = DarkSide Ransomware diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 2202c7f443..e1198476ff 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-23T08:46:11 UTC +# On Date: 2021-07-26T11:37:21 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -10,6 +10,14 @@ definition = sourcetype="aws:cloudwatchlogs:eks" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[aws_config] +definition = sourcetype=aws:config +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + +[aws_description] +definition = sourcetype="aws:description" +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [aws_s3_accesslogs] definition = sourcetype=aws:s3:accesslogs description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. @@ -18,6 +26,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = sourcetype="aws:securityhub:finding" description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. +[aws_securityhub_firehose] +definition = sourcetype="aws:securityhub:firehose" +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [brand_abuse_dns] definition = lookup update=true brandMonitoring_lookup domain as query OUTPUT domain_abuse | search domain_abuse=true description = This macro limits the output to only domains that are in the brand monitoring lookup file @@ -130,6 +142,10 @@ description = customer specific splunk configurations(eg- index, source, sourcet definition = (eventName = CreateNetworkAcl OR eventName = CreateNetworkAclEntry OR eventName = DeleteNetworkAcl OR eventName = DeleteNetworkAclEntry OR eventName = ReplaceNetworkAclEntry OR eventName = ReplaceNetworkAclAssociation) description = This is a list of AWS event names that are associated with Network ACLs +[notable] +definition = index=notable +description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. + [o365_management_activity] definition = sourcetype=o365:management:activity description = customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. @@ -367,6 +383,22 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[aws_investigate_security_hub_alerts_by_dest_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_investigate_user_activities_by_arn_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_investigate_user_activities_by_accesskeyid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_network_acl_details_from_id_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [aws_network_access_control_list_created_with_all_open_ports_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -375,6 +407,14 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[aws_network_interface_details_via_resourceid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[aws_s3_bucket_details_via_bucketname_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [aws_saml_access_by_provider_user_and_principal_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -435,6 +475,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[all_backup_logs_for_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [allow_file_and_printing_sharing_in_firewall_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -459,6 +503,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[amazon_eks_kubernetes_activity_by_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [amazon_eks_kubernetes_cluster_scan_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1387,6 +1435,10 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[gcp_kubernetes_activity_by_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [gcp_kubernetes_cluster_pod_scan_detection_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1399,6 +1451,106 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[get_all_aws_activity_from_city_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_country_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_all_aws_activity_from_region_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_backup_logs_for_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_certificate_logs_for_a_domain_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_dns_server_history_for_a_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_dns_traffic_ratio_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_ec2_instance_details_by_instanceid_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_ec2_launch_details_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_email_info_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_emails_from_specific_sender_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_first_occurrence_and_last_occurrence_of_a_mac_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_history_of_email_sources_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_logon_rights_modifications_for_endpoint_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_logon_rights_modifications_for_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_notable_history_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_outbound_emails_to_hidden_cobra_threat_actors_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_parent_process_info_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_file_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_info_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_information_for_port_activity_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_process_responsible_for_the_dns_traffic_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_sysmon_wmi_activity_for_host_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[get_web_session_information_via_session_id_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [hide_user_account_from_sign_in_screen_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. @@ -1447,6 +1599,58 @@ description = Update this macro to limit the output results to filter out false definition = search * description = Update this macro to limit the output results to filter out false positives. +[investigate_aws_user_activities_by_user_field_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_aws_activities_via_region_name_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_failed_logins_for_multiple_destinations_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_network_traffic_from_src_ip_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_okta_activity_by_ip_address_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_okta_activity_by_app_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_pass_the_hash_attempts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_pass_the_ticket_attempts_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_previous_unseen_user_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_successful_remote_desktop_authentications_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_suspicious_strings_in_http_header_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_user_activities_in_okta_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + +[investigate_web_posts_from_src_filter] +definition = search * +description = Update this macro to limit the output results to filter out false positives. + [kerberoasting_spn_request_with_rc4_encryption_filter] definition = search * description = Update this macro to limit the output results to filter out false positives. diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 58c0ba6504..805608d3f3 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-23T08:46:10 UTC +# On Date: 2021-07-26T11:37:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -4972,6 +4972,59 @@ realtime_schedule = 0 is_visible = false search = `wineventlog_security` EventCode=4624 OR EventCode=4742 TargetUserName="ANONYMOUS LOGON" LogonType=3 | stats count values(host) as host, values(TargetDomainName) as Domain, values(user) as user | `detect_computer_changed_with_anonymous_account_filter` +[ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.escu.mappings = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.escu.how_to_implement = To successfully implement this analytic, you will need to enable PowerShell Script Block Logging on some or all endpoints. Additional setup here https://docs.splunk.com/Documentation/UBA/5.0.4.1/GetDataIn/AddPowerShell#Configure_module_logging_for_PowerShell. +action.escu.known_false_positives = Limited false positives as the scope is limited to SAM, SYSTEM and SECURITY hives. +action.escu.creation_date = 2021-07-21 +action.escu.modification_date = 2021-07-21 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Credential Dumping"] +action.risk = 1 +action.risk.param._risk_object = ComputerName +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 80 +action.risk.param._risk_message = PowerShell was identified running a script to capture the SAM hive on endpoint $ComputerName$ by user $user$. +action.risk.param._risk = [{"risk_object_field": "user", "risk_object_type": "user", "risk_score": 80}, {"risk_object_field": "ComputerName", "risk_object_type": "system", "risk_score": 80}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule +action.correlationsearch.annotations = {"analytic_story": ["Credential Dumping"], "confidence": 100, "context": ["Source:Endpoint", "Stage:Defense Evasion"], "impact": 80, "kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1003.002"], "observable": [{"name": "user", "role": ["Victim"], "type": "User"}, {"name": "ComputerName", "role": ["Victim"], "type": "Hostname"}]} +schedule_window = auto +action.notable = 1 +action.notable.param.rule_description = The following analytic utilizes PowerShell Script Block Logging (EventCode=4104) to identify suspicious PowerShell execution. Script Block Logging captures the command sent to PowerShell, the full command to be executed. Upon enabling, logs will output to Windows event logs. Dependent upon volume, enable no critical endpoints or all. \ +This analytic identifies `copy` or `[System.IO.File]::Copy` being used to capture the SAM, SYSTEM or SECURITY hives identified in script block. This will catch the most basic use cases for credentials being taken for offline cracking. \ +During triage, review parallel processes using an EDR product or 4688 events. It will be important to understand the timeline of events around this activity. Review the entire logged PowerShell script block. +action.notable.param.rule_title = Detect Copy of ShadowCopy with Script Block Logging +action.notable.param.security_domain = endpoint +action.notable.param.severity = high +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `powershell` EventCode=4104 Message IN ("*copy*","*[System.IO.File]::Copy*") AND Message IN ("*System32\\config\\SAM*", "*System32\\config\\SYSTEM*","*System32\\config\\SECURITY*") | stats count min(_time) as firstTime max(_time) as lastTime by OpCode ComputerName User EventCode Message | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_copy_of_shadowcopy_with_script_block_logging_filter` + [ESCU - Detect Credential Dumping through LSASS access - Rule] action.escu = 0 action.escu.enabled = 1 @@ -8499,6 +8552,48 @@ realtime_schedule = 0 is_visible = false search = | tstats `security_content_summariesonly` count values(Processes.process) as process values(Processes.parent_process) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` | transaction dest connected=false maxpause=5m |where eventcount>=5 | table firstTime lastTime dest user process_name process parent_process eventcount | `detect_processes_used_for_system_network_configuration_discovery_filter` +[ESCU - Detect shared ec2 snapshot - Rule] +action.escu = 0 +action.escu.enabled = 1 +description = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. +action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} +action.escu.data_models = [] +action.escu.eli5 = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. +action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. +action.escu.known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose. +action.escu.creation_date = 2021-07-20 +action.escu.modification_date = 2021-07-20 +action.escu.confidence = high +action.escu.full_search_name = ESCU - Detect shared ec2 snapshot - Rule +action.escu.search_type = detection +action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] +action.escu.providing_technologies = [] +action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Data Exfiltration"] +action.risk = 1 +action.risk.param._risk_object = src_ip +action.risk.param._risk_object_type = system +action.risk.param._risk_score = 48 +action.risk.param._risk_message = AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$ +action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src_ip", "threat_object_type": "ip address"}] +action.risk.param.verbose = 0 +cron_schedule = 0 * * * * +dispatch.earliest_time = -70m@m +dispatch.latest_time = -10m@m +action.correlationsearch.enabled = 1 +action.correlationsearch.label = ESCU - Detect shared ec2 snapshot - Rule +action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Data Exfiltration"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Exfiltration"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]} +schedule_window = auto +alert.digest_mode = 1 +disabled = true +enableSched = 1 +allow_skew = 100% +counttype = number of events +relation = greater than +quantity = 0 +realtime_schedule = 0 +is_visible = false +search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` + [ESCU - Detect web traffic to dynamic domain providers - Rule] action.escu = 0 action.escu.enabled = 1 @@ -24671,7 +24766,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = sourcetype="aws:securityhub:firehose" "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation +search = `aws_securityhub_firehose` "findings{}.Resources{}.Type"=AWSEC2Instance | rex field=findings{}.Resources{}.Id .*instance/(?.*)| rename instance as dest| search dest = $dest$ |rename findings{}.* as * | rename Remediation.Recommendation.Text as Remediation | table dest Title ProductArn Description FirstObservedAt RecordState Remediation [ESCU - AWS Investigate User Activities By ARN - Response Task] action.escu = 0 @@ -24692,7 +24787,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType +search = `cloudtrail` | search user=$user$| table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType [ESCU - AWS Investigate User Activities By AccessKeyId - Response Task] action.escu = 0 @@ -24713,7 +24808,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage +search = `cloudtrail` | rename userIdentity.accessKeyId as accessKeyId| search accessKeyId=$accessKeyId$ | spath output=user path=userIdentity.arn | rename sourceIPAddress as src_ip | table _time, user, src_ip, awsRegion, eventName, errorCode, errorMessage [ESCU - AWS Network ACL Details from ID - Response Task] action.escu = 0 @@ -24734,7 +24829,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:description| rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.* +search = `aws_description` | rename id as networkAclId | search networkAclId=$networkAclId$ | table id account_id vpc_id network_acl_entries{}.* [ESCU - AWS Network Interface details via resourceId - Response Task] action.escu = 0 @@ -24755,7 +24850,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:config resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp +search = `aws_config` resourceId=$resourceId$ | table _time ARN relationships{}.resourceType relationships{}.name relationships{}.resourceId configuration.privateIpAddresses{}.privateIpAddress configuration.privateIpAddresses{}.association.publicIp [ESCU - AWS S3 Bucket details via bucketName - Response Task] action.escu = 0 @@ -24776,7 +24871,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:config | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList +search = `aws_config` | rename resourceId as bucketName |search bucketName=$bucketName$ | table resourceCreationTime bucketName vendor_region action aws_account_id supplementaryConfiguration.AccessControlList [ESCU - All backup logs for host - Response Task] action.escu = 0 @@ -24797,7 +24892,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype="netbackup_logs" dest=$dest$ +search = | search `netbackup` dest=$dest$ [ESCU - Amazon EKS Kubernetes activity by src ip - Response Task] action.escu = 0 @@ -24818,7 +24913,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = sourcetype="aws:cloudwatchlogs:eks" |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip +search = `aws_cloudwatchlogs_eks` |rename sourceIPs{} as src_ip |search src_ip=$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(user.username) values(requestURI) values(verb) values(userAgent) by source annotations.authorization.k8s.io/decision src_ip [ESCU - GCP Kubernetes activity by src ip - Response Task] action.escu = 0 @@ -24839,7 +24934,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = sourcetype="google:gcp:pubsub:message" | rename data.protoPayload.requestMetadata.callerIp as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type +search = `google_gcp_pubsub_message` | rename data.protoPayload.requestMetadata.callerIp as src_ip | search src_ip =$src_ip$ | stats count min(_time) as firstTime max(_time) as lastTime values(data.protoPayload.methodName) as method_names values(data.protoPayload.resourceName) as resource_name values(data.protoPayload.requestMetadata.callerSuppliedUserAgent) as http_user_agent values(data.protoPayload.authenticationInfo.principalEmail) as user values(data.protoPayload.status.message) by src_ip data.resource.labels.cluster_name data.resource.type [ESCU - Get All AWS Activity From City - Response Task] action.escu = 0 @@ -24860,7 +24955,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode +search = `cloudtrail` | iplocation sourceIPAddress | search City=$City$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, City, user, userName, userType, src_ip, awsRegion, eventName, errorCode [ESCU - Get All AWS Activity From Country - Response Task] action.escu = 0 @@ -24881,7 +24976,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode +search = `cloudtrail` | iplocation sourceIPAddress | search Country=$Country$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Country, user, userName, userType, src_ip, awsRegion, eventName, errorCode [ESCU - Get All AWS Activity From IP Address - Response Task] action.escu = 0 @@ -24902,7 +24997,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode +search = `cloudtrail` | iplocation sourceIPAddress | search src_ip=$src_ip$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, user, userName, userType, src_ip, awsRegion, eventName, errorCode [ESCU - Get All AWS Activity From Region - Response Task] action.escu = 0 @@ -24923,7 +25018,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode +search = `cloudtrail` | iplocation sourceIPAddress | search Region=$Region$ | spath output=user path=userIdentity.arn | spath output=awsUserName path=userIdentity.userName | spath output=userType path=userIdentity.type | rename sourceIPAddress as src_ip | table _time, Region, user, userName, userType, src_ip, awsRegion, eventName, errorCode [ESCU - Get Backup Logs For Endpoint - Response Task] action.escu = 0 @@ -24944,7 +25039,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype="netbackup_logs" COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as signature | table _time, dest, signature +search = `netbackup` COMPUTERNAME=$dest$ | rename COMPUTERNAME as dest, MESSAGE as signature | table _time, dest, signature [ESCU - Get Certificate logs for a domain - Response Task] action.escu = 0 @@ -24965,7 +25060,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | tstats `summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime FROM datamodel=Certificates.All_Certificates where All_Certificates.SSL.ssl_subject_common_name=*$domain$ by All_Certificates.dest All_Certificates.src All_Certificates.SSL.ssl_issuer_common_name All_Certificates.SSL.ssl_subject_common_name All_Certificates.SSL.ssl_hash | `drop_dm_object_name(All_Certificates)` | `drop_dm_object_name(SSL)` | rename ssl_subject_common_name as domain | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` [ESCU - Get DNS Server History for a host - Response Task] action.escu = 0 @@ -25028,7 +25123,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype="aws:description" source="*:ec2_instances"| dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC +search = `aws_description` | dedup id sortby -_time |rename id as instanceId| search instanceId=$instanceId$ | spath output=tags path=tags | eval tags=mvzip(key,value," = "), ip_address=if((ip_address == "null"),private_ip_address,ip_address) | table id, tags.Name, aws_account_id, placement, instance_type, key_name, ip_address, launch_time, state, vpc_id, subnet_id, tags | rename aws_account_id as "Account ID", id as ID, instance_type as Type, ip_address as "IP Address", key_name as "Key Pair", launch_time as "Launch Time", placement as "Availability Zone", state as State, subnet_id as Subnet, "tags.Name" as Name, vpc_id as VPC [ESCU - Get EC2 Launch Details - Response Task] action.escu = 0 @@ -25049,7 +25144,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName +search = `cloudtrail` dest=$dest$ |rename userIdentity.arn as arn, responseElements.instancesSet.items{}.instanceId as dest, responseElements.instancesSet.items{}.privateIpAddress as privateIpAddress, responseElements.instancesSet.items{}.imageId as amiID, responseElements.instancesSet.items{}.architecture as architecture, responseElements.instancesSet.items{}.keyName as keyName | table arn, awsRegion, dest, architecture, privateIpAddress, amiID, keyName [ESCU - Get Email Info - Response Task] action.escu = 0 @@ -25112,7 +25207,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST All_Sessions.All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Network_Sessions where nodename=All_Sessions.DHCP All_Sessions.signature=DHCPREQUEST All_Sessions.src_mac= $src_mac$ by All_Sessions.src_ip All_Sessions.user | `security_content_ctime(lastTime)` | `security_content_ctime(firstTime)` [ESCU - Get History Of Email Sources - Response Task] action.escu = 0 @@ -25154,7 +25249,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search eventtype=wineventlog_security (signature_id=4718 OR signature_id=4717) dest=$dest$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature +search = `wineventlog_security` (signature_id=4718 OR signature_id=4717) dest=$dest$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature [ESCU - Get Logon Rights Modifications For User - Response Task] action.escu = 0 @@ -25175,7 +25270,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search eventtype=wineventlog_security (signature_id=4718 OR signature_id=4717) user=$user$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature +search = `wineventlog_security` (signature_id=4718 OR signature_id=4717) user=$user$ | rename user as "Account Modified" | table _time, dest, "Account Modified", Access_Right, signature [ESCU - Get Notable History - Response Task] action.escu = 0 @@ -25238,7 +25333,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search = | tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search parent_process_name= $parent_process_name$ |search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` [ESCU - Get Process File Activity - Response Task] action.escu = 0 @@ -25280,7 +25375,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | tstats `summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search process_name= $process_name$ | search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` +search = | tstats `security_content_summariesonly` count values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime FROM datamodel=Endpoint.Processes by Processes.user Processes.parent_process_name Processes.process_name Processes.dest | `drop_dm_object_name("Processes")` | search process_name= $process_name$ | search dest = $dest$ | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` [ESCU - Get Process Information For Port Activity - Response Task] action.escu = 0 @@ -25343,7 +25438,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter +search = `sysmon` EventCode>18 EventCode<22 | rename host as dest | search dest=$dest$| table _time, dest, user, Name, Operation, EventType, Type, Query, Consumer, Filter [ESCU - Get Web Session Information via session id - Response Task] action.escu = 0 @@ -25364,7 +25459,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=stream:http session_id = $session_id$ | stats values(url) values(http_user_agent) by src_ip status +search = `stream_http` session_id = $session_id$ | stats values(url) values(http_user_agent) by src_ip status [ESCU - Investigate AWS User Activities by user field - Response Task] action.escu = 0 @@ -25385,7 +25480,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType +search = `cloudtrail` user=$user$ | table _time userIdentity.type userIdentity.userName userIdentity.arn aws_account_id src awsRegion eventName eventType [ESCU - Investigate AWS activities via region name - Response Task] action.escu = 0 @@ -25406,7 +25501,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=aws:cloudtrail vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region +search = `cloudtrail` vendor_region=$vendor_region$| rename requestParameters.instancesSet.items{}.instanceId as instanceId | stats values(eventName) by user instanceId vendor_region [ESCU - Investigate Failed Logins for Multiple Destinations - Response Task] action.escu = 0 @@ -25469,7 +25564,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = eventtype=okta_log src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason +search = `okta` src_ip={src_ip} | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason [ESCU - Investigate Okta Activity by app - Response Task] action.escu = 0 @@ -25490,7 +25585,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = eventtype=okta_log app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason +search = `okta` app=$app$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason [ESCU - Investigate Pass the Hash Attempts - Response Task] action.escu = 0 @@ -25595,7 +25690,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = | search sourcetype=stream:http | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length > 100 | rex field="cs_content_type" (?cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") | rename suspicious_strings_found AS "Suspicious Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url +search = `stream_http` | search src_ip=$src_ip$ | search dest_ip=$dest_ip$ | eval cs_content_type_length = len(cs_content_type) | search cs_content_type_length > 100 | rex field="cs_content_type" (?cmd.exe) | eval suspicious_strings_found=if(match(cs_content_type, "application"), "True", "False") | rename suspicious_strings_found AS "Suspicious Content-Type Found" | fields "Suspicious Content-Type Found", dest_ip, src_ip, suspicious_strings, cs_content_type, cs_content_type_length, url [ESCU - Investigate User Activities In Okta - Response Task] action.escu = 0 @@ -25616,7 +25711,7 @@ action.escu.known_false_positives = None at this time disabled = true schedule_window = auto is_visible = false -search = eventtype=okta_log user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason +search = `okta` user=$user$ | rename client.geographicalContext.country as country, client.geographicalContext.state as state, client.geographicalContext.city as city | table _time, user, displayMessage, app, src_ip, state, city, result, outcome.reason [ESCU - Investigate Web POSTs From src - Response Task] action.escu = 0 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index 26b66a37c6..20f21490a1 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-23T08:46:10 UTC +# On Date: 2021-07-26T11:37:20 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index e68d2294f1..106a862816 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-23T08:46:11 UTC +# On Date: 2021-07-26T11:37:21 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -14,7 +14,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By AccessKeyId - Rule", "ESCU - Get Notable History - Rule", "ESCU - aws detect attach to role policy - Rule", "ESCU - aws detect permanent key creation - Rule", "ESCU - aws detect role creation - Rule", "ESCU - aws detect sts assume role abuse - Rule", "ESCU - aws detect sts get session token abuse - Rule", "ESCU - AWS Investigate User Activities By AccessKeyId - Response Task", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another AWS account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Amazon Web Services (AWS) admins manage access to AWS resources and services across the enterprise using AWS's Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage AWS users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as EC2 instances, the AWS Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ Herein lies the rub. In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -39,7 +39,7 @@ version = 2 references = ["https://docs.aws.amazon.com/AmazonVPC/latest/UserGuide/VPC_Appendix_NACLs.html", "https://aws.amazon.com/blogs/security/how-to-help-prepare-for-ddos-attacks-by-reducing-your-attack-surface/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Access Control List Created with All Open Ports - Rule", "ESCU - AWS Network Access Control List Deleted - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in Network ACL Activity - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Monitor your AWS network infrastructure for bad configurations and malicious activity. Investigative searches help you probe deeper, when the facts warrant it. narrative = AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational/risk auditing of your AWS account. Actions taken by a user, role, or an AWS service are recorded as events in CloudTrail. It is crucial for a company to monitor events and actions taken in the AWS Management Console, AWS Command Line Interface, and AWS SDKs and APIs to ensure that your servers are not vulnerable to attacks. This analytic story contains detection searches that leverage CloudTrail logs from AWS to check for bad configurations and malicious activity in your AWS network access controls. @@ -50,7 +50,7 @@ version = 1 references = ["https://aws.amazon.com/security-hub/features/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for EC2 Instance - Rule", "ESCU - Detect Spike in AWS Security Hub Alerts for User - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task"] description = This story is focused around detecting Security Hub alerts generated from AWS narrative = AWS Security Hub collects and consolidates findings from AWS security services enabled in your environment, such as intrusion detection findings from Amazon GuardDuty, vulnerability scans from Amazon Inspector, S3 bucket policy findings from Amazon Macie, publicly accessible and cross-account resources from IAM Access Analyzer, and resources lacking WAF coverage from AWS Firewall Manager. @@ -61,7 +61,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Excessive Security Scanning - Rule", "ESCU - Detect API activity from users without MFA - Rule", "ESCU - Detect AWS API Activities From Unapproved Accounts - Rule", "ESCU - Detect Spike in AWS API Activity - Rule", "ESCU - Detect Spike in Security Group Activity - Rule", "ESCU - Detect new API calls from user roles - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Detect and investigate dormant user accounts for your AWS environment that have become active again. Because inactive and ad-hoc accounts are common attack targets, it's critical to enable governance within your environment. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new EC2 instances and increased bandwidth usage. \ @@ -88,7 +88,7 @@ version = 1 references = ["https://github.com/SpiderLabs/owasp-modsecurity-crs/blob/v3.2/dev/rules/REQUEST-944-APPLICATION-ATTACK-JAVA.conf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Suspicious Strings in HTTP Header - Rule", "ESCU - Investigate Web POSTs From src - Rule", "ESCU - Suspicious Java Classes - Rule", "ESCU - Unusually Long Content-Type Length - Rule", "ESCU - Web Servers Executing Suspicious Processes - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Suspicious Strings in HTTP Header - Response Task", "ESCU - Investigate Web POSTs From src - Response Task"] description = Detect and investigate activities--such as unusually long `Content-Type` length, suspicious java classes and web servers executing suspicious processes--consistent with attempts to exploit Apache Struts vulnerabilities. narrative = In March of 2017, a remote code-execution vulnerability in the Jakarta Multipart parser in Apache Struts, a widely used open-source framework for creating Java web applications, was disclosed and assigned to CVE-2017-5638. About two months later, hackers exploited the flaw to carry out the world's 5th largest data breach. The target, credit giant Equifax, told investigators that it had become aware of the vulnerability two months before the attack. \ The exploit involved manipulating the `Content-Type HTTP` header to execute commands embedded in the header.\ @@ -112,7 +112,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/inventory-of-authorized-and-unauthorized-devices/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Unauthorized Assets by MAC address - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get First Occurrence and Last Occurrence of a MAC Address - Response Task", "ESCU - Get Notable History - Response Task"] description = Keep a careful inventory of every asset on your network to make it easier to detect rogue devices. Unauthorized/unmanaged devices could be an indication of malicious behavior that should be investigated further. narrative = This Analytic Story is designed to help you develop a better understanding of what authorized and unauthorized devices are part of your enterprise. This story can help you better categorize and classify assets, providing critical business context and awareness of their assets during an incident. Information derived from this Analytic Story can be used to better inform and support other analytic stories. For successful detection, you will need to leverage the Assets and Identity Framework from Enterprise Security to populate your known assets. @@ -145,7 +145,7 @@ version = 1 references = ["https://www.zerofox.com/blog/what-is-digital-risk-monitoring/", "https://securingtomorrow.mcafee.com/consumer/family-safety/what-is-typosquatting/", "https://blog.malwarebytes.com/cybercrime/2016/06/explained-typosquatting/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Monitor DNS For Brand Abuse - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Monitor Web Traffic For Brand Abuse - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate activity that may indicate that an adversary is using faux domains to mislead users into interacting with malicious infrastructure. Monitor DNS, email, and web traffic for permutations of your brand name. narrative = While you can educate your users and customers about the risks and threats posed by typosquatting, phishing, and corporate espionage, human error is a persistent fact of life. Of course, your adversaries are all too aware of this reality and will happily leverage it for nefarious purposes whenever possible3phishing with lookalike addresses, embedding faux command-and-control domains in malware, and hosting malicious content on domains that closely mimic your corporate servers. This is where brand monitoring comes in.\ You can use our adaptation of `DNSTwist`, together with the support searches in this Analytic Story, to generate permutations of specified brands and external domains. Splunk can monitor email, DNS requests, and web traffic for these permutations and provide you with early warnings and situational awareness--powerful elements of an effective defense.\ @@ -169,7 +169,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS Investigate Security Hub alerts by dest - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Compute Instance Created By Previously Unseen User - Rule", "ESCU - Cloud Compute Instance Created In Previously Unused Region - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Image - Rule", "ESCU - Cloud Compute Instance Created With Previously Unseen Instance Type - Rule", "ESCU - Get EC2 Instance Details by instanceId - Rule", "ESCU - Get EC2 Launch Details - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate Security Hub alerts by dest - Response Task", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get EC2 Instance Details by instanceId - Response Task", "ESCU - Get EC2 Launch Details - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Monitor your cloud compute instances for activities related to cryptojacking/cryptomining. New instances that originate from previously unseen regions, users who launch abnormally high numbers of instances, or compute instances started by previously unseen users are just a few examples of potentially malicious behavior. narrative = Cryptomining is an intentionally difficult, resource-intensive business. Its complexity was designed into the process to ensure that the number of blocks mined each day would remain steady. So, it's par for the course that ambitious, but unscrupulous, miners make amassing the computing power of large enterprises--a practice known as cryptojacking--a top priority. \ Cryptojacking has attracted an increasing amount of media attention since its explosion in popularity in the fall of 2017. The attacks have moved from in-browser exploits and mobile phones to enterprise cloud services, such as Amazon Web Services (AWS), Google Cloud Platform (GCP), and Azure. It's difficult to determine exactly how widespread the practice has become, since bad actors continually evolve their ability to escape detection, including employing unlisted endpoints, moderating their CPU usage, and hiding the mining pool's IP address behind a free CDN. \ @@ -214,7 +214,7 @@ version = 1 references = ["https://www.intego.com/mac-security-blog/osxcoldroot-and-the-rat-invasion/", "https://objective-see.com/blog/blog_0x2A.html", "https://www.bleepingcomputer.com/news/security/coldroot-rat-still-undetectable-despite-being-uploaded-on-github-two-years-ago/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - Investigate Network Traffic From src ip - Rule", "ESCU - Osquery pack - ColdRoot detection - Rule", "ESCU - Processes Tapping Keyboard Events - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate Network Traffic From src ip - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that relate to the ColdRoot Remote Access Trojan that affects MacOS. An example of some of these activities are changing sensative binaries in the MacOS sub-system, detecting process names and executables associated with the RAT, detecting when a keyboard tab is installed on a MacOS machine and more. narrative = Conventional wisdom holds that Apple's MacOS operating system is significantly less vulnerable to attack than Windows machines. While that point is debatable, it is true that attacks against MacOS systems are much less common. However, this fact does not mean that Macs are impervious to breaches. To the contrary, research has shown that that Mac malware is increasing at an alarming rate. According to AV-test, in 2018, there were 86,865 new MacOS malware variants, up from 27,338 the year before—a 31% increase. In contrast, the independent research firm found that new Windows malware had increased from 65.17M to 76.86M during that same period, less than half the rate of growth. The bottom line is that while the numbers look a lot smaller than Windows, it's definitely time to take Mac security more seriously.\ This Analytic Story addresses the ColdRoot remote access trojan (RAT), which was uploaded to Github in 2016, but was still escaping detection by the first quarter of 2018, when a new, more feature-rich variant was discovered masquerading as an Apple audio driver. Among other capabilities, the Pascal-based ColdRoot can heist passwords from users' keychains and remotely control infected machines without detection. In the initial report of his findings, Patrick Wardle, Chief Research Officer for Digita Security, explained that the new ColdRoot RAT could start and kill processes on the breached system, spawn new remote-desktop sessions, take screen captures and assemble them into a live stream of the victim's desktop, and more.\ @@ -227,7 +227,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Collection", "https://attack.mitre.org/wiki/Technique/T1074"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect Renamed 7-Zip - Rule", "ESCU - Detect Renamed WinRAR - Rule", "ESCU - Email files written outside of the Outlook directory - Rule", "ESCU - Email servers sending high volume traffic to hosts - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hosts receiving high volume of network traffic from email server - Rule", "ESCU - Suspicious writes to System Volume Information - Rule", "ESCU - Suspicious writes to windows Recycle Bin - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities--such as suspicious writes to the Windows Recycling Bin or email servers sending high amounts of traffic to specific hosts, for example--that may indicate that an adversary is harvesting and exfiltrating sensitive data. narrative = A common adversary goal is to identify and exfiltrate data of value from a target organization. This data may include email conversations and addresses, confidential company information, links to network design/infrastructure, important dates, and so on.\ Attacks are composed of three activities: identification, collection, and staging data for exfiltration. Identification typically involves scanning systems and observing user activity. Collection can involve the transfer of large amounts of data from various repositories. Staging/preparation includes moving data to a central location and compressing (and optionally encoding and/or encrypting) it. All of these activities provide opportunities for defenders to identify their presence. \ @@ -240,7 +240,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Command_and_Control", "https://searchsecurity.techtarget.com/feature/Command-and-control-servers-The-puppet-masters-that-govern-malware"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Large Outbound ICMP Packets - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate tactics, techniques, and procedures leveraged by attackers to establish and operate command and control channels. Implants installed by attackers on compromised endpoints use these channels to receive instructions and send data back to the malicious operators. narrative = Threat actors typically architect and implement an infrastructure to use in various ways during the course of their attack campaigns. In some cases, they leverage this infrastructure for scanning and performing reconnaissance activities. In others, they may use this infrastructure to launch actual attacks. One of the most important functions of this infrastructure is to establish servers that will communicate with implants on compromised endpoints. These servers establish a command and control channel that is used to proxy data between the compromised endpoint and the attacker. These channels relay commands from the attacker to the compromised endpoint and the output of those commands back to the attacker.\ Because this communication is so critical for an adversary, they often use techniques designed to hide the true nature of the communications. There are many different techniques used to establish and communicate over these channels. This Analytic Story provides searches that look for a variety of the techniques used for these channels, as well as indications that these channels are active, by examining logs associated with border control devices and network-access control lists. @@ -263,7 +263,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -276,7 +276,7 @@ version = 2 references = ["https://www.us-cert.gov/ncas/alerts/TA18-074A"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Create local admin accounts using net exe - Rule", "ESCU - Detect New Local Admin account - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process File Activity - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Malicious PowerShell Process - Execution Policy Bypass - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Scheduled Task Deleted Or Created via CMD - Rule", "ESCU - Single Letter Process On Endpoint - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process File Activity - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Monitor for suspicious activities associated with DHS Technical Alert US-CERT TA18-074A. Some of the activities that adversaries used in these compromises included spearfishing attacks, malware, watering-hole domains, many and more. narrative = The frequency of nation-state cyber attacks has increased significantly over the last decade. Employing numerous tactics and techniques, these attacks continue to escalate in complexity. \ There is a wide range of motivations for these state-sponsored hacks, including stealing valuable corporate, military, or diplomatic dataѿall of which could confer advantages in various arenas. They may also target critical infrastructure. \ @@ -290,7 +290,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA13-088A", "https://www.imperva.com/learn/application-security/dns-amplification/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Large Volume of DNS ANY Queries - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - Large Volume of DNS ANY Queries - Rule", "ESCU - Get Notable History - Response Task"] description = DNS poses a serious threat as a Denial of Service (DOS) amplifier, if it responds to `ANY` queries. This Analytic Story can help you detect attackers who may be abusing your company's DNS infrastructure to launch amplification attacks, causing Denial of Service to other victims. narrative = The Domain Name System (DNS) is the protocol used to map domain names to IP addresses. It has been proven to work very well for its intended function. However if DNS is misconfigured, servers can be abused by attackers to levy amplification or redirection attacks against victims. Because DNS responses to `ANY` queries are so much larger than the queries themselves--and can be made with a UDP packet, which does not require a handshake--attackers can spoof the source address of the packet and cause much more data to be sent to the victim than if they sent the traffic themselves. The `ANY` requests are will be larger than normal DNS server requests, due to the fact that the server provides significant details, such as MX records and associated IP addresses. A large volume of this traffic can result in a DOS on the victim's machine. This misconfiguration leads to two possible victims, the first being the DNS servers participating in an attack and the other being the hosts that are the targets of the DOS attack.\ The search in this story can help you to detect if attackers are abusing your company's DNS infrastructure to launch DNS amplification attacks causing Denial of Service to other victims. @@ -302,7 +302,7 @@ version = 1 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - DNS Hijack Enrichment - Response Task", "ESCU - Get DNS Server History for a host - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - DNS record changed - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS Server History for a host - Response Task"] description = Secure your environment against DNS hijacks with searches that help you detect and investigate unauthorized changes to DNS records. narrative = Dubbed the Achilles heel of the Internet (see https://www.f5.com/labs/articles/threat-intelligence/dns-is-still-the-achilles-heel-of-the-internet-25613), DNS plays a critical role in routing web traffic but is notoriously vulnerable to attack. One reason is its distributed nature. It relies on unstructured connections between millions of clients and servers over inherently insecure protocols.\ The gravity and extent of the importance of securing DNS from attacks is undeniable. The fallout of compromised DNS can be disastrous. Not only can hackers bring down an entire business, they can intercept confidential information, emails, and login credentials, as well. \ @@ -332,7 +332,7 @@ version = 1 references = ["https://attack.mitre.org/tactics/TA0010/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] description = The stealing of data by an adversary. narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. @@ -343,7 +343,7 @@ version = 1 references = ["https://www.cisecurity.org/controls/data-protection/", "https://www.sans.org/reading-room/whitepapers/dns/splunk-detect-dns-tunneling-37022", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Detect USB device insertion - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Fortify your data-protection arsenal--while continuing to ensure data confidentiality and integrity--with searches that monitor for and help you investigate possible signs of data exfiltration. narrative = Attackers can leverage a variety of resources to compromise or exfiltrate enterprise data. Common exfiltration techniques include remote-access channels via low-risk, high-payoff active-collections operations and close-access operations using insiders and removable media. While this Analytic Story is not a comprehensive listing of all the methods by which attackers can exfiltrate data, it provides a useful starting point. @@ -365,7 +365,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://github.com/SecuraBV/CVE-2020-1472", "https://www.secura.com/blog/zero-logon", "https://nvd.nist.gov/vuln/detail/CVE-2020-1472"] maintainers = [{"company": "Jose Hernandez, Stan Miskowicz, David Dorsey, Shannon Davis Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Computer Changed with Anonymous Account - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Detect Zerologon via Zeek - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity related to the execution of Zerologon CVE-2020-11472, a technique wherein attackers target a Microsoft Windows Domain Controller to reset its computer account password. The result from this attack is attackers can now provide themselves high privileges and take over Domain Controller. The included searches in this Analytic Story are designed to identify attempts to reset Domain Controller Computer Account via exploit code remotely or via the use of tool Mimikatz as payload carrier. narrative = This attack is a privilege escalation technique, where attacker targets a Netlogon secure channel connection to a domain controller, using Netlogon Remote Protocol (MS-NRPC). This vulnerability exposes vulnerable Windows Domain Controllers to be targeted via unaunthenticated RPC calls which eventually reset Domain Contoller computer account ($) providing the attacker the opportunity to exfil domain controller credential secrets and assign themselve high privileges that can lead to domain controller and potentially complete network takeover. The detection searches in this Analytic Story use Windows Event viewer events and Sysmon events to detect attack execution, these searches monitor access to the Local Security Authority Subsystem Service (LSASS) process which is an indicator of the use of Mimikatz tool which has bee updated to carry this attack payload. @@ -376,7 +376,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1089", "https://blog.malwarebytes.com/cybercrime/2015/11/vonteera-adware-uses-certificates-to-disable-anti-malware/", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Attempt To Add Certificate To Untrusted Store - Rule", "ESCU - Attempt To Stop Security Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - Unload Sysmon Filter Driver - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Looks for activities and techniques associated with the disabling of security tools on a Windows system, such as suspicious `reg.exe` processes, processes launching netsh, and many others. narrative = Attackers employ a variety of tactics in order to avoid detection and operate without barriers. This often involves modifying the configuration of security tools to get around them or explicitly disabling them to prevent them from running. This Analytic Story includes searches that look for activity consistent with attackers attempting to disable various security mechanisms. Such activity may involve monitoring for suspicious registry activity, as this is where much of the configuration for Windows and various other programs reside, or explicitly attempting to shut down security-related services. Other times, attackers attempt various tricks to prevent specific programs from running, such as adding the certificates with which the security tools are signed to a block list (which would prevent them from running). @@ -398,7 +398,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html", "https://umbrella.cisco.com/blog/2013/04/15/on-the-trail-of-malicious-dynamic-dns-domains/", "http://www.noip.com/blog/2014/07/11/dynamic-dns-can-use-2/", "https://www.splunk.com/blog/2015/08/04/detecting-dynamic-dns-domains-in-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detect web traffic to dynamic domain providers - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Detect and investigate hosts in your environment that may be communicating with dynamic domain providers. Attackers may leverage these services to help them avoid firewall blocks and deny lists. narrative = Dynamic DNS services (DDNS) are legitimate low-cost or free services that allow users to rapidly update domain resolutions to IP infrastructure. While their usage can be benign, malicious actors can abuse DDNS to host harmful payloads or interactive-command-and-control infrastructure. These attackers will manually update or automate domain resolution changes by routing dynamic domains to IP addresses that circumvent firewall blocks and deny lists and frustrate a network defender's analytic and investigative processes. These searches will look for DNS queries made from within your infrastructure to suspicious dynamic domains and then investigate more deeply, when appropriate. While this list of top-level dynamic domains is not exhaustive, it can be dynamically updated as new suspicious dynamic domains are identified. @@ -409,7 +409,7 @@ version = 1 references = ["https://www.us-cert.gov/ncas/alerts/TA18-201A", "https://www.first.org/resources/papers/conf2017/Advanced-Incident-Detection-and-Threat-Hunting-using-Sysmon-and-Splunk.pdf", "https://www.vkremez.com/2017/05/emotet-banking-trojan-malware-analysis.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Detect Rare Executables - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - Detection of tools built by NirSoft - Rule", "ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect rarely used executables, specific registry paths that may confer malware survivability and persistence, instances where cmd.exe is used to launch script interpreters, and other indicators that the Emotet financial malware has compromised your environment. narrative = The trojan downloader known as Emotet first surfaced in 2014, when it was discovered targeting the banking industry to steal credentials. However, according to a joint technical alert (TA) issued by three government agencies (https://www.us-cert.gov/ncas/alerts/TA18-201A), Emotet has evolved far beyond those beginnings to become what a ThreatPost article called a threat-delivery service(see https://threatpost.com/emotet-malware-evolves-beyond-banking-to-threat-delivery-service/134342/). For example, in early 2018, Emotet was found to be using its loader function to spread the Quakbot and Ransomware variants. \ According to the TA, the the malware continues to be among the most costly and destructive malware affecting the private and public sectors. Researchers have linked it to the threat group Mealybug, which has also been on the security communitys radar since 2014.\ @@ -422,7 +422,7 @@ version = 1 references = ["https://www.ptsecurity.com/ww-en/about/news/f5-fixes-critical-vulnerability-discovered-by-positive-technologies-in-big-ip-application-delivery-controller/", "https://support.f5.com/csp/article/K52145254", "https://blog.cloudflare.com/cve-2020-5902-helping-to-protect-against-the-f5-tmui-rce-vulnerability/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect F5 TMUI RCE CVE-2020-5902 - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity consistent with CVE-2020-5902. Discovered by Positive Technologies researchers, this vulnerability affects F5 BIG-IP, BIG-IQ. and Traffix SDC devices (vulnerable versions in F5 support link below). This vulnerability allows unauthenticated users, along with authenticated users, who have access to the configuration utility to execute system commands, create/delete files, disable services, and/or execute Java code. This vulnerability can result in full system compromise. narrative = A client is able to perform a remote code execution on an exposed and vulnerable system. The detection search in this Analytic Story uses syslog to detect the malicious behavior. Syslog is going to be the best detection method, as any systems using SSL to protect their management console will make detection via wire data difficult. The searches included used Splunk Connect For Syslog (https://splunkbase.splunk.com/app/4740/), and used a custom destination port to help define the data as F5 data (covered in https://splunk-connect-for-syslog.readthedocs.io/en/master/sources/F5/) @@ -433,7 +433,7 @@ version = 1 references = ["https://cloud.google.com/iam/docs/understanding-service-accounts"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - GCP Detect accounts with high risk roles by project - Rule", "ESCU - GCP Detect gcploit framework - Rule", "ESCU - GCP Detect high risk permissions by resource and account - Rule", "ESCU - Get Notable History - Rule", "ESCU - gcp detect oauth token abuse - Rule", "ESCU - Get Notable History - Response Task"] description = Track when a user assumes an IAM role in another GCP account to obtain cross-account access to services and resources in that account. Accessing new roles could be an indication of malicious activity. narrative = Google Cloud Platform (GCP) admins manage access to GCP resources and services across the enterprise using GCP Identity and Access Management (IAM) functionality. IAM provides the ability to create and manage GCP users, groups, and roles-each with their own unique set of privileges and defined access to specific resources (such as Compute instances, the GCP Management Console, API, or the command-line interface). Unlike conventional (human) users, IAM roles are potentially assumable by anyone in the organization. They provide users with dynamically created temporary security credentials that expire within a set time period.\ In between the time between when the temporary credentials are issued and when they expire is a period of opportunity, where a user could leverage the temporary credentials to wreak havoc-spin up or remove instances, create new users, elevate privileges, and other malicious activities-throughout the environment.\ @@ -459,7 +459,7 @@ version = 2 references = ["https://www.us-cert.gov/HIDDEN-COBRA-North-Korean-Malicious-Cyber-Activity", "https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Create or delete windows shares using net exe - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - Detect Outbound SMB Traffic - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Suspicious File Write - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Outbound Emails to Hidden Cobra Threat Actors - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Monitor for and investigate activities, including the creation or deletion of hidden shares and file writes, that may be evidence of infiltration by North Korean government-sponsored cybercriminals. Details of this activity were reported in DHS Report TA-18-149A. narrative = North Korea's government-sponsored "cyber army" has been slowly building momentum and gaining sophistication over the last 15 years or so. As a result, the group's activity, which the US government refers to as "Hidden Cobra," has surreptitiously crept onto the collective radar as a preeminent global threat.\ These state-sponsored actors are thought to be responsible for everything from a hack on a South Korean nuclear plant to an attack on Sony in anticipation of its release of the movie "The Interview" at the end of 2014. They're also notorious for cyberespionage. In recent years, the group seems to be focused on financial crimes, such as cryptojacking.\ @@ -484,7 +484,7 @@ version = 1 references = ["http://www.deependresearch.org/2016/04/jboss-exploits-view-from-victim.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = In March of 2016, adversaries were seen using JexBoss--an open-source utility used for testing and exploiting JBoss application servers. These searches help detect evidence of these attacks, such as network connections to external resources or web services spawning atypical child processes, among others. narrative = This Analytic Story looks for probing and exploitation attempts targeting JBoss application servers. While the vulnerabilities associated with this story are rather dated, they were leveraged in a spring 2016 campaign in connection with the Samsam ransomware variant. Incidents involving this ransomware are unique, in that they begin with attacks against vulnerable services, rather than the phishing or drive-by attacks more common with ransomware. In this case, vulnerable JBoss applications appear to be the target of choice.\ It is helpful to understand how often a notable event generated by this story occurs, as well as the commonalities between some of these events, both of which may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. It may also help to understand whether the issue is restricted to a single user/system or whether it is broader in scope.\ @@ -509,7 +509,7 @@ version = 1 references = ["https://github.com/splunk/cloud-datamodel-security-research"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Amazon EKS Kubernetes Pod scan detection - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Rule", "ESCU - Amazon EKS Kubernetes cluster scan detection - Rule", "ESCU - GCP Kubernetes activity by src ip - Rule", "ESCU - GCP Kubernetes cluster pod scan detection - Rule", "ESCU - GCP Kubernetes cluster scan detection - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes Azure pod scan fingerprint - Rule", "ESCU - Kubernetes Azure scan fingerprint - Rule", "ESCU - Amazon EKS Kubernetes activity by src ip - Response Task", "ESCU - GCP Kubernetes activity by src ip - Response Task", "ESCU - Get Notable History - Response Task"] description = This story addresses detection against Kubernetes cluster fingerprint scan and attack by providing information on items such as source ip, user agent, cluster names. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitve information and management priviledges of production workloads, microservices and applications. These searches allow operator to detect suspicious unauthenticated requests from the internet to kubernetes cluster. @@ -520,7 +520,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/approaching-kubernetes-security-detecting-kubernetes-scan-with-splunk.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS EKS Kubernetes cluster sensitive object access - Rule", "ESCU - Get Notable History - Rule", "ESCU - Kubernetes AWS detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes AWS detect suspicious kubectl calls - Rule", "ESCU - Kubernetes Azure detect sensitive object access - Rule", "ESCU - Kubernetes Azure detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes Azure detect suspicious kubectl calls - Rule", "ESCU - Kubernetes GCP detect sensitive object access - Rule", "ESCU - Kubernetes GCP detect service accounts forbidden failure access - Rule", "ESCU - Kubernetes GCP detect suspicious kubectl calls - Rule", "ESCU - Get Notable History - Response Task"] description = This story addresses detection and response of accounts acccesing Kubernetes cluster sensitive objects such as configmaps or secrets providing information on items such as user user, group. object, namespace and authorization reason. narrative = Kubernetes is the most used container orchestration platform, this orchestration platform contains sensitive objects within its architecture, specifically configmaps and secrets, if accessed by an attacker can lead to further compromise. These searches allow operator to detect suspicious requests against Kubernetes sensitive objects. @@ -531,7 +531,7 @@ version = 2 references = ["https://www.fireeye.com/blog/executive-perspective/2015/08/malware_lateral_move.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Detect Activity Related to Pass the Hash Attacks - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Kerberoasting spn request with RC4 encryption - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Remote Desktop Process Running On System - Rule", "ESCU - Schtasks scheduling job on remote system - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Detect and investigate tactics, techniques, and procedures around how attackers move laterally within the enterprise. Because lateral movement can expose the adversary to detection, it should be an important focus for security analysts. narrative = Once attackers gain a foothold within an enterprise, they will seek to expand their accesses and leverage techniques that facilitate lateral movement. Attackers will often spend quite a bit of time and effort moving laterally. Because lateral movement renders an attacker the most vulnerable to detection, it's an excellent focus for detection and investigation.\ Indications of lateral movement can include the abuse of system utilities (such as `psexec.exe`), unauthorized use of remote desktop services, `file/admin$` shares, WMI, PowerShell, pass-the-hash, or the abuse of scheduled tasks. Organizations must be extra vigilant in detecting lateral movement techniques and look for suspicious activity in and around high-value strategic network assets, such as Active Directory, which are often considered the primary target or "crown jewels" to a persistent threat actor.\ @@ -546,7 +546,7 @@ version = 5 references = ["https://blogs.mcafee.com/mcafee-labs/malware-employs-powershell-to-infect-systems/", "https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Any Powershell DownloadFile - Rule", "ESCU - Any Powershell DownloadString - Rule", "ESCU - Detect Empire with PowerShell Script Block Logging - Rule", "ESCU - Detect Mimikatz With PowerShell Script Block Logging - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Malicious PowerShell Process - Encoded Command - Rule", "ESCU - Malicious PowerShell Process - Multiple Suspicious Command-Line Arguments - Rule", "ESCU - Malicious PowerShell Process With Obfuscation Techniques - Rule", "ESCU - PowerShell Domain Enumeration - Rule", "ESCU - PowerShell Loading DotNET into Memory via System Reflection Assembly - Rule", "ESCU - Powershell Creating Thread Mutex - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Powershell Fileless Process Injection via GetProcAddress - Rule", "ESCU - Powershell Fileless Script Contains Base64 Encoded Content - Rule", "ESCU - Powershell Processing Stream Of Data - Rule", "ESCU - Powershell Using memory As Backing Store - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recon Using WMI Class - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unloading AMSI via Reflection - Rule", "ESCU - WMI Recon Running Process Or Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Attackers are finding stealthy ways "live off the land," leveraging utilities and tools that come standard on the endpoint--such as PowerShell--to achieve their goals without downloading binary files. These searches can help you detect and investigate PowerShell command-line options that may be indicative of malicious intent. narrative = The searches in this Analytic Story monitor for parameters often used for malicious purposes. It is helpful to understand how often the notable events generated by this story occur, as well as the commonalities between some of these events. These factors may provide clues about whether this is a common occurrence of minimal concern or a rare event that may require more extensive investigation. Likewise, it is important to determine whether the issue is restricted to a single user/system or is broader in scope. \ The following factors may assist you in determining whether the event is malicious: \ @@ -594,7 +594,7 @@ version = 1 references = ["https://learn.cisecurity.org/20-controls-download"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - No Windows Updates in a time frame - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - No Windows Updates in a time frame - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your enterprise to ensure that your endpoints are being patched and updated. Adversaries notoriously exploit known vulnerabilities that could be mitigated by applying routine security patches. narrative = It is a common best practice to ensure that endpoints are being patched and updated in a timely manner, in order to reduce the risk of compromise via a publicly disclosed vulnerability. Timely application of updates/patches is important to eliminate known vulnerabilities that may be exploited by various threat actors.\ Searches in this analytic story are designed to help analysts monitor endpoints for system patches and/or updates. This helps analysts identify any systems that are not successfully updated in a timely matter.\ @@ -618,7 +618,7 @@ version = 1 references = ["https://docs.microsoft.com/en-us/previous-versions/tn-archive/bb490939(v=technet.10)", "https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html", "http://blog.jpcert.or.jp/2016/01/windows-commands-abused-by-attackers.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Processes created by netsh - Rule", "ESCU - Processes launching netsh - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the abuse of `netsh.exe`, which can disable local firewall settings or set up a remote connection to a host from an infected system. narrative = It is a common practice for attackers of all types to leverage native Windows tools and functionality to execute commands for malicious reasons. One such tool on Windows OS is `netsh.exe`,a command-line scripting utility that allows you to--either locally or remotely--display or modify the network configuration of a computer that is currently running. `Netsh.exe` can be used to discover and disable local firewall settings. It can also be used to set up a remote connection to a host from an infected system.\ To get started, run the detection search to identify parent processes of `netsh.exe`. @@ -641,7 +641,7 @@ version = 2 references = ["https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia", "https://www.infosecurity-magazine.com/news/healthcare-targeted-by-hacker/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect activities and various techniques associated with the Orangeworm Attack Group, a group that frequently targets the healthcare industry. narrative = In May of 2018, the attack group Orangeworm was implicated for installing a custom backdoor called Trojan.Kwampirs within large international healthcare corporations in the United States, Europe, and Asia. This malware provides the attackers with remote access to the target system, decrypting and extracting a copy of its main DLL payload from its resource section. Before writing the payload to disk, it inserts a randomly generated string into the middle of the decrypted payload in an attempt to evade hash-based detections.\ Awareness of the Orangeworm group first surfaced in January, 2015. It has conducted targeted attacks against related industries, as well, such as pharmaceuticals and healthcare IT solution providers.\ @@ -655,7 +655,7 @@ version = 1 references = ["https://www.infosecurity-magazine.com/news/scope-of-mudcarp-attacks-highlight-1/", "http://blog.amossys.fr/badflick-is-not-so-bad.html"] maintainers = [{"company": "iDefense", "email": "-", "name": "iDefense Cyber Espionage Team"}] spec_version = 3 -searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First time seen command line argument - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Malicious PowerShell Process - Connect To Internet With Hidden Window - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor your environment for suspicious behaviors that resemble the techniques employed by the MUDCARP threat group. narrative = This story was created as a joint effort between iDefense and Splunk.\ iDefense analysts have recently discovered a Windows executable file that, upon execution, spoofs a decryption tool and then drops a file that appears to be the custom-built javascript backdoor, "Orz," which is associated with the threat actors known as MUDCARP (as well as "temp.Periscope" and "Leviathan"). The file is executed using Wscript.\ @@ -709,7 +709,7 @@ version = 1 references = ["http://www.novetta.com/2015/02/advanced-methods-to-detect-advanced-cyber-attacks-protocol-abuse/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Allow Inbound Traffic By Firewall Rule Registry - Rule", "ESCU - Allow Inbound Traffic In Firewall Rule - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Enable RDP In Other Port Number - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Protocol or Port Mismatch - Rule", "ESCU - TOR Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Detect instances of prohibited network traffic allowed in the environment, as well as protocols running on non-standard ports. Both of these types of behaviors typically violate policy and can be leveraged by attackers. narrative = A traditional security best practice is to control the ports, protocols, and services allowed within your environment. By limiting the services and protocols to those explicitly approved by policy, administrators can minimize the attack surface. The combined effect allows both network defenders and security controls to focus and not be mired in superfluous traffic or data types. Looking for deviations to policy can identify attacker activity that abuses services and protocols to run on alternate or non-standard ports in the attempt to avoid detection or frustrate forensic analysts. @@ -720,7 +720,7 @@ version = 1 references = ["https://www.carbonblack.com/2017/06/28/carbon-black-threat-research-technical-analysis-petya-notpetya-ransomware/", "https://www.splunk.com/blog/2017/06/27/closing-the-detection-to-mitigation-gap-or-to-petya-or-notpetya-whocares-.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - Allow File And Printing Sharing In Firewall - Rule", "ESCU - Allow Network Discovery In Firewall - Rule", "ESCU - Allow Operation with Consent Admin - Rule", "ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - CMLUA Or CMSTPLUA UAC Bypass - Rule", "ESCU - Clear Unallocated Sector Using Cipher App - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Conti Common Exec parameter - Rule", "ESCU - Delete ShadowCopy With PowerShell - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect RClone Command-Line Usage - Rule", "ESCU - Detect Renamed RClone - Rule", "ESCU - Detect SharpHound Command-Line Arguments - Rule", "ESCU - Detect SharpHound File Modifications - Rule", "ESCU - Detect SharpHound Usage - Rule", "ESCU - Disable AMSI Through Registry - Rule", "ESCU - Disable ETW Through Registry - Rule", "ESCU - Disable Logs Using WevtUtil - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Excessive Service Stop Attempt - Rule", "ESCU - Excessive Usage Of Net App - Rule", "ESCU - Excessive Usage Of SC Service Utility - Rule", "ESCU - Execute Javascript With Jscript COM CLSID - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - ICACLS Grant Command - Rule", "ESCU - Known Services Killed by Ransomware - Rule", "ESCU - Modification Of Wallpaper - Rule", "ESCU - Msmpeng Application DLL Side Loading - Rule", "ESCU - Permission Modification using Takeown App - Rule", "ESCU - Powershell Disable Security Monitoring - Rule", "ESCU - Powershell Enable SMB1Protocol Feature - Rule", "ESCU - Prevent Automatic Repair Mode using Bcdedit - Rule", "ESCU - Prohibited Network Traffic Allowed - Rule", "ESCU - Recon AVProduct Through Pwh or WMI - Rule", "ESCU - Recursive Delete of Directory In Batch CMD - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Revil Common Exec Parameter - Rule", "ESCU - Revil Registry Entry - Rule", "ESCU - SMB Traffic Spike - MLTK - Rule", "ESCU - SMB Traffic Spike - Rule", "ESCU - Scheduled tasks used in BadRabbit ransomware - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Start Up During Safe Mode Boot - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - TOR Traffic - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - Wbemprox COM Object Execution - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware--spikes in SMB traffic, suspicious wevtutil usage, the presence of common ransomware extensions, and system processes run from unexpected locations, and many others. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise. Attackers can deploy ransomware to enterprises through spearphishing campaigns and driveby downloads, as well as through traditional remote service-based exploitation. In the case of the WannaCry campaign, there was self-propagating wormable functionality that was used to maximize infection. Fortunately, organizations can apply several techniques--such as those in this Analytic Story--to detect and or mitigate the effects of ransomware. @@ -731,7 +731,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/s3-ransomware-part-1-attack-vector/", "https://github.com/d1vious/git-wild-hunt", "https://www.youtube.com/watch?v=PgzNib37g0M"] maintainers = [{"company": "David Dorsey, Splunk", "email": "-", "name": "Rod Soto"}] spec_version = 3 -searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - AWS Detect Users creating keys with encrypt policy without MFA - Rule", "ESCU - AWS Detect Users with KMS keys performing encryption S3 - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to ransomware. These searches include cloud related objects that may be targeted by malicious actors via cloud providers own encryption features. narrative = Ransomware is an ever-present risk to the enterprise, wherein an infected host encrypts business-critical data, holding it hostage until the victim pays the attacker a ransom. There are many types and varieties of ransomware that can affect an enterprise.Cloud ransomware can be deployed by obtaining high privilege credentials from targeted users or resources. @@ -753,7 +753,7 @@ version = 1 references = ["https://www.fireeye.com/blog/executive-perspective/2015/09/the_new_route_toper.html", "https://www.cisco.com/c/en/us/about/security-center/event-response/synful-knock.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect ARP Poisoning - Rule", "ESCU - Detect IPv6 Network Infrastructure Threats - Rule", "ESCU - Detect New Login Attempts to Routers - Rule", "ESCU - Detect Port Security Violation - Rule", "ESCU - Detect Rogue DHCP Server - Rule", "ESCU - Detect Software Download To Network Device - Rule", "ESCU - Detect Traffic Mirroring - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Validate the security configuration of network infrastructure and verify that only authorized users and systems are accessing critical assets. Core routing and switching infrastructure are common strategic targets for attackers. narrative = Networking devices, such as routers and switches, are often overlooked as resources that attackers will leverage to subvert an enterprise. Advanced threats actors have shown a proclivity to target these critical assets as a means to siphon and redirect network traffic, flash backdoored operating systems, and implement cryptographic weakened algorithms to more easily decrypt network traffic.\ This Analytic Story helps you gain a better understanding of how your network devices are interacting with your hosts. By compromising your network devices, attackers can obtain direct access to the company's internal infrastructure— effectively increasing the attack surface and accessing private services/data. @@ -765,7 +765,7 @@ version = 1 references = ["https://www.splunk.com/en_us/blog/security/detecting-ryuk-using-splunk-attack-range.html", "https://www.crowdstrike.com/blog/big-game-hunting-with-ryuk-another-lucrative-targeted-ransomware/", "https://us-cert.cisa.gov/ncas/alerts/aa20-302a"] maintainers = [{"company": "Splunk", "email": "-", "name": "Jose Hernandez"}] spec_version = 3 -searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - BCDEdit Failure Recovery Modification - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Get Notable History - Rule", "ESCU - NLTest Domain Trust Discovery - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Ryuk Test Files Detected - Rule", "ESCU - Ryuk Wake on LAN Command - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WBAdmin Delete System Backups - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Windows Security Account Manager Stopped - Rule", "ESCU - Windows connhost exe started forcefully - Rule", "ESCU - Get Notable History - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the Ryuk ransomware, including looking for file writes associated with Ryuk, Stopping Security Access Manager, DisableAntiSpyware registry key modification, suspicious psexec use, and more. narrative = Cybersecurity Infrastructure Security Agency (CISA) released Alert (AA20-302A) on October 28th called “Ransomware Activity Targeting the Healthcare and Public Health Sector.” This alert details TTPs associated with ongoing and possible imminent attacks against the Healthcare sector, and is a joint advisory in coordination with other U.S. Government agencies. The objective of these malicious campaigns is to infiltrate targets in named sectors and to drop ransomware payloads, which will likely cause disruption of service and increase risk of actual harm to the health and safety of patients at hospitals, even with the aggravant of an ongoing COVID-19 pandemic. This document specifically refers to several crimeware exploitation frameworks, emphasizing the use of Ryuk ransomware as payload. The Ryuk ransomware payload is not new. It has been well documented and identified in multiple variants. Payloads need a carrier, and for Ryuk it has often been exploitation frameworks such as Cobalt Strike, or popular crimeware frameworks such as Emotet or Trickbot. @@ -776,7 +776,7 @@ version = 1 references = ["https://capec.mitre.org/data/definitions/66.html", "https://www.incapsula.com/web-application-security/sql-injection.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - SQL Injection with Long URLs - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - SQL Injection with Long URLs - Rule", "ESCU - Get Notable History - Response Task"] description = Use the searches in this Analytic Story to help you detect structured query language (SQL) injection attempts characterized by long URLs that contain malicious parameters. narrative = It is very common for attackers to inject SQL parameters into vulnerable web applications, which then interpret the malicious SQL statements.\ This Analytic Story contains a search designed to identify attempts by attackers to leverage this technique to compromise a host and gain a foothold in the target environment. @@ -788,7 +788,7 @@ version = 1 references = ["https://www.crowdstrike.com/blog/an-in-depth-analysis-of-samsam-ransomware-and-boss-spider/", "https://nakedsecurity.sophos.com/2018/07/31/samsam-the-almost-6-million-ransomware/", "https://thehackernews.com/2018/07/samsam-ransomware-attacks.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] +searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Batch File Write to System32 - Rule", "ESCU - Common Ransomware Extensions - Rule", "ESCU - Common Ransomware Notes - Rule", "ESCU - Deleting Shadow Copies - Rule", "ESCU - Detect PsExec With accepteula Flag - Rule", "ESCU - Detect Renamed PSExec - Rule", "ESCU - Detect attackers scanning for vulnerable JBoss servers - Rule", "ESCU - Detect malicious requests to exploit JBoss servers - Rule", "ESCU - File with Samsam Extension - Rule", "ESCU - Get Backup Logs For Endpoint - Rule", "ESCU - Get History Of Email Sources - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Investigate Successful Remote Desktop Authentications - Rule", "ESCU - Prohibited Software On Endpoint - Rule", "ESCU - Remote Desktop Network Bruteforce - Rule", "ESCU - Remote Desktop Network Traffic - Rule", "ESCU - Samsam Test File Write - Rule", "ESCU - Spike in File Writes - Rule", "ESCU - Get Backup Logs For Endpoint - Response Task", "ESCU - Get History Of Email Sources - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Investigate Successful Remote Desktop Authentications - Response Task"] description = Leverage searches that allow you to detect and investigate unusual activities that might relate to the SamSam ransomware, including looking for file writes associated with SamSam, RDP brute force attacks, the presence of files with SamSam ransomware extensions, suspicious psexec use, and more. narrative = The first version of the SamSam ransomware (a.k.a. Samas or SamsamCrypt) was launched in 2015 by a group of Iranian threat actors. The malicious software has affected and continues to affect thousands of victims and has raised almost $6M in ransom.\ Although categorized under the heading of ransomware, SamSam campaigns have some importance distinguishing characteristics. Most notable is the fact that conventional ransomware is a numbers game. Perpetrators use a "spray-and-pray" approach with phishing campaigns or other mechanisms, charging a small ransom (typically under $1,000). The goal is to find a large number of victims willing to pay these mini-ransoms, adding up to a lucrative payday. They use relatively simple methods for infecting systems.\ @@ -833,7 +833,7 @@ version = 1 references = ["https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Detect new user AWS Console Login - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Monitor your AWS authentication events using your CloudTrail logs. Searches within this Analytic Story will help you stay aware of and investigate suspicious logins. narrative = It is important to monitor and control who has access to your AWS infrastructure. Detecting suspicious logins to your AWS infrastructure will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any EC2 instances created by the attacker. @@ -844,7 +844,7 @@ version = 2 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://www.tripwire.com/state-of-security/security-data-protection/cloud/public-aws-s3-buckets-writable/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS S3 Bucket details via bucketName - Rule", "ESCU - Detect New Open S3 Buckets over AWS CLI - Rule", "ESCU - Detect New Open S3 buckets - Rule", "ESCU - Detect S3 access from a new IP - Rule", "ESCU - Detect Spike in S3 Bucket deletion - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS activities via region name - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS S3 Bucket details via bucketName - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS activities via region name - Response Task"] description = Use the searches in this Analytic Story to monitor your AWS S3 buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open S3 buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = As cloud computing has exploded, so has the number of creative attacks on virtual environments. And as the number-two cloud-service provider, Amazon Web Services (AWS) has certainly had its share.\ Amazon's "shared responsibility" model dictates that the company has responsibility for the environment outside of the VM and the customer is responsible for the security inside of the S3 container. As such, it's important to stay vigilant for activities that may belie suspicious behavior inside of your environment.\ @@ -857,7 +857,7 @@ version = 1 references = ["https://rhinosecuritylabs.com/aws/hiding-cloudcobalt-strike-beacon-c2-using-amazon-apis/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - AWS Network ACL Details from ID - Rule", "ESCU - AWS Network Interface details via resourceId - Rule", "ESCU - Detect Spike in blocked Outbound Traffic from your AWS - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - AWS Network ACL Details from ID - Response Task", "ESCU - AWS Network Interface details via resourceId - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Information For Port Activity - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Leverage these searches to monitor your AWS network traffic for evidence of anomalous activity and suspicious behaviors, such as a spike in blocked outbound traffic in your virtual private cloud (VPC). narrative = A virtual private cloud (VPC) is an on-demand managed cloud-computing service that isolates computing resources for each client. Inside the VPC container, the environment resembles a physical network. \ Amazon's VPC service enables you to launch EC2 instances and leverage other Amazon resources. The traffic that flows in and out of this VPC can be controlled via network access-control rules and security groups. Amazon also has a feature called VPC Flow Logs that enables you to log IP traffic going to and from the network interfaces in your VPC. This data is stored using Amazon CloudWatch Logs.\ @@ -871,7 +871,7 @@ version = 1 references = ["https://aws.amazon.com/blogs/security/aws-cloudtrail-now-tracks-cross-account-activity-to-its-origin/", "https://docs.aws.amazon.com/IAM/latest/UserGuide/cloudtrail-integration.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] +searches = ["ESCU - AWS Cross Account Activity From Previously Unseen Account - Rule", "ESCU - Detect AWS Console Login by New User - Rule", "ESCU - Detect AWS Console Login by User from New City - Rule", "ESCU - Detect AWS Console Login by User from New Country - Rule", "ESCU - Detect AWS Console Login by User from New Region - Rule", "ESCU - Get Notable History - Rule", "ESCU - Investigate AWS User Activities by user field - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Investigate AWS User Activities by user field - Response Task"] description = Monitor your cloud authentication events. Searches within this Analytic Story leverage the recent cloud updates to the Authentication data model to help you stay aware of and investigate suspicious login activity. narrative = It is important to monitor and control who has access to your cloud infrastructure. Detecting suspicious logins will provide good starting points for investigations. Abusive behaviors caused by compromised credentials can lead to direct monetary costs, as you will be billed for any compute activity whether legitimate or otherwise.\ This Analytic Story has data model versions of cloud searches leveraging Authentication data, including those looking for suspicious login activity, and cross-account activity for AWS. @@ -883,7 +883,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -894,7 +894,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Cloud Provisioning Activity From Previously Unseen City - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Country - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen IP Address - Rule", "ESCU - Cloud Provisioning Activity From Previously Unseen Region - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Because most enterprise cloud infrastructure activities originate from familiar geographic locations, monitoring for activity from unknown or unusual regions is an important security measure. This indicator can be especially useful in environments where it is impossible to add specific IPs to an allow list because they vary.\ This Analytic Story was designed to provide you with flexibility in the precision you employ in specifying legitimate geographic regions. It can be as specific as an IP address or a city, or as broad as a region (think state) or an entire country. By determining how precise you want your geographical locations to be and monitoring for new locations that haven't previously accessed your environment, you can detect adversaries as they begin to probe your environment. Since there are legitimate reasons for activities from unfamiliar locations, this is not a standalone indicator. Nevertheless, location can be a relevant piece of information that you may wish to investigate further. @@ -906,7 +906,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf", "https://redlock.io/blog/cryptojacking-tesla"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] +searches = ["ESCU - AWS IAM AccessDenied Discovery Events - Rule", "ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Infrastructure API Calls - Rule", "ESCU - Abnormally High Number Of Cloud Security Group API Calls - Rule", "ESCU - Cloud API Calls From Previously Unseen User Roles - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task"] description = Detect and investigate suspicious activities by users and roles in your cloud environments. narrative = It seems obvious that it is critical to monitor and control the users who have access to your cloud infrastructure. Nevertheless, it's all too common for enterprises to lose track of ad-hoc accounts, leaving their servers vulnerable to attack. In fact, this was the very oversight that led to Tesla's cryptojacking attack in February, 2018.\ In addition to compromising the security of your data, when bad actors leverage your compute resources, it can incur monumental costs, since you will be billed for any new instances and increased bandwidth usage. @@ -918,7 +918,7 @@ version = 2 references = ["https://attack.mitre.org/wiki/Technique/T1059", "https://www.microsoft.com/en-us/wdsi/threats/macro-malware", "https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Use of cmd exe to Launch Script Interpreters - Rule", "ESCU - First time seen command line argument - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Leveraging the Windows command-line interface (CLI) is one of the most common attack techniques--one that is also detailed in the MITRE ATT&CK framework. Use this Analytic Story to help you identify unusual or suspicious use of the CLI on Windows systems. narrative = The ability to execute arbitrary commands via the Windows CLI is a primary goal for the adversary. With access to the shell, an attacker can easily run scripts and interact with the target system. Often, attackers may only have limited access to the shell or may obtain access in unusual ways. In addition, malware may execute and interact with the CLI in ways that would be considered unusual and inconsistent with typical user activity. This provides defenders with opportunities to identify suspicious use and investigate, as appropriate. This Analytic Story contains various searches to help identify this suspicious activity, as well as others to aid you in deeper investigation. @@ -943,7 +943,7 @@ version = 1 references = ["http://blogs.splunk.com/2015/10/01/random-words-on-entropy-and-dns/", "http://www.darkreading.com/analytics/security-monitoring/got-malware-three-signs-revealed-in-dns-traffic/d/d-id/1139680", "https://live.paloaltonetworks.com/t5/Threat-Vulnerability-Articles/What-are-suspicious-DNS-queries/ta-p/71454"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] +searches = ["ESCU - Clients Connecting to Multiple DNS Servers - Rule", "ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - DNS Query Length Outliers - MLTK - Rule", "ESCU - DNS Query Length With High Standard Deviation - Rule", "ESCU - DNS Query Requests Resolved by Unauthorized DNS Servers - Rule", "ESCU - Detect Long DNS TXT Record Response - Rule", "ESCU - Detect hosts connecting to dynamic domain providers - Rule", "ESCU - Detection of DNS Tunnels - Rule", "ESCU - Excessive DNS Failures - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get DNS Server History for a host - Rule", "ESCU - Get DNS traffic ratio - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Process Responsible For The DNS Traffic - Rule", "ESCU - Get DNS Server History for a host - Response Task", "ESCU - Get DNS traffic ratio - Response Task", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Process Responsible For The DNS Traffic - Response Task"] description = Attackers often attempt to hide within or otherwise abuse the domain name system (DNS). You can thwart attempts to manipulate this omnipresent protocol by monitoring for these types of abuses. narrative = Although DNS is one of the fundamental underlying protocols that make the Internet work, it is often ignored (perhaps because of its complexity and effectiveness). However, attackers have discovered ways to abuse the protocol to meet their objectives. One potential abuse involves manipulating DNS to hijack traffic and redirect it to an IP address under the attacker's control. This could inadvertently send users intending to visit google.com, for example, to an unrelated malicious website. Another technique involves using the DNS protocol for command-and-control activities with the attacker's malicious code or to covertly exfiltrate data. The searches within this Analytic Story look for these types of abuses. @@ -954,7 +954,7 @@ version = 1 references = ["https://www.splunk.com/blog/2015/06/26/phishing-hits-a-new-level-of-quality/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Email Attachments With Lots Of Spaces - Rule", "ESCU - Get Email Info - Rule", "ESCU - Get Emails From Specific Sender - Rule", "ESCU - Get Notable History - Rule", "ESCU - Monitor Email For Brand Abuse - Rule", "ESCU - Suspicious Email - UBA Anomaly - Rule", "ESCU - Suspicious Email Attachment Extensions - Rule", "ESCU - Get Email Info - Response Task", "ESCU - Get Emails From Specific Sender - Response Task", "ESCU - Get Notable History - Response Task"] description = Email remains one of the primary means for attackers to gain an initial foothold within the modern enterprise. Detect and investigate suspicious emails in your environment with the help of the searches in this Analytic Story. narrative = It is a common practice for attackers of all types to leverage targeted spearphishing campaigns and mass mailers to deliver weaponized email messages and attachments. Fortunately, there are a number of ways to monitor email data in Splunk to detect suspicious content.\ Once a phishing message has been detected, the next steps are to answer the following questions: \ @@ -969,7 +969,7 @@ version = 1 references = ["https://cloud.google.com/blog/product/gcp/4-steps-for-hardening-your-cloud-storage-buckets-taking-charge-of-your-security", "https://rhinosecuritylabs.com/gcp/google-cloud-platform-gcp-bucket-enumeration/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect GCP Storage access from a new IP - Rule", "ESCU - Detect New Open GCP Storage Buckets - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Use the searches in this Analytic Story to monitor your GCP Storage buckets for evidence of anomalous activity and suspicious behaviors, such as detecting open storage buckets and buckets being accessed from a new IP. The contextual and investigative searches will give you more information, when required. narrative = Similar to other cloud providers, GCP operates on a shared responsibility model. This means the end user, you, are responsible for setting appropriate access control lists and permissions on your GCP resources.\ This Analytics Story concentrates on detecting things like open storage buckets (both read and write) along with storage bucket access from unfamiliar users and IP addresses. @@ -980,7 +980,7 @@ version = 2 references = ["https://redcanary.com/blog/introducing-atomictestharnesses/", "https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/techniques/T1218/005/", "https://medium.com/@mbromileyDFIR/malware-monday-aebb456356c5"] maintainers = [{"company": "Michael Haag, Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Detect MSHTA Url in Command Line - Rule", "ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - Detect Rundll32 Inline HTA Execution - Rule", "ESCU - Detect mshta inline hta execution - Rule", "ESCU - Detect mshta renamed - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Suspicious mshta child process - Rule", "ESCU - Suspicious mshta spawn - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect techniques used by attackers who leverage the mshta.exe process to execute malicious code. narrative = One common adversary tactic is to bypass application control solutions via the mshta.exe process, which loads Microsoft HTML applications (mshtml.dll) with the .hta suffix. In these cases, attackers use the trusted Windows utility to proxy execution of malicious files, whether an .hta application, javascript, or VBScript.\ The searches in this story help you detect and investigate suspicious activity that may indicate that an attacker is leveraging mshta.exe to execute malicious code.\ @@ -1003,7 +1003,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Technique/T1078", "https://owasp.org/www-community/attacks/Credential_stuffing", "https://searchsecurity.techtarget.com/answer/What-is-a-password-spraying-attack-and-how-does-it-work"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] +searches = ["ESCU - Investigate Okta Activity by IP Address - Rule", "ESCU - Investigate Okta Activity by app - Rule", "ESCU - Investigate User Activities In Okta - Rule", "ESCU - Multiple Okta Users With Invalid Credentials From The Same IP - Rule", "ESCU - Okta Account Lockout Events - Rule", "ESCU - Okta Failed SSO Attempts - Rule", "ESCU - Okta User Logins From Multiple Cities - Rule", "ESCU - Investigate Okta Activity by IP Address - Response Task", "ESCU - Investigate Okta Activity by app - Response Task", "ESCU - Investigate User Activities In Okta - Response Task"] description = Monitor your Okta environment for suspicious activities. Due to the Covid outbreak, many users are migrating over to leverage cloud services more and more. Okta is a popular tool to manage multiple users and the web-based applications they need to stay productive. The searches in this story will help monitor your Okta environment for suspicious activities and associated user behaviors. narrative = Okta is the leading single sign on (SSO) provider, allowing users to authenticate once to Okta, and from there access a variety of web-based applications. These applications are assigned to users and allow administrators to centrally manage which users are allowed to access which applications. It also provides centralized logging to help understand how the applications are used and by whom. \ While SSO is a major convenience for users, it also provides attackers with an opportunity. If the attacker can gain access to Okta, they can access a variety of applications. As such monitoring the environment is important. \ @@ -1049,7 +1049,7 @@ version = 2 references = ["https://www.blackhat.com/docs/us-15/materials/us-15-Graeber-Abusing-Windows-Management-Instrumentation-WMI-To-Build-A-Persistent%20Asynchronous-And-Fileless-Backdoor-wp.pdf", "https://www.fireeye.com/blog/threat-research/2017/03/wmimplant_a_wmi_ba.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] +searches = ["ESCU - Detect WMI Event Subscription Persistence - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Get Sysmon WMI Activity for Host - Rule", "ESCU - Process Execution via WMI - Rule", "ESCU - Remote Process Instantiation via WMI - Rule", "ESCU - Remote WMI Command Attempt - Rule", "ESCU - Script Execution via WMI - Rule", "ESCU - WMI Permanent Event Subscription - Rule", "ESCU - WMI Permanent Event Subscription - Sysmon - Rule", "ESCU - WMI Temporary Event Subscription - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task", "ESCU - Get Sysmon WMI Activity for Host - Response Task"] description = Attackers are increasingly abusing Windows Management Instrumentation (WMI), a framework and associated utilities available on all modern Windows operating systems. Because WMI can be leveraged to manage both local and remote systems, it is important to identify the processes executed and the user context within which the activity occurred. narrative = WMI is a Microsoft infrastructure for management data and operations on Windows operating systems. It includes of a set of utilities that can be leveraged to manage both local and remote Windows systems. Attackers are increasingly turning to WMI abuse in their efforts to conduct nefarious tasks, such as reconnaissance, detection of antivirus and virtual machines, code execution, lateral movement, persistence, and data exfiltration. The detection searches included in this Analytic Story are used to look for suspicious use of WMI commands that attackers may leverage to interact with remote systems. The searches specifically look for the use of WMI to run processes on remote systems. In the event that unauthorized WMI execution occurs, it will be important for analysts and investigators to determine the context of the event. These details may provide insights related to how WMI was used and to what end. @@ -1060,7 +1060,7 @@ version = 1 references = ["https://redcanary.com/blog/windows-registry-attacks-threat-detection/", "https://attack.mitre.org/wiki/Technique/T1112"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disabling Remote User Account Control - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor and detect registry changes initiated from remote locations, which can be a sign that an attacker has infiltrated your system. narrative = Attackers are developing increasingly sophisticated techniques for hijacking target servers, while evading detection. One such technique that has become progressively more common is registry modification.\ The registry is a key component of the Windows operating system. It has a hierarchical database called "registry" that contains settings, options, and values for executables. Once the threat actor gains access to a machine, they can use reg.exe to modify their account to obtain administrator-level privileges, maintain persistence, and move laterally within the environment.\ @@ -1073,7 +1073,7 @@ version = 1 references = ["https://blog.rapid7.com/2020/04/02/dispelling-zoom-bugbears-what-you-need-to-know-about-the-latest-zoom-vulnerabilities/", "https://threatpost.com/two-zoom-zero-day-flaws-uncovered/154337/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get Process File Activity - Response Task"] +searches = ["ESCU - Detect Prohibited Applications Spawning cmd exe - Rule", "ESCU - First Time Seen Child Process of Zoom - Rule", "ESCU - Get Process File Activity - Rule", "ESCU - Get Process File Activity - Response Task"] description = Attackers are using Zoom as an vector to increase privileges on a sytems. This story detects new child processes of zoom and provides investigative actions for this detection. narrative = Zoom is a leader in modern enterprise video communications and its usage has increased dramatically with a large amount of the population under stay-at-home orders due to the COVID-19 pandemic. With increased usage has come increased scrutiny and several security flaws have been found with this application on both Windows and macOS systems.\ Current detections focus on finding new child processes of this application on a per host basis. Investigative searches are included to gather information needed during an investigation. @@ -1132,7 +1132,7 @@ version = 2 references = ["https://www.fireeye.com/blog/threat-research/2017/08/monitoring-windows-console-activity-part-two.html", "https://www.splunk.com/pdfs/technical-briefs/advanced-threat-detection-and-response-tech-brief.pdf", "https://www.sans.org/reading-room/whitepapers/logging/detecting-security-incidents-windows-workstation-event-logs-34262"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Attacker Tools On Endpoint - Rule", "ESCU - Detect Rare Executables - Rule", "ESCU - Detect processes used for System Network Configuration Discovery - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - RunDLL Loading DLL By Ordinal - Rule", "ESCU - System Processes Run From Unexpected Locations - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Unusually Long Command Line - MLTK - Rule", "ESCU - Unusually Long Command Line - Rule", "ESCU - WinRM Spawning a Process - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Quickly identify systems running new or unusual processes in your environment that could be indicators of suspicious activity. Processes run from unusual locations, those with conspicuously long command lines, and rare executables are all examples of activities that may warrant deeper investigation. narrative = Being able to profile a host's processes within your environment can help you more quickly identify processes that seem out of place when compared to the rest of the population of hosts or asset types.\ This Analytic Story lets you identify processes that are either a) not typically seen running or b) have some sort of suspicious command-line arguments associated with them. This Analytic Story will also help you identify the user running these processes and the associated process activity on the host.\ @@ -1145,7 +1145,7 @@ version = 1 references = ["https://www.monkey.org/~dugsong/dsniff/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] +searches = ["ESCU - Get Notable History - Rule", "ESCU - Get Process Information For Port Activity - Rule", "ESCU - Protocols passing authentication in cleartext - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Process Information For Port Activity - Response Task"] description = Leverage searches that detect cleartext network protocols that may leak credentials or should otherwise be encrypted. narrative = Various legacy protocols operate by default in the clear, without the protections of encryption. This potentially leaks sensitive information that can be exploited by passively sniffing network traffic. Depending on the protocol, this information could be highly sensitive, or could allow for session hijacking. In addition, these protocols send authentication information, which would allow for the harvesting of usernames and passwords that could potentially be used to authenticate and compromise secondary systems. @@ -1156,7 +1156,7 @@ version = 1 references = ["https://research.checkpoint.com/2020/resolving-your-way-into-domain-admin-exploiting-a-17-year-old-bug-in-windows-dns-servers/", "https://support.microsoft.com/en-au/help/4569509/windows-dns-server-remote-code-execution-vulnerability"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - Detect Windows DNS SIGRed via Splunk Stream - Rule", "ESCU - Detect Windows DNS SIGRed via Zeek - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Notable History - Response Task"] description = Uncover activity consistent with CVE-2020-1350, or SIGRed. Discovered by Checkpoint researchers, this vulnerability affects Windows 2003 to 2019, and is triggered by a malicious DNS response (only affects DNS over TCP). An attacker can use the malicious payload to cause a buffer overflow on the vulnerable system, leading to compromise. The included searches in this Analytic Story are designed to identify the large response payload for SIG and KEY DNS records which can be used for the exploit. narrative = When a client requests a DNS record for a particular domain, that request gets routed first through the client's locally configured DNS server, then to any DNS server(s) configured as forwarders, and then onto the target domain's own DNS server(s). If a attacker wanted to, they could host a malicious DNS server that responds to the initial request with a specially crafted large response (~65KB). This response would flow through to the client's local DNS server, which if not patched for CVE-2020-1350, would cause the buffer overflow. The detection searches in this Analytic Story use wire data to detect the malicious behavior. Searches for Splunk Stream and Zeek are included. The Splunk Stream search correlates across stream:dns and stream:tcp, while the Zeek search correlates across bro:dns:json and bro:conn:json. These correlations are required to pick up both the DNS record types (SIG and KEY) along with the payload size (>65KB). @@ -1167,7 +1167,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms. @@ -1178,7 +1178,7 @@ version = 1 references = ["https://blog.malwarebytes.com/cybercrime/2013/12/file-extensions-2/", "https://attack.mitre.org/wiki/Technique/T1042"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Execution of File With Spaces Before Extension - Rule", "ESCU - Execution of File with Multiple Extensions - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Changes to File Associations - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect and investigate suspected abuse of file extensions and Windows file associations. Some of the malicious behaviors involved may include inserting spaces before file extensions or prepending the file extension with a different one, among other techniques. narrative = Attackers use a variety of techniques to entice users to run malicious code or to persist on an endpoint. One way to accomplish these goals is to leverage file extensions and the mechanism Windows uses to associate files with specific applications. \ Since its earliest days, Windows has used extensions to identify file types. Users have become familiar with these extensions and their application associations. For example, if users see that a file ends in `.doc` or `.docx`, they will assume that it is a Microsoft Word document and expect that double-clicking will open it using `winword.exe`. The user will typically also presume that the `.docx` file is safe. \ @@ -1193,7 +1193,7 @@ version = 2 references = ["https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/", "https://zeltser.com/security-incident-log-review-checklist/", "http://journeyintoir.blogspot.com/2013/01/re-introducing-usnjrnl.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Deleting Shadow Copies - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Suspicious Event Log Service Behavior - Rule", "ESCU - Suspicious wevtutil Usage - Rule", "ESCU - USN Journal Deletion - Rule", "ESCU - Windows Event Log Cleared - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Adversaries often try to cover their tracks by manipulating Windows logs. Use these searches to help you monitor for suspicious activity surrounding log files--an essential component of an effective defense. narrative = Because attackers often modify system logs to cover their tracks and/or to thwart the investigative process, log monitoring is an industry-recognized best practice. While there are legitimate reasons to manipulate system logs, it is still worthwhile to keep track of who manipulated the logs, when they manipulated them, and in what way they manipulated them (determining which accesses, tools, or utilities were employed). Even if no malicious activity is detected, the knowledge of an attempt to manipulate system logs may be indicative of a broader security risk that should be thoroughly investigated.\ The Analytic Story gives users two different ways to detect manipulation of Windows Event Logs and one way to detect deletion of the Update Sequence Number (USN) Change Journal. The story helps determine the history of the host and the users who have accessed it. Finally, the story aides in investigation by retrieving all the information on the process that caused these events (if the process has been identified). @@ -1205,7 +1205,7 @@ version = 2 references = ["http://www.fuzzysecurity.com/tutorials/19.html", "https://www.fireeye.com/blog/threat-research/2010/07/malware-persistence-windows-registry.html", "http://resources.infosecinstitute.com/common-malware-persistence-mechanisms/", "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html", "https://www.youtube.com/watch?v=dq2Hv7J9fvk"] maintainers = [{"company": "Splunk", "email": "-", "name": "Bhavin Patel"}] spec_version = 3 -searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Certutil exe certificate extraction - Rule", "ESCU - Detect Path Interception By Creation Of program exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - Monitor Registry Keys for Print Monitors - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Registry Keys Used For Persistence - Rule", "ESCU - Registry Keys for Creating SHIM Databases - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Schedule Task with HTTP Command Arguments - Rule", "ESCU - Schedule Task with Rundll32 Command Trigger - Rule", "ESCU - Schtasks used for forcing a reboot - Rule", "ESCU - Shim Database File Creation - Rule", "ESCU - Shim Database Installation With Suspicious Parameters - Rule", "ESCU - Suspicious Scheduled Task from Public Directory - Rule", "ESCU - WinEvent Scheduled Task Created Within Public Path - Rule", "ESCU - WinEvent Scheduled Task Created to Spawn Shell - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for activities and techniques associated with maintaining persistence on a Windows system--a sign that an adversary may have compromised your environment. narrative = Maintaining persistence is one of the first steps taken by attackers after the initial compromise. Attackers leverage various custom and built-in tools to ensure survivability and persistent access within a compromised enterprise. This Analytic Story provides searches to help you identify various behaviors used by attackers to maintain persistent access to a Windows environment. @@ -1216,7 +1216,7 @@ version = 2 references = ["https://attack.mitre.org/tactics/TA0004/"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Child Processes of Spoolsv exe - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Overwriting Accessibility Binaries - Rule", "ESCU - Registry Keys Used For Privilege Escalation - Rule", "ESCU - Uncommon Processes On Endpoint - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Monitor for and investigate activities that may be associated with a Windows privilege-escalation attack, including unusual processes running on endpoints, modified registry keys, and more. narrative = Privilege escalation is a "land-and-expand" technique, wherein an adversary gains an initial foothold on a host and then exploits its weaknesses to increase his privileges. The motivation is simple: certain actions on a Windows machine--such as installing software--may require higher-level privileges than those the attacker initially acquired. By increasing his privilege level, the attacker can gain the control required to carry out his malicious ends. This Analytic Story provides searches to detect and investigate behaviors that attackers may use to elevate their privileges in your environment. @@ -1227,7 +1227,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1050", "https://attack.mitre.org/wiki/Technique/T1031"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - First Time Seen Running Windows Service - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Reg exe Manipulating Windows Services Registry Keys - Rule", "ESCU - Sc exe Manipulating Windows Services - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Windows services are often used by attackers for persistence and the ability to load drivers or otherwise interact with the Windows kernel. This Analytic Story helps you monitor your environment for indications that Windows services are being modified or created in a suspicious manner. narrative = The Windows operating system uses a services architecture to allow for running code in the background, similar to a UNIX daemon. Attackers will often leverage Windows services for persistence, hiding in plain sight, seeking the ability to run privileged code that can interact with the kernel. In many cases, attackers will create a new service to host their malicious code. Attackers have also been observed modifying unnecessary or unused services to point to their own code, as opposed to what was intended. In these cases, attackers often use tools to create or modify services in ways that are not typical for most environments, providing opportunities for detection. @@ -1580,16 +1580,6 @@ annotations = {"kill_chain_phases": ["Reconnaissance"], "mitre_attack": ["T1087. known_false_positives = admin or power user may used this series of command. providing_technologies = [] -[savedsearch://ESCU - Add Prohibited Processes to Enterprise Security - Rule] -type = detection -asset_type = -confidence = medium -explanation = WARNING, this detection has been marked deprecated by the Splunk Threat Research team, this means that it will no longer be maintained or supported. If you have any questions feel free to email us at: research@splunk.com. This search takes the existing interesting process table from ES, filters out any existing additions added by ESCU and then updates the table with processes identified by ESCU that should be prohibited on your endpoints. -how_to_implement = This search should be run on each new install of ESCU. -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - Allow File And Printing Sharing In Firewall - Rule] type = detection asset_type = @@ -1760,152 +1750,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1197", known_false_positives = Limited false positives, however it may be required to filter based on parent process name or network connection. providing_technologies = [] -[savedsearch://ESCU - Baseline Of Cloud Infrastructure API Calls Per User - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline Of Cloud Instances Destroyed - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are destroyed in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances destroyed in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline Of Cloud Instances Launched - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many instances are created in the environment. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of instances created in a small time window. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline Of Cloud Security Group API Calls Per User - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many API calls for security groups are performed by each user. By default, the search uses the last 90 days of data to build the model and the model is rebuilt weekly. -how_to_implement = You must have Enterprise Security 6.0 or later, if not you will need to verify that the Machine Learning Toolkit (MLTK) version 4.2 or later is installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 90 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline of API Calls per User ARN - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline of Command Line Length - MLTK - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the command lines observed for each user in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies outliers in the length of the command line. -how_to_implement = You must be ingesting endpoint data and populating the Endpoint data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline of DNS Query Length - MLTK - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the length of the DNS queries for each DNS record type observed in the environment. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search, which uses it to identify outliers in the length of the DNS query. -how_to_implement = To successfully implement this search, you will need to ensure that DNS data is populating the Network_Resolution data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline of Excessive AWS Instances Launched by User - MLTK - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many RunInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of RunInstances performed by a user in a small time window. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ -In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline of Excessive AWS Instances Terminated by User - MLTK - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model for how many TerminateInstances users do in the environment. By default, the search uses the last 90 days of data to build the model. The model created by this search is then used in the corresponding detection search, which identifies subsequent outliers in the number of TerminateInstances performed by a user in a small time window. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs.\ -In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. Depending on the number of users in your environment, you may also need to adjust the value for max_inputs in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data.\ -More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline of Network ACL Activity by ARN - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of API calls that were related to network ACLs made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for network ACLs, edit the macro `network_acl_events`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline of S3 Bucket deletion activity by ARN - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search establishes, on a per-hour basis, the average and standard deviation for the number of API calls related to deleting an S3 bucket by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline of SMB Traffic - MLTK - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is used to build a Machine Learning Toolkit (MLTK) model to characterize the number of SMB connections observed each hour for every day of week. By default, the search uses the last 30 days of data to build the model. The model created by this search is then used in the corresponding detection search to identify outliers in the number of SMB connections for that hour and day of the week. -how_to_implement = You must be ingesting network traffic and populating the Network_Traffic data model. In addition, you must have the Machine Learning Toolkit (MLTK) version >= 4.2 installed, along with any required dependencies. To improve your results, you may consider adding "src" to the by clause, which will build the model for each unique source in your enviornment. However, if you have a large number of hosts in your environment, this search may be very resource intensive. In this case, you may need to raise the value of max_inputs and/or max_groups in the MLTK settings for the DensityFunction algorithm, then ensure that the search completes in a reasonable timeframe. By default, the search builds the model using the past 30 days of data. You can modify the search window to build the model over a longer period of time, which may give you better results. You may also want to periodically re-run this search to rebuild the model with the latest data. More information on the algorithm used in the search can be found at `https://docs.splunk.com/Documentation/MLApp/4.2.0/User/Algorithms#DensityFunction`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline of Security Group Activity by ARN - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search establishes, on a per-hour basis, the average and the standard deviation for the number of API calls related to security groups made by each user. Also recorded is the number of data points for each user. This table is then outputted to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove API event names for security groups, edit the macro `security_group_api_calls`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Baseline of blocked outbound traffic from AWS - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search establishes, on a per-hour basis, the average and the standard deviation of the number of outbound connections blocked in your VPC flow logs by each source IP address (IP address of your EC2 instances). Also recorded is the number of data points for each source IP. This table outputs to a lookup file to allow the detection search to operate quickly. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your `VPC flow logs.`. -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - Batch File Write to System32 - Rule] type = detection asset_type = Endpoint @@ -2187,26 +2031,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1204"]} known_false_positives = 3rd party tool may have commandline parameter that can trigger this detection. providing_technologies = [] -[savedsearch://ESCU - Count of Unique IPs Connecting to Ports - Rule] -type = detection -asset_type = -confidence = medium -explanation = The search counts the number of times a connection was observed to each destination port, and the number of unique source IPs connecting to them. -how_to_implement = To successfully implement this search, you must be ingesting network traffic, and populating the Network_Traffic data model. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Count of assets by category - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search shows you every asset category you have and the assets that belong to those categories. -how_to_implement = To successfully implement this search you must first leverage the Assets and Identity framework in Enterprise Security to populate your assets_by_str.csv file which should then be mapped to the Identity_Management data model. The Identity_Management data model will contain a list of known authorized company assets. Ensure that all inventoried systems are constantly vetted and updated. -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - Create Remote Thread into LSASS - Rule] type = detection asset_type = Windows @@ -2227,16 +2051,6 @@ annotations = {"kill_chain_phases": ["Privilege Escalation"], "mitre_attack": [" known_false_positives = unknown providing_technologies = [] -[savedsearch://ESCU - Create a list of approved AWS service accounts - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for successful API activity in CloudTrail within the last 30 days, filters out known users from the identity table, and outputs values of users into `aws_service_accounts.csv` lookup file. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the service account entires in `aws_service_accounts.csv`, which is a lookup file created as a result of running this support search. Please remove the entries of service accounts that are not legitimate. -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - Create local admin accounts using net exe - Rule] type = detection asset_type = Endpoint @@ -2377,16 +2191,6 @@ annotations = {"cis20": ["CIS 1", "CIS 3", "CIS 8", "CIS 12"], "kill_chain_phase known_false_positives = Legitimate DNS changes can be detected in this search. Investigate, verify and update the list of provided current answers for the domains in question as appropriate. providing_technologies = [] -[savedsearch://ESCU - DNSTwist Domain Names - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search creates permutations of your existing domains, removes the valid domain names and stores them in a specified lookup file so they can be checked for in the associated detection searches. -how_to_implement = To successfully implement this search you need to update the file called domains.csv in the DA-ESS-SOC/lookup directory. Or `cim_corporate_email_domains.csv` and `cim_corporate_web_domains.csv` from **Splunk\_SA\_CIM**. -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - DSQuery Domain Discovery - Rule] type = detection asset_type = @@ -3608,16 +3412,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1562.00 known_false_positives = admin may disable this application for non technical user. providing_technologies = [] -[savedsearch://ESCU - Discover DNS records - Rule] -type = detection -asset_type = -confidence = medium -explanation = The search takes corporate and common cloud provider domains configured under `cim_corporate_email_domains.csv`, `cim_corporate_web_domains.csv`, and `cloud_domains.csv` finds their responses across the last 30 days from data in the `Network_Resolution ` datamodel, then stores the output under the `discovered_dns_records.csv` lookup -how_to_implement = To successfully implement this search, you must be ingesting DNS logs, and populating the Network_Resolution data model. Also make sure that the cim_corporate_web_domains and cim_corporate_email_domains lookups are populated with the domains owned by your corporation -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - Download Files Using Telegram - Rule] type = detection asset_type = @@ -4176,36 +3970,6 @@ annotations = {"cis20": ["CIS 16"], "mitre_attack": ["T1078.002"], "nist": ["PR. known_false_positives = If the Identity_Management data model is not updated regularly, this search could give you false positive alerts. Please consider this and investigate appropriately. providing_technologies = [] -[savedsearch://ESCU - Identify Systems Creating Remote Desktop Traffic - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search counts the numbers of times the system has generated remote desktop traffic. -how_to_implement = To successfully implement this search, you must ingest network traffic and populate the Network_Traffic data model. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Identify Systems Receiving Remote Desktop Traffic - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search counts the numbers of times the system has created remote desktop traffic -how_to_implement = To successfully implement this search you must ingest network traffic and populate the Network_Traffic data model. If a system receives a lot of remote desktop traffic, you can apply the category common_rdp_destination to it. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Identify Systems Using Remote Desktop - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search counts the numbers of times the remote desktop process, mstsc.exe, has run on each system. -how_to_implement = To successfully implement this search you must be ingesting endpoint data that records process activity. -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - Kerberoasting spn request with RC4 encryption - Rule] type = detection asset_type = Endpoint @@ -4556,26 +4320,6 @@ annotations = {"cis20": ["CIS 8", "CIS 5"], "kill_chain_phases": ["Actions on Ob known_false_positives = You will encounter noise from legitimate print-monitor registry entries. providing_technologies = [] -[savedsearch://ESCU - Monitor Successful Backups - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is intended to give you a feel for how often successful backups are conducted in your environment. Fluctuations in these numbers will allow you to determine when you should investigate. -how_to_implement = To successfully implement this search you must be ingesting your backup logs. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Monitor Unsuccessful Backups - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is intended to give you a feel for how often backup failures happen in your environments. Fluctuations in these numbers will allow you to determine when you should investigate. -how_to_implement = To successfully implement this search you must be ingesting your backup logs. -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - Monitor Web Traffic For Brand Abuse - Rule] type = detection asset_type = Endpoint @@ -5212,336 +4956,6 @@ annotations = {"kill_chain_phases": ["Exploitation"], "mitre_attack": ["T1490"]} known_false_positives = Administrators may modify the boot configuration ignore failure during testing and debugging. providing_technologies = [] -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later)and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen AWS Cross Account Activity - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for **AssumeRole** events where the requesting account differs from the requested account, then writes these relationships to a lookup file. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_aws_cross_account_activity.csv`, a lookup file created by this support search. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen AWS Provisioning Activity Sources - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen AWS Regions - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for CloudTrail events where an AWS instance is started and creates a baseline of most recent time (latest) and the first time (earliest) we've seen this region in our dataset grouped by the value awsRegion for the last 30 days -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of the first and last times seen for every user role and command combination. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud API Calls Per User Role - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search updates the table of the first and last times seen for every user role and command combination. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Compute Creations By User - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen users that have launched a cloud compute instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the proper TAs installed. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Compute Images - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Compute Images - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen images used to launch cloud compute instances -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen cloud compute instance types -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Compute Instance Types - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen cloud compute instance types -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen users that have modified a cloud instance. -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the latest Change Datamodel accelerated. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Instance Modifications By User - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search updates a table of previously seen Cloud Instance modifications that have been made by a user -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity. This is broadly defined as any event that runs or creates something. This table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Provisioning Activity Sources - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This returns the first and last times seen for every IP address (along with its physical location) previously associated with cloud-provisioning activity within the last day. Cloud provisioning is broadly defined as any event that runs or creates something. It then updates this information with historical data and filters out locations that have not been seen within the specified time window. This updated table is then cached. -how_to_implement = You must be ingesting Cloud infrastructure logs from your cloud provider. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Regions - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Cloud Regions - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for cloud compute events where a compute instance is started and creates a baseline of most recent time, `lastTime` and the first time `firstTime` we've seen this region in our dataset grouped by the region for the last 30 days -how_to_implement = You must be ingesting the approrpiate cloud infrastructure logs and have the Security Research cloud data model installed. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen EC2 AMIs - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen AMIs used to launch EC2 instances -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen EC2 Instance Types - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen EC2 instance types -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen EC2 Launches By User - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen ARNs that have launched a EC2 instance. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen EC2 Modifications By User - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search builds a table of previously seen ARNs that have launched a EC2 instance. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS version (4.4.0 or later), then configure your CloudTrail inputs. To add or remove APIs that modify an EC2 instance, edit the macro `ec2_modification_api_calls`. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Running Windows Services - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This collects the services that have been started across your entire enterprise. -how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Running Windows Services - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search returns the first and last time a Windows service was seen across your enterprise within the last hour. It then updates this information with historical data and filters out Windows services pairs that have not been seen within the specified time window. This updated table is then cached. -how_to_implement = While this search does not require you to adhere to Splunk CIM, you must be ingesting your Windows security-event logs for it to execute successfully. Please ensure that the Splunk Add-on for Microsoft Windows is version 8.0.0 or above. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Users In CloudTrail - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by user, within the last hour. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Users in CloudTrail - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by username, within the last 30 days. -how_to_implement = You must install and configure the Splunk Add-on for AWS (version 5.1.0 or later) and Enterprise Security 6.2, which contains the required updates to the Authentication data model for cloud use cases. Validate the user name entries in `previously_seen_users_console_logins`, which is a lookup file created by this support search. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Zoom Child Processes - Initial - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS). This table is then cached. -how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously Seen Zoom Child Processes - Update - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search returns the first and last time a process was seen per endpoint with a parent process of zoom.exe (Windows) or zoom.us (macOS) within the last hour. It then updates this information with historical data and filters out proces_name and endpoint pairs that have not been seen within the specified time window. This updated table is outputed to disk. -how_to_implement = You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously seen API call per user roles in CloudTrail - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for successful API calls made by different user roles, then creates a baseline of the earliest and latest times we have encountered this user role. It also returns the name of the API call in our dataset--grouped by user role and name of the API call--that occurred within the last 30 days. In this support search, we are only looking for events where the user identity is Assumed Role. -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user role entries in `previously_seen_api_calls_from_user_roles.csv`, which is a lookup file created as a result of running this support search. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously seen S3 bucket access by remote IP - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for successful access to S3 buckets from remote IP addresses, then creates a baseline of the earliest and latest times we have encountered this remote IP within the last 30 days. In this support search, we are only looking for S3 access events where the HTTP response code from AWS is "200" -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your S3 access-logs inputs. You must validate the remote IP and bucket name entries in `previously_seen_S3_access_from_remote_ip.csv`, which is a lookup file created as a result of running this support search. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously seen command line arguments - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for command-line arguments where `cmd.exe /c` is used to execute a program, then creates a baseline of the earliest and latest times we have encountered this command-line argument in our dataset within the last 30 days. -how_to_implement = You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must be ingesting logs with both the process name and command line from your endpoints. The complete process name with command-line arguments are mapped to the "process" field in the Endpoint data model. -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Previously seen users in CloudTrail - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for CloudTrail events where a user logs into the console, then creates a baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last 30 days. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - Print Spooler Adding A Printer Driver - Rule] type = detection asset_type = @@ -6618,16 +6032,6 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives" known_false_positives = This detection may require tuning based on third party applications utilizing native Windows binaries in non-standard paths. providing_technologies = [] -[savedsearch://ESCU - Systems Ready for Spectre-Meltdown Windows Patch - Rule] -type = detection -asset_type = -confidence = medium -explanation = Some AV applications can cause the Spectre/Meltdown patch for Windows not to install successfully. This registry key is supposed to be created by the AV engine when it has been patched to be able to handle the Windows patch. If this key has been written, the system can then be patched for Spectre and Meltdown. -how_to_implement = You need to be ingesting logs with both the process name and command-line from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the Sysmon TA. -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - TOR Traffic - Rule] type = detection asset_type = Endpoint @@ -6760,16 +6164,6 @@ annotations = {"cis20": ["CIS 3", "CIS 4", "CIS 18", "CIS 12"], "kill_chain_phas known_false_positives = Very few legitimate Content-Type fields will have a length greater than 100 characters. providing_technologies = [] -[savedsearch://ESCU - Update previously seen users in CloudTrail - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search looks for CloudTrail events where a user logs into the console, then updates the baseline of the latest and earliest times, City, Region, and Country we have encountered this user in our dataset, grouped by ARN, within the last hour. NOTE - This baseline search is deprecated and has been updated to use the Authentication Datamodel -how_to_implement = You must install the AWS App for Splunk (version 5.1.0 or later) and Splunk Add-on for AWS (version 4.4.0 or later), then configure your CloudTrail inputs. Please validate the user name entries in `previously_seen_users_console_logins_cloudtrail`, which is a lookup file created as a result of running this support search. -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - W3WP Spawning Shell - Rule] type = detection asset_type = @@ -7003,26 +6397,6 @@ annotations = {"cis20": ["CIS 8"], "kill_chain_phases": ["Delivery"], "mitre_att known_false_positives = SAM is a critical windows service, stopping it would cause major issues on an endpoint this makes false positive rare. AlthoughNo false positives have been identified. providing_technologies = [] -[savedsearch://ESCU - Windows Updates Install Failures - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is intended to give you a feel for how often Windows updates fail to install in your environment. Fluctuations in these numbers will allow you to determine when you should be concerned. -how_to_implement = You must be ingesting your Windows Update Logs -annotations = {} -known_false_positives = none -providing_technologies = [] - -[savedsearch://ESCU - Windows Updates Install Successes - Rule] -type = detection -asset_type = -confidence = medium -explanation = This search is intended to give you a feel for how often successful Windows updates are applied in your environments. Fluctuations in these numbers will allow you to determine when you should be concerned. -how_to_implement = You must be ingesting your Windows Update Logs -annotations = {} -known_false_positives = none -providing_technologies = [] - [savedsearch://ESCU - Windows connhost exe started forcefully - Rule] type = detection asset_type = Endpoint @@ -7221,32 +6595,6 @@ known_false_positives = not defined earliest_time_offset = 14400 latest_time_offset = 0 -[savedsearch://ESCU - DNS Hijack Enrichment - Response Task] -type = investigation -explanation = none -how_to_implement = If Splunk>Phantom is also configured in your environment, a Playbook called "DNS Hijack Enrichment" can be configured to run when any results are found by this detection search. The playbook takes in the DNS record changed and uses Geoip, whois, Censys and PassiveTotal to detect if DNS issuers changed. To use this integration, install the Phantom App for Splunk `https://splunkbase.splunk.com/app/3411/`, add the correct hostname to the "Phantom Instance" field in the Adaptive Response Actions when configuring this detection search, and set the corresponding Playbook to active. \ -(Playbook Link:`https://my.phantom.us/4.2/playbook/dns-hijack-enrichment/`).\ - -known_false_positives = not defined -earliest_time_offset = 14400 -latest_time_offset = 0 - -[savedsearch://ESCU - Domain Certificate Investigation - Response Task] -type = investigation -explanation = none -how_to_implement = To successfully implement this phantom playbook, you must integrate Enterprise Security with Phantom. Configure this playbook in the correlation search `Detect DNS requests to Phishing Sites leveraging EvilGinx2` ,as an adaptive response action. -known_false_positives = not defined -earliest_time_offset = 14400 -latest_time_offset = 0 - -[savedsearch://ESCU - Excessive Account Lockouts Enrichment And Response - Response Task] -type = investigation -explanation = none -how_to_implement = Import playbook into phantom -known_false_positives = not defined -earliest_time_offset = 14400 -latest_time_offset = 0 - [savedsearch://ESCU - GCP Kubernetes activity by src ip - Response Task] type = investigation explanation = none diff --git a/macros/aws_config.yml b/macros/aws_config.yml new file mode 100644 index 0000000000..c709c1e0a5 --- /dev/null +++ b/macros/aws_config.yml @@ -0,0 +1,4 @@ +definition: sourcetype=aws:config +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: aws_config diff --git a/macros/aws_description.yml b/macros/aws_description.yml new file mode 100644 index 0000000000..223e3effaa --- /dev/null +++ b/macros/aws_description.yml @@ -0,0 +1,4 @@ +definition: sourcetype="aws:description" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: aws_description diff --git a/macros/aws_securityhub_firehose.yml b/macros/aws_securityhub_firehose.yml new file mode 100644 index 0000000000..b362424495 --- /dev/null +++ b/macros/aws_securityhub_firehose.yml @@ -0,0 +1,4 @@ +definition: sourcetype="aws:securityhub:firehose" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: aws_securityhub_firehose diff --git a/macros/notable.yml b/macros/notable.yml new file mode 100644 index 0000000000..96322dc8a5 --- /dev/null +++ b/macros/notable.yml @@ -0,0 +1,4 @@ +definition: index=notable +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: notable From c4ce0e8590171dc3417a32296279dddc646cc79d Mon Sep 17 00:00:00 2001 From: P4T12ICK Date: Mon, 26 Jul 2021 13:49:50 +0200 Subject: [PATCH 19/21] converted response_task to investigations --- bin/generate.py | 1 - 1 file changed, 1 deletion(-) diff --git a/bin/generate.py b/bin/generate.py index e68e58758f..e9bc076ae4 100644 --- a/bin/generate.py +++ b/bin/generate.py @@ -570,7 +570,6 @@ def compute_objects(objects, PRODUCT, OUTPUT_PATH): if PRODUCT == "SAAWS": objects["detections"] = [object for object in objects["detections"] if 'Splunk Security Analytics for AWS' in object['tags']['product']] objects["stories"] = [object for object in objects["stories"] if 'Splunk Security Analytics for AWS' in object['tags']['product']] - objects["response_tasks"] = [object for object in objects["response_tasks"] if 'Splunk Security Analytics for AWS' in object['tags']['product']] # only use ESCU detections to the configurations objects["detections"] = sorted(filter(lambda d: not 'Splunk Behavioral Analytics' in d['tags']['product'], objects["detections"]), key=lambda d: d['name']) From df4b2903408273dfbad18e2cfc0317219adeec0b Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 26 Jul 2021 18:40:35 -0700 Subject: [PATCH 20/21] minor --- detections/endpoint/sam_database_file_access_attempt.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/detections/endpoint/sam_database_file_access_attempt.yml b/detections/endpoint/sam_database_file_access_attempt.yml index 124ab397da..ef1b49aa43 100644 --- a/detections/endpoint/sam_database_file_access_attempt.yml +++ b/detections/endpoint/sam_database_file_access_attempt.yml @@ -3,7 +3,7 @@ id: 57551656-ebdb-11eb-afdf-acde48001122 version: 1 date: '2021-07-23' author: Michael Haag, Mauricio Velazco, Splunk -type: batch +type: Hunting datamodel: - Endpoint description: The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either use a Shadow Copy or recent CVE-2021-36934 to access the SAM database. From 8ae3aa8ba9cbbb4bb136c707896b8ed3f77e53b0 Mon Sep 17 00:00:00 2001 From: patel-bhavin Date: Mon, 16 Aug 2021 15:34:57 -0700 Subject: [PATCH 21/21] conflicts and tests --- ...previously_seen_command_line_arguments.yml | 2 - dist/escu/default/analytic_stories.conf | 10 ++-- dist/escu/default/collections.conf | 2 +- .../data/ui/views/analytic_story_details.xml | 2 +- .../default/data/ui/views/escu_summary.xml | 2 +- .../escu/default/data/ui/views/escu_usage.xml | 2 +- dist/escu/default/data/ui/views/feedback.xml | 2 +- dist/escu/default/macros.conf | 2 +- dist/escu/default/savedsearches.conf | 46 +------------------ dist/escu/default/transforms.conf | 2 +- dist/escu/default/use_case_library.conf | 10 ++-- 11 files changed, 19 insertions(+), 63 deletions(-) diff --git a/detections/endpoint/previously_seen_command_line_arguments.yml b/detections/endpoint/previously_seen_command_line_arguments.yml index 1ae345f1e9..015dc971bb 100644 --- a/detections/endpoint/previously_seen_command_line_arguments.yml +++ b/detections/endpoint/previously_seen_command_line_arguments.yml @@ -30,8 +30,6 @@ tags: - Suspicious Command-Line Executions - Suspicious MSHTA Activity detections: - - Detect Prohibited Applications Spawning cmd.exe - - Processes launching netsh - First time seen command line argument deployments: - Daily Cache Updates diff --git a/dist/escu/default/analytic_stories.conf b/dist/escu/default/analytic_stories.conf index ff70301e35..96ec1fe027 100644 --- a/dist/escu/default/analytic_stories.conf +++ b/dist/escu/default/analytic_stories.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-29T20:53:17 UTC +# On Date: 2021-08-16T22:33:36 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -377,7 +377,7 @@ modification_date = 2020-02-04 id = 854d78bf-d0e2-4f4e-b05c-640905f86d7a version = 3 reference = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] -detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] +detection_searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule"] mappings = {"cis20": ["CIS 16", "CIS 3", "CIS 5", "CIS 6", "CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Exploitation", "Installation"], "mitre_attack": ["T1003.001", "T1003.002", "T1003.003", "T1059.001"], "nist": ["DE.AE", "DE.CM", "PR.AC", "PR.IP"]} investigative_searches = ["ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] support_searches = [] @@ -476,7 +476,7 @@ modification_date = 2020-10-21 id = 66b0fe0c-1351-11eb-adc1-0242ac120002 version = 1 reference = ["https://attack.mitre.org/tactics/TA0010/"] -detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"] +detection_searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule"] mappings = {"cis20": ["CIS 13", "CIS 16"], "kill_chain_phases": ["Actions on Objective", "Actions on Objectives", "Exfiltration", "Exploitation"], "mitre_attack": ["T1041", "T1048", "T1048.003", "T1114", "T1114.001", "T1114.003", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - Get Notable History - Response Task"] support_searches = [] @@ -1273,7 +1273,7 @@ modification_date = 2020-08-25 id = 8168ca88-392e-42f4-85a2-767579c660ce version = 1 reference = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] -detection_searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule"] +detection_searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule"] mappings = {"cis20": ["CIS 1", "CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1078.004", "T1537"], "nist": ["DE.AE", "DE.CM", "DE.DP", "ID.AM", "PR.AC", "PR.DS"]} investigative_searches = ["ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] support_searches = ["ESCU - Baseline Of Cloud Instances Destroyed", "ESCU - Baseline Of Cloud Instances Launched", "ESCU - Previously Seen Cloud Instance Modifications By User - Initial", "ESCU - Previously Seen Cloud Instance Modifications By User - Update"] @@ -1689,7 +1689,7 @@ modification_date = 2018-05-31 id = 56e24a28-5003-4047-b2db-e8f3c4618064 version = 1 reference = ["https://attack.mitre.org/wiki/Defense_Evasion"] -detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] +detection_searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule"] mappings = {"cis20": ["CIS 8"], "kill_chain_phases": ["Actions on Objectives", "Delivery", "Exploitation", "Privilege Escalation"], "mitre_attack": ["T1112", "T1222.001", "T1548.002", "T1562.001", "T1564.001"], "nist": ["DE.CM", "PR.PT"]} investigative_searches = ["ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] support_searches = [] diff --git a/dist/escu/default/collections.conf b/dist/escu/default/collections.conf index 2d8a2f162a..364863c0e0 100644 --- a/dist/escu/default/collections.conf +++ b/dist/escu/default/collections.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-29T20:53:17 UTC +# On Date: 2021-08-16T22:33:36 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/data/ui/views/analytic_story_details.xml b/dist/escu/default/data/ui/views/analytic_story_details.xml index 3f80cafa90..4d6d8ceab6 100644 --- a/dist/escu/default/data/ui/views/analytic_story_details.xml +++ b/dist/escu/default/data/ui/views/analytic_story_details.xml @@ -1,4 +1,4 @@ -
+
diff --git a/dist/escu/default/data/ui/views/escu_summary.xml b/dist/escu/default/data/ui/views/escu_summary.xml index bd5f75dca5..93ca23d043 100644 --- a/dist/escu/default/data/ui/views/escu_summary.xml +++ b/dist/escu/default/data/ui/views/escu_summary.xml @@ -1,4 +1,4 @@ - + diff --git a/dist/escu/default/data/ui/views/escu_usage.xml b/dist/escu/default/data/ui/views/escu_usage.xml index fb9f5c3f6e..bfe5d7a189 100644 --- a/dist/escu/default/data/ui/views/escu_usage.xml +++ b/dist/escu/default/data/ui/views/escu_usage.xml @@ -1,4 +1,4 @@ - + $field1.earliest$ diff --git a/dist/escu/default/data/ui/views/feedback.xml b/dist/escu/default/data/ui/views/feedback.xml index cd49ebc7cc..3ec519bfd2 100644 --- a/dist/escu/default/data/ui/views/feedback.xml +++ b/dist/escu/default/data/ui/views/feedback.xml @@ -1,4 +1,4 @@ - + Welcome to Splunk Enterprise Security Content Updates Feedback Center. diff --git a/dist/escu/default/macros.conf b/dist/escu/default/macros.conf index 1a2ffd00c4..d75b8166a4 100644 --- a/dist/escu/default/macros.conf +++ b/dist/escu/default/macros.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-29T20:53:17 UTC +# On Date: 2021-08-16T22:33:36 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/savedsearches.conf b/dist/escu/default/savedsearches.conf index 74aee828c5..17f023c829 100644 --- a/dist/escu/default/savedsearches.conf +++ b/dist/escu/default/savedsearches.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-29T20:53:17 UTC +# On Date: 2021-08-16T22:33:36 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -8165,48 +8165,6 @@ realtime_schedule = 0 is_visible = false search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` -[ESCU - Detect shared ec2 snapshot - Rule] -action.escu = 0 -action.escu.enabled = 1 -description = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. -action.escu.mappings = {"cis20": ["CIS 13"], "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"]} -action.escu.data_models = [] -action.escu.eli5 = The following analytic utilizes AWS CloudTrail events to identify when an EC2 snapshot permissions are modified to be shared with a different AWS account. This method is used by adversaries to exfiltrate the EC2 snapshot. -action.escu.how_to_implement = You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. -action.escu.known_false_positives = It is possible that an AWS admin has legitimately shared a snapshot with others for a specific purpose. -action.escu.creation_date = 2021-07-20 -action.escu.modification_date = 2021-07-20 -action.escu.confidence = high -action.escu.full_search_name = ESCU - Detect shared ec2 snapshot - Rule -action.escu.search_type = detection -action.escu.product = ["Splunk Security Analytics for AWS", "Splunk Enterprise", "Splunk Enterprise Security", "Splunk Cloud"] -action.escu.providing_technologies = [] -action.escu.analytic_story = ["Suspicious Cloud Instance Activities", "Data Exfiltration"] -action.risk = 1 -action.risk.param._risk_object = src_ip -action.risk.param._risk_object_type = system -action.risk.param._risk_score = 48 -action.risk.param._risk_message = AWS EC2 snapshot from account $aws_account_id$ is shared with $requested_account_id$ by user $user_arn$ from $src_ip$ -action.risk.param._risk = [{"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "user_arn", "risk_object_type": "user", "risk_score": 48, "threat_object_field": "user_arn", "threat_object_type": "user"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src_ip", "threat_object_type": "ip address"}, {"risk_object_field": "src_ip", "risk_object_type": "system", "risk_score": 48, "threat_object_field": "src_ip", "threat_object_type": "ip address"}] -action.risk.param.verbose = 0 -cron_schedule = 0 * * * * -dispatch.earliest_time = -70m@m -dispatch.latest_time = -10m@m -action.correlationsearch.enabled = 1 -action.correlationsearch.label = ESCU - Detect shared ec2 snapshot - Rule -action.correlationsearch.annotations = {"analytic_story": ["Suspicious Cloud Instance Activities", "Data Exfiltration"], "cis20": ["CIS 13"], "confidence": 80, "context": ["Source:Cloud Data", "Scope:External", "Outcome:Allowed", "Stage:Execution", "Stage:Exfiltration"], "impact": 60, "kill_chain_phases": ["Actions on Objectives"], "mitre_attack": ["T1537"], "nist": ["PR.DS", "PR.AC", "DE.CM"], "observable": [{"name": "user_arn", "role": ["Attacker"], "type": "User"}, {"name": "src_ip", "role": ["Attacker"], "type": "IP Address"}]} -schedule_window = auto -alert.digest_mode = 1 -disabled = true -enableSched = 1 -allow_skew = 100% -counttype = number of events -relation = greater than -quantity = 0 -realtime_schedule = 0 -is_visible = false -search = `cloudtrail` eventName=ModifySnapshotAttribute | rename requestParameters.createVolumePermission.add.items{}.userId as requested_account_id | search requested_account_id != NULL | eval match=if(requested_account_id==aws_account_id,"Match","No Match") | table _time user_arn src_ip requestParameters.attributeType requested_account_id aws_account_id match vendor_region user_agent | where match = "No Match" | `detect_shared_ec2_snapshot_filter` - [ESCU - Detect web traffic to dynamic domain providers - Rule] action.escu = 0 action.escu.enabled = 1 @@ -16918,7 +16876,7 @@ relation = greater than quantity = 0 realtime_schedule = 0 is_visible = false -search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "*-nolan*" OR Processes.process = "*-nolocal*" OR Processes.process = "*-fast*" OR Processes.process = "*-full*" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_common_exec_parameter_filter` +search = | tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process = "* -nolan *" OR Processes.process = "* -nolocal *" OR Processes.process = "* -fast *" OR Processes.process = "* -full *" by Processes.process_name Processes.process Processes.parent_process_name Processes.parent_process Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `revil_common_exec_parameter_filter` [ESCU - Revil Registry Entry - Rule] action.escu = 0 diff --git a/dist/escu/default/transforms.conf b/dist/escu/default/transforms.conf index d86c626720..7b20903912 100644 --- a/dist/escu/default/transforms.conf +++ b/dist/escu/default/transforms.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-29T20:53:17 UTC +# On Date: 2021-08-16T22:33:36 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# diff --git a/dist/escu/default/use_case_library.conf b/dist/escu/default/use_case_library.conf index 345dbf5ea4..f4c2cf81a8 100644 --- a/dist/escu/default/use_case_library.conf +++ b/dist/escu/default/use_case_library.conf @@ -1,6 +1,6 @@ ############# # Automatically generated by generator.py in splunk/security_content -# On Date: 2021-07-29T20:53:17 UTC +# On Date: 2021-08-16T22:33:36 UTC # Author: Splunk Security Research # Contact: research@splunk.com ############# @@ -263,7 +263,7 @@ version = 3 references = ["https://attack.mitre.org/wiki/Technique/T1003", "https://cyberwardog.blogspot.com/2017/03/chronicles-of-threat-hunter-hunting-for.html"] maintainers = [{"company": "Splunk", "email": "-", "name": "Rico Valdez"}] spec_version = 3 -searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] +searches = ["ESCU - Access LSASS Memory for Dump Creation - Rule", "ESCU - Attempted Credential Dump From Registry via Reg exe - Rule", "ESCU - Create Remote Thread into LSASS - Rule", "ESCU - Creation of Shadow Copy - Rule", "ESCU - Creation of Shadow Copy with wmic and powershell - Rule", "ESCU - Creation of lsass Dump with Taskmgr - Rule", "ESCU - Credential Dumping via Copy Command from Shadow Copy - Rule", "ESCU - Credential Dumping via Symlink to Shadow Copy - Rule", "ESCU - Detect Copy of ShadowCopy with Script Block Logging - Rule", "ESCU - Detect Credential Dumping through LSASS access - Rule", "ESCU - Detect Mimikatz Using Loaded Images - Rule", "ESCU - Dump LSASS via comsvcs DLL - Rule", "ESCU - Dump LSASS via procdump - Rule", "ESCU - Dump LSASS via procdump Rename - Rule", "ESCU - Extract SAM from Registry - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Rule", "ESCU - Investigate Pass the Hash Attempts - Rule", "ESCU - Investigate Pass the Ticket Attempts - Rule", "ESCU - Investigate Previous Unseen User - Rule", "ESCU - Ntdsutil Export NTDS - Rule", "ESCU - SAM Database File Access Attempt - Rule", "ESCU - SecretDumps Offline NTDS Dumping Tool - Rule", "ESCU - Set Default PowerShell Execution Policy To Unrestricted or Bypass - Rule", "ESCU - Unsigned Image Loaded by LSASS - Rule", "ESCU - Investigate Failed Logins for Multiple Destinations - Response Task", "ESCU - Investigate Pass the Hash Attempts - Response Task", "ESCU - Investigate Pass the Ticket Attempts - Response Task", "ESCU - Investigate Previous Unseen User - Response Task"] description = Uncover activity consistent with credential dumping, a technique wherein attackers compromise systems and attempt to obtain and exfiltrate passwords. The threat actors use these pilfered credentials to further escalate privileges and spread throughout a target environment. The included searches in this Analytic Story are designed to identify attempts to credential dumping. narrative = Credential dumping—gathering credentials from a target system, often hashed or encrypted—is a common attack technique. Even though the credentials may not be in plain text, an attacker can still exfiltrate the data and set to cracking it offline, on their own systems. The threat actors target a variety of sources to extract them, including the Security Accounts Manager (SAM), Local Security Authority (LSA), NTDS from Domain Controllers, or the Group Policy Preference (GPP) files.\ Once attackers obtain valid credentials, they use them to move throughout a target network with ease, discovering new systems and identifying assets of interest. Credentials obtained in this manner typically include those of privileged users, which may provide access to more sensitive information and system operations.\ @@ -332,7 +332,7 @@ version = 1 references = ["https://attack.mitre.org/tactics/TA0010/"] maintainers = [{"company": "Splunk", "email": "-", "name": "Shannon Davis"}] spec_version = 3 -searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] +searches = ["ESCU - DNS Exfiltration Using Nslookup App - Rule", "ESCU - Detect SNICat SNI Exfiltration - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Excessive Usage of NSLOOKUP App - Rule", "ESCU - Get Notable History - Rule", "ESCU - Mailsniper Invoke functions - Rule", "ESCU - Multiple Archive Files Http Post Traffic - Rule", "ESCU - O365 PST export alert - Rule", "ESCU - O365 Suspicious Admin Email Forwarding - Rule", "ESCU - O365 Suspicious User Email Forwarding - Rule", "ESCU - Plain HTTP POST Exfiltrated Data - Rule", "ESCU - Get Notable History - Response Task"] description = The stealing of data by an adversary. narrative = Exfiltration comes in many flavors. Adversaries can collect data over encrypted or non-encrypted channels. They can utilise Command and Control channels that are already in place to exfiltrate data. They can use both standard data transfer protocols such as FTP, SCP, etc to exfiltrate data. Or they can use non-standard protocols such as DNS, ICMP, etc with specially crafted fields to try and circumvent security technologies in place. @@ -883,7 +883,7 @@ version = 1 references = ["https://d0.awsstatic.com/whitepapers/aws-security-best-practices.pdf"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] +searches = ["ESCU - AWS Investigate User Activities By ARN - Rule", "ESCU - Abnormally High Number Of Cloud Instances Destroyed - Rule", "ESCU - Abnormally High Number Of Cloud Instances Launched - Rule", "ESCU - Cloud Instance Modified By Previously Unseen User - Rule", "ESCU - Detect shared ec2 snapshot - Rule", "ESCU - Get All AWS Activity From IP Address - Rule", "ESCU - AWS Investigate User Activities By ARN - Response Task", "ESCU - Get All AWS Activity From IP Address - Response Task"] description = Monitor your cloud infrastructure provisioning activities for behaviors originating from unfamiliar or unusual locations. These behaviors may indicate that malicious activities are occurring somewhere within your cloud environment. narrative = Monitoring your cloud infrastructure logs allows you enable governance, compliance, and risk auditing. It is crucial for a company to monitor events and actions taken in the their cloud environments to ensure that your instances are not vulnerable to attacks. This Analytic Story identifies suspicious activities in your cloud compute instances and helps you respond and investigate those activities. @@ -1167,7 +1167,7 @@ version = 1 references = ["https://attack.mitre.org/wiki/Defense_Evasion"] maintainers = [{"company": "Splunk", "email": "-", "name": "David Dorsey"}] spec_version = 3 -searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] +searches = ["ESCU - Disable Registry Tool - Rule", "ESCU - Disable Show Hidden Files - Rule", "ESCU - Disable Windows Behavior Monitoring - Rule", "ESCU - Disable Windows SmartScreen Protection - Rule", "ESCU - Disabling CMD Application - Rule", "ESCU - Disabling ControlPanel - Rule", "ESCU - Disabling Firewall with Netsh - Rule", "ESCU - Disabling FolderOptions Windows Feature - Rule", "ESCU - Disabling NoRun Windows App - Rule", "ESCU - Disabling Remote User Account Control - Rule", "ESCU - Disabling SystemRestore In Registry - Rule", "ESCU - Disabling Task Manager - Rule", "ESCU - Eventvwr UAC Bypass - Rule", "ESCU - Excessive number of service control start as disabled - Rule", "ESCU - FodHelper UAC Bypass - Rule", "ESCU - Get Notable History - Rule", "ESCU - Get Parent Process Info - Rule", "ESCU - Get Process Info - Rule", "ESCU - Hiding Files And Directories With Attrib exe - Rule", "ESCU - NET Profiler UAC bypass - Rule", "ESCU - Reg exe used to hide files directories via registry keys - Rule", "ESCU - Remote Registry Key modifications - Rule", "ESCU - SLUI RunAs Elevated - Rule", "ESCU - SLUI Spawning a Process - Rule", "ESCU - Sdclt UAC Bypass - Rule", "ESCU - SilentCleanup UAC Bypass - Rule", "ESCU - Suspicious Reg exe Process - Rule", "ESCU - UAC Bypass MMC Load Unsigned Dll - Rule", "ESCU - WSReset UAC Bypass - Rule", "ESCU - Windows DisableAntiSpyware Registry - Rule", "ESCU - Get Notable History - Response Task", "ESCU - Get Parent Process Info - Response Task", "ESCU - Get Process Info - Response Task"] description = Detect tactics used by malware to evade defenses on Windows endpoints. A few of these include suspicious `reg.exe` processes, files hidden with `attrib.exe` and disabling user-account control, among many others narrative = Defense evasion is a tactic--identified in the MITRE ATT&CK framework--that adversaries employ in a variety of ways to bypass or defeat defensive security measures. There are many techniques enumerated by the MITRE ATT&CK framework that are applicable in this context. This Analytic Story includes searches designed to identify the use of such techniques on Windows platforms.