diff --git a/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe/ocsf_old/cred_dump.yml b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe/ocsf_old/cred_dump.yml new file mode 100644 index 0000000000..a5a4c19ba7 --- /dev/null +++ b/detections/endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe/ocsf_old/cred_dump.yml @@ -0,0 +1,134 @@ +name: Attempted Credential Dump From Registry via Reg exe +id: 14038953-e5f2-4daf-acff-5452062baf03 +version: 2 +description: The following analytic identifies the use of `reg.exe` attempting to + export Windows registry keys that contain hashed credentials. Adversaries will utilize + this technique to capture and perform offline password cracking. +search: ' | from read_ba_enriched_events() +| eval timestamp=ucast(map_get(input_event,"time"), "long", null) +| eval process_map=ucast(map_get(input_event, "process"), "map", null), + file_map=ucast(map_get(process_map, "file"), "map", null), + process_name=lower(ucast(map_get(file_map, "name"), "string", null)), + process_cmd=ucast(map_get(process_map, "cmd_line"), "string", null), + actor_process_map=ucast(map_get(input_event, "actor_process"), "map", null), + file_map=ucast(map_get(actor_process_map, "file"), "map", null), + parent_process_name=ucast(map_get(file_map, "name"), "string", null), + metadata_map=ucast(map_get(input_event, "metadata"), "map", null), + metadata_uid=ucast(map_get(metadata_map, "uid"), "string", null) +| where process_name="cmd.exe" + OR process_name="reg.exe" +| where process_cmd != null + AND match_regex(process_cmd, /(?i)save\s+/)=true + AND ( match_regex(process_cmd, /(?i)HKLM\\Security/)=true + OR match_regex(process_cmd, /(?i)HKLM\\SAM/)=true + OR match_regex(process_cmd, /(?i)HKLM\\System/)=true + OR match_regex(process_cmd, /(?i)HKEY_LOCAL_MACHINE\\Security/)=true + OR match_regex(process_cmd, /(?i)HKEY_LOCAL_MACHINE\\SAM/)=true + OR match_regex(process_cmd, /(?i)HKEY_LOCAL_MACHINE\\System/)=true ) +| eval origin_map=ucast(map_get(input_event, "origin"), "map", null), + dest_device=ucast(map_get(origin_map, "device"), "map", null), + dest_user=ucast(map_get(input_event, "user"), "map", null), + dest_device_name=ucast( map_get( dest_device , "name"), "string", null), + dest_user_name=ucast( map_get( dest_user , "name"), "string", null), + message=concat("An attempt to save registry keys storing credentials has been performed on ", dest_device_name, " by ", dest_user_name, " via process ", process_name, ".") +| eval body=create_map( + "category_uid", 101, + "class_uid", 101000, + "detection_start_time", timestamp, + "detection_end_time", timestamp, + "device_entities",[create_map("uid", ucast( map_get( dest_device , "ref_uid"), "string", null), "type_id", 0)], + "disposition_id", 1, + "end_time", timestamp, + "event_uid", 10100001, + "event_time", strftime(timestamp, "%Y-%m-%dT%H:%M:%S.%6QZ", "%Z"), + "finding", create_map( + "confidence", 90, + "confidence_id", 3, + "context_ids", [10, 46], + "impact", 70, "impact_id", 4, + "kill_chain_phase", "Actions on Objectives", + "kill_chain_phase_id", 7, + "risk_level", "High", + "risk_level_id", 3, + "risk_score", 63, + "type_id", 1, + "ref_event_uid", metadata_uid + ), + "message", message, + "metadata", create_map( + "log_name", "Endpoint_Processes", + "version", "1.0.0" + ), + "observables", [ + create_map( + "name", "parent_process_name", + "role_ids", [5], + "type_id", 15, + "value", parent_process_name + ) + , create_map( + "name", "process_name", + "role_ids", [6], + "type_id", 15, + "value", process_name + ) + , create_map( + "name", "process", + "role_ids", [6], + "type_id", 15, + "value", process_cmd + ) + ], + "origin", create_map( + "product", create_map("name", "Splunk Behavioral Analytics") + ), + "rule", create_map("name", "Attempted Credential Dump From Registry via Reg exe"), + "start_time", timestamp, + "time", timestamp, + "user_entities", [create_map("uid", ucast(map_get(dest_user, "ref_uid"),"string", null))] + ) +| into write_ssa_finding_events();' +how_to_implement: To successfully implement this search, you need to be ingesting + logs with the process name, parent process, and command-line executions from your + endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the + Sysmon TA. +known_false_positives: None identified. +references: +- https://github.com/splunk/security_content/blob/55a17c65f9f56c2220000b62701765422b46125d/detections/attempted_credential_dump_from_registry_via_reg_exe.yml +- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.002/T1003.002.md#atomic-test-1---registry-dump-of-sam-creds-and-secrets +tags: + analytic_story: + - Credential Dumping + cis20: + - CIS 3 + - CIS 5 + - CIS 16 + kill_chain_phases: + - Actions on Objectives + mitre_attack_id: + - T1003 + - T1003.002 + nist: + - DE.CM + required_fields: + - process_name + - _time + - dest_device_id + - dest_user_id + - process + - cmd_line + risk_score: 63 + security_domain: endpoint + risk_severity: medium + research_site_url: https://research.splunk.com/endpoint/14038953-e5f2-4daf-acff-5452062baf03/ + event_schema: ocsf +test: + name: Attempted Credential Dump From Registry via Reg exe Unit Test + tests: + - name: Attempted Credential Dump From Registry via Reg exe + file: endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml + pass_condition: '@count_gt(0)' + attack_data: + - file_name: windows-security.log + data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log + source: WinEventLog:Security