Merge branch 'develop' into nterl0k-T1110.003-NTLM-bruteforce

contentctl.yml

@@ -182,4 +182,11 @@ apps:
   version: 1.9.2
   description: description of app
   hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz
+- uid: 5082
+  title: CrowdStrike Falcon Event Streams Technical Add-On
+  appid: TA-crowdstrike-falcon-event-streams
+  version: 3.2.1
+  description: description of app
+  hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/crowdstrike-falcon-event-streams-technical-add-on_321.tgz
+
 githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd

detections/endpoint/crowdstrike_admin_weak_password_policy.yml

@@ -0,0 +1,59 @@
+name: Crowdstrike Admin Weak Password Policy
+id: bb1481fd-23c0-4195-b6a0-94d746c9637c
+version: 1
+date: '2024-07-15'
+author: Teoderick Contreras, Splunk
+data_source: []
+type: TTP
+status: production
+description: The following analytic detects CrowdStrike alerts for admin weak password policy violations, 
+  identifying instances where administrative passwords do not meet security standards. 
+  These alerts highlight significant vulnerabilities that could be exploited by attackers to gain unauthorized access. 
+  Promptly addressing these alerts is crucial for maintaining robust security and protecting critical systems and data from potential threats.
+search: '`crowdstrike_identities` primaryDisplayName = "*admin*"
+  | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
+  | stats count min(_time) as firstTime max(_time) as lastTime by  domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type
+  | where risk_type = "WEAK_PASSWORD_POLICY" 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `crowdstrike_admin_weak_password_policy_filter`'
+how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, 
+  authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. 
+  Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
+known_false_positives: unknown
+references:
+- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
+tags:
+  analytic_story:
+  - Compromised Windows Host
+  asset_type: Endpoint
+  confidence: 80
+  impact: 100
+  message: Weak Password for Admin User found on $domain$
+  mitre_attack_id:
+  - T1110
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - riskFactors{}.severity
+  - riskFactors{}.type
+  - roles{}.type
+  - accounts{}.domain
+  - accounts{}.dn
+  - accounts{}.samAccountName
+  risk_score: 80
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_weak_password_admin_cleaned.log
+    sourcetype: crowdstrike:identities
+    source: crowdstrike:identities

detections/endpoint/crowdstrike_admin_with_duplicate_password.yml

@@ -0,0 +1,58 @@
+name: Crowdstrike Admin With Duplicate Password
+id: b8bccfbf-6ac2-40f2-83b6-e72b7efaa7d4
+version: 1
+date: '2024-07-15'
+author: Teoderick Contreras, Splunk
+data_source: []
+type: TTP
+status: production
+description: The following analytic detects CrowdStrike alerts for admin accounts with duplicate password risk, 
+  identifying instances where administrative users share the same password. This practice significantly increases 
+  the risk of unauthorized access and potential breaches. Addressing these alerts promptly is crucial for maintaining 
+  strong security protocols, ensuring each admin account uses a unique, secure password to protect critical systems and data.
+search: '`crowdstrike_identities` primaryDisplayName = "*admin*"
+  | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
+  | stats count min(_time) as firstTime max(_time) as lastTime by  domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type
+  | where risk_type = "DUPLICATE_PASSWORD" 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` | `crowdstrike_admin_with_duplicate_password_filter`'
+how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, 
+  authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. 
+  Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
+known_false_positives: unknown
+references:
+- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
+tags:
+  analytic_story:
+  - Compromised Windows Host
+  asset_type: Endpoint
+  confidence: 80
+  impact: 100
+  message: Duplicate Password for Admin User found on $domain$
+  mitre_attack_id:
+  - T1110
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - riskFactors{}.severity
+  - riskFactors{}.type
+  - roles{}.type
+  - accounts{}.domain
+  - accounts{}.dn
+  - accounts{}.samAccountName
+  risk_score: 80
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/admin_duplicate_password/crowdstrike_admin_dup_pwd_cleaned.log
+    sourcetype: crowdstrike:identities
+    source: crowdstrike:identities

detections/endpoint/crowdstrike_high_identity_risk_severity.yml

@@ -0,0 +1,58 @@
+name: Crowdstrike High Identity Risk Severity
+id: 0df524ad-6d78-4883-9987-d29418928103
+version: 1
+date: '2024-07-17'
+author: Teoderick Contreras, Splunk
+data_source: []
+type: TTP
+status: production
+description: The following analytic detects CrowdStrike alerts for High Identity Risk Severity with a risk score of 70 or higher. 
+  These alerts indicate significant vulnerabilities in user identities, such as suspicious behavior or compromised credentials. 
+  Promptly investigating and addressing these alerts is crucial to prevent potential security breaches and ensure the integrity 
+  and protection of sensitive information and systems.
+search: '`crowdstrike_identities` riskScoreSeverity="HIGH" OR riskScore >= 0.70
+  | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
+  | stats count min(_time) as firstTime max(_time) as lastTime by  domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `crowdstrike_high_identity_risk_severity_filter`'
+how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, 
+  authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. 
+  Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
+known_false_positives: unknown
+references:
+- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
+tags:
+  analytic_story:
+  - Compromised Windows Host
+  asset_type: Endpoint
+  confidence: 90
+  impact: 100
+  message: High Identity Risk Score Severity found on $domain$
+  mitre_attack_id:
+  - T1110
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - riskFactors{}.severity
+  - riskFactors{}.type
+  - roles{}.type
+  - accounts{}.domain
+  - accounts{}.dn
+  - accounts{}.samAccountName
+  risk_score: 90
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/high_risk_score/crowdstrike_high_riskscore_cleaned.log
+    sourcetype: crowdstrike:identities
+    source: crowdstrike:identities

detections/endpoint/crowdstrike_medium_identity_risk_severity.yml

@@ -0,0 +1,58 @@
+name: Crowdstrike Medium Identity Risk Severity
+id: c23b425c-9024-4bd7-b526-c18a4a51d93e
+version: 1
+date: '2024-07-15'
+author: Teoderick Contreras, Splunk
+data_source: []
+type: TTP
+status: production
+description: The following analytic detects CrowdStrike alerts for Medium Identity Risk Severity with a risk score of 55 or higher. 
+  These alerts indicate significant vulnerabilities in user identities, such as suspicious behavior or compromised credentials. 
+  Promptly investigating and addressing these alerts is crucial to prevent potential security breaches and ensure the integrity 
+  and protection of sensitive information and systems.
+search: '`crowdstrike_identities` riskScoreSeverity = "MEDIUM" OR riskScore >= 0.55 AND riskScore < 0.70
+  | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
+  | stats count min(_time) as firstTime max(_time) as lastTime by  domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `crowdstrike_medium_identity_risk_severity_filter`'
+how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, 
+  authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. 
+  Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
+known_false_positives: unknown
+references:
+- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
+tags:
+  analytic_story:
+  - Compromised Windows Host
+  asset_type: Endpoint
+  confidence: 70
+  impact: 100
+  message: Medium Identity Risk Score Severity found on $domain$
+  mitre_attack_id:
+  - T1110
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - riskFactors{}.severity
+  - riskFactors{}.type
+  - roles{}.type
+  - accounts{}.domain
+  - accounts{}.dn
+  - accounts{}.samAccountName
+  risk_score: 70
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/riskscore/crowdstrike_riskscore_cleaned.log
+    sourcetype: crowdstrike:identities
+    source: crowdstrike:identities

detections/endpoint/crowdstrike_medium_severity_alert.yml

@@ -0,0 +1,60 @@
+name: Crowdstrike Medium Severity Alert
+id: 7e80d92a-6ec3-4eb1-a444-1480acfe2d14
+version: 1
+date: '2024-07-15'
+author: Teoderick Contreras, Splunk
+data_source: []
+type: Anomaly
+status: production
+description: The following analytic detects a CrowdStrike alert with MEDIUM severity indicates a potential threat that requires prompt attention. 
+  This alert level suggests suspicious activity that may compromise security but is not immediately critical. 
+  It typically involves detectable but non-imminent risks, such as unusual behavior or attempted policy violations, 
+  which should be investigated further and mitigated quickly to prevent escalation of attacks.
+search: '`crowdstrike_stream` 
+  | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity
+  | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, src_host, user, description, type, count_alerts, severity
+  | where LIKE (severity, "%MEDIUM%")
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `crowdstrike_medium_severity_alert_filter`'
+how_to_implement: To implement CrowdStrike stream JSON logs, use the Falcon Streaming API. Set up an API client, 
+  authenticate with your CrowdStrike credentials, and subscribe to the "CrowdStrike:Event:Streams:JSON" event stream. 
+  Process and store the JSON logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
+known_false_positives: unknown
+references:
+- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
+tags:
+  analytic_story:
+  - Compromised Windows Host
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: A MEDIUM Severity Crowdstrike Alert found in $src_host$
+  mitre_attack_id:
+  - T1110
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - event.EndpointIp
+  - event.EndpointName
+  - event.UserName
+  - event.IncidentDescription
+  - event.IncidentType
+  - event.NumbersOfAlerts
+  - event.SeverityName
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/medium_alert/crowdstrike_medium_clean.log
+    sourcetype: CrowdStrike:Event:Streams:JSON
+    source: CrowdStrike:Event:Streams

detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml

@@ -0,0 +1,62 @@
+name: Crowdstrike Multiple LOW Severity Alerts
+id: 5c2c02d8-bee7-4f5c-9dea-e3e1012daddb
+version: 1
+date: '2024-07-17'
+author: Teoderick Contreras, Splunk
+data_source: []
+type: Anomaly
+status: production
+description: The following analytic detects multiple CrowdStrike LOW severity alerts, 
+  indicating a series of minor suspicious activities or policy violations. 
+  These alerts are not immediately critical but should be reviewed to prevent potential threats. 
+  They often highlight unusual behavior or low-level risks that, if left unchecked, could escalate 
+  into more significant security issues. Regular monitoring and analysis of these alerts are essential 
+  for maintaining robust security.
+search: '`crowdstrike_stream` tag=alert event.SeverityName= LOW
+  | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity
+  | stats dc(type) as type_count, values(user) as users, values(description) as descriptions, values(type) as types, values(severity) count min(_time) as firstTime max(_time) as lastTime by src_ip src_host
+  | where type_count >= 3
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `crowdstrike_multiple_low_severity_alerts_filter`'
+how_to_implement: To implement CrowdStrike stream JSON logs, use the Falcon Streaming API. Set up an API client, 
+  authenticate with your CrowdStrike credentials, and subscribe to the "CrowdStrike:Event:Streams:JSON" event stream. 
+  Process and store the JSON logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
+known_false_positives: unknown
+references:
+- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
+tags:
+  analytic_story:
+  - Compromised Windows Host
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: Several LOW severity alerts found in $src_host$
+  mitre_attack_id:
+  - T1110
+  observable:
+  - name: src_host
+    type: Hostname
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - event.EndpointIp
+  - event.EndpointName
+  - event.UserName
+  - event.IncidentDescription
+  - event.IncidentType
+  - event.NumbersOfAlerts
+  - event.SeverityName
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/multiple_low_alert/crowdstrike_multiple_low_cleaned.log
+    sourcetype: CrowdStrike:Event:Streams:JSON
+    source: CrowdStrike:Event:Streams

detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml

@@ -0,0 +1,60 @@
+name: Crowdstrike Privilege Escalation For Non-Admin User
+id: 69e2860c-0e4b-40ae-9dc4-bf9e3bf2a548
+version: 1
+date: '2024-07-15'
+author: Teoderick Contreras, Splunk
+data_source: []
+type: Anomaly
+status: production
+description: The following analytic detects CrowdStrike alerts for privilege escalation attempts by non-admin users. 
+  These alerts indicate unauthorized efforts by regular users to gain elevated permissions, posing a significant security risk. 
+  Detecting and addressing these attempts promptly helps prevent potential breaches and ensures that user privileges remain properly managed, 
+  maintaining the integrity of the organization's security protocols.
+search: '`crowdstrike_stream` tag=alert 
+  | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity
+  | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, src_host, user, description, type, count_alerts, severity
+  | where LIKE(type,"%Privilege escalation%") AND NOT LIKE(user, "%adm%") AND NOT LIKE(user, "%svc%") AND NOT LIKE(user, "%admin%") 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `crowdstrike_privilege_escalation_for_non_admin_user_filter`'
+how_to_implement: To implement CrowdStrike stream JSON logs, use the Falcon Streaming API. Set up an API client, 
+  authenticate with your CrowdStrike credentials, and subscribe to the "CrowdStrike:Event:Streams:JSON" event stream. 
+  Process and store the JSON logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
+known_false_positives: unknown
+references:
+- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
+tags:
+  analytic_story:
+  - Compromised Windows Host
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: A Privilege escalation happened in Non-Admin Account in $src_host$
+  mitre_attack_id:
+  - T1110
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - event.EndpointIp
+  - event.EndpointName
+  - event.UserName
+  - event.IncidentDescription
+  - event.IncidentType
+  - event.NumbersOfAlerts
+  - event.SeverityName
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/privilege_escalation/crowdstrike_priv_esc_cleaned.log
+    sourcetype: CrowdStrike:Event:Streams:JSON
+    source: CrowdStrike:Event:Streams

detections/endpoint/crowdstrike_user_weak_password_policy.yml

@@ -0,0 +1,60 @@
+name: Crowdstrike User Weak Password Policy
+id: b49b6ef4-57cd-4d42-bd7e-64e00f11cc87
+version: 1
+date: '2024-07-15'
+author: Teoderick Contreras, Splunk
+data_source: []
+type: Anomaly
+status: production
+description: The following analytic detects CrowdStrike alerts for weak password policy violations, 
+  identifying instances where passwords do not meet the required security standards. 
+  These alerts highlight potential vulnerabilities that could be exploited by attackers, emphasizing the need 
+  for stronger password practices. Addressing these alerts promptly helps to enhance overall security 
+  and protect sensitive information from unauthorized access.
+search: '`crowdstrike_identities`  primaryDisplayName != "*admin*"
+  | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
+  | stats count min(_time) as firstTime max(_time) as lastTime by  domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type
+  | where risk_type = "WEAK_PASSWORD_POLICY" 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)` 
+  | `crowdstrike_user_weak_password_policy_filter`'
+how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, 
+  authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. 
+  Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
+known_false_positives: unknown
+references:
+- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
+tags:
+  analytic_story:
+  - Compromised Windows Host
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: User Weak Password found on $domain$
+  mitre_attack_id:
+  - T1110
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - riskFactors{}.severity
+  - riskFactors{}.type
+  - roles{}.type
+  - accounts{}.domain
+  - accounts{}.dn
+  - accounts{}.samAccountName
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/non_adminweak_password_policy/crowdstrike_user_weak_password_cleaned.log
+    sourcetype: crowdstrike:identities
+    source: crowdstrike:identities

detections/endpoint/crowdstrike_user_with_duplicate_password.yml

@@ -0,0 +1,59 @@
+name: Crowdstrike User with Duplicate Password
+id: 386dd914-16e5-400b-9bf6-25572cc4415a
+version: 1
+date: '2024-07-15'
+author: Teoderick Contreras, Splunk
+data_source: []
+type: Anomaly
+status: production
+description: The following analytic detects CrowdStrike alerts for non-admin accounts with duplicate password risk, 
+  identifying instances where multiple non-admin users share the same password. This practice weakens security and increases 
+  the potential for unauthorized access. Addressing these alerts is essential to ensure each user account has a unique, 
+  strong password, thereby enhancing overall security and protecting sensitive information.
+search: '`crowdstrike_identities` primaryDisplayName != "*admin*"
+  | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user
+  | stats count min(_time) as firstTime max(_time) as lastTime by  domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type
+  | where risk_type = "DUPLICATE_PASSWORD" 
+  | `security_content_ctime(firstTime)`
+  | `security_content_ctime(lastTime)`
+  | `crowdstrike_user_with_duplicate_password_filter`'
+how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, 
+  authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. 
+  Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis.
+known_false_positives: unknown
+references:
+- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf
+tags:
+  analytic_story:
+  - Compromised Windows Host
+  asset_type: Endpoint
+  confidence: 70
+  impact: 70
+  message: User with Duplicate Password found on $domain$
+  mitre_attack_id:
+  - T1110
+  observable:
+  - name: user
+    type: User
+    role:
+    - Victim
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - riskFactors{}.severity
+  - riskFactors{}.type
+  - roles{}.type
+  - accounts{}.domain
+  - accounts{}.dn
+  - accounts{}.samAccountName
+  risk_score: 49
+  security_domain: endpoint
+tests:
+- name: True Positive Test
+  attack_data:
+  - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/user_duplicate_password/crowdstrike_user_dup_pwd_cleaned.log
+    sourcetype: crowdstrike:identities
+    source: crowdstrike:identities

macros/crowdstrike_identities.yml

@@ -0,0 +1,4 @@
+definition: sourcetype=crowdstrike:identities 
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: crowdstrike_identities

macros/crowdstrike_stream.yml

@@ -0,0 +1,4 @@
+definition: sourcetype="CrowdStrike:Event:Streams:JSON" 
+description: customer specific splunk configurations(eg- index, source, sourcetype).
+  Replace the macro definition with configurations for your Splunk Environmnent.
+name: crowdstrike_stream

stories/compromised_windows_host.yml

@@ -0,0 +1,19 @@
+name: Compromised Windows Host
+id: 95c15513-180b-4534-9e34-a085a26ce481
+version: 1
+date: '2024-04-18'
+author: Teoderick Contreras, Splunk
+description: Monitor for activities and techniques associated with Compromised Windows Host attacks. 
+  A compromised Windows host refers to a computer system running the Windows operating system that 
+  has been infiltrated or attacked by unauthorized parties. Such compromises often result in security breaches, 
+  data theft, malware infections, or unauthorized access, posing risks to sensitive information and system integrity.
+narrative: In a scenario of digital compromise, a Windows host becomes the target of sophisticated cyber attacks. Utilizing advanced persistent threat (APT) techniques, attackers bypass security measures and exploit system vulnerabilities to gain unauthorized access. Once inside the network, they execute a series of malicious activities, including exfiltrating sensitive data, deploying malware, and undermining the integrity of the cybersecurity infrastructure.
+references: []
+tags:
+  category:
+  - Adversary Tactics
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  usecase: Advanced Threat Detection