From 3890a9048b182d1cbc2c39e77e6820e53381f4e8 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 31 Jul 2024 11:02:19 +0200 Subject: [PATCH 1/4] crowstrikes_analytics --- ...crowdstrike_admin_weak_password_policy.yml | 59 ++++++++++++++++++ ...wdstrike_admin_with_duplicate_password.yml | 58 +++++++++++++++++ ...rowdstrike_high_identity_risk_severity.yml | 58 +++++++++++++++++ ...wdstrike_medium_identity_risk_severity.yml | 58 +++++++++++++++++ .../crowdstrike_medium_severity_alert.yml | 60 ++++++++++++++++++ ...owdstrike_multiple_low_severity_alerts.yml | 62 +++++++++++++++++++ ...rivilege_escalation_for_non_admin_user.yml | 60 ++++++++++++++++++ .../crowdstrike_user_weak_password_policy.yml | 60 ++++++++++++++++++ ...owdstrike_user_with_duplicate_password.yml | 59 ++++++++++++++++++ 9 files changed, 534 insertions(+) create mode 100644 detections/endpoint/crowdstrike_admin_weak_password_policy.yml create mode 100644 detections/endpoint/crowdstrike_admin_with_duplicate_password.yml create mode 100644 detections/endpoint/crowdstrike_high_identity_risk_severity.yml create mode 100644 detections/endpoint/crowdstrike_medium_identity_risk_severity.yml create mode 100644 detections/endpoint/crowdstrike_medium_severity_alert.yml create mode 100644 detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml create mode 100644 detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml create mode 100644 detections/endpoint/crowdstrike_user_weak_password_policy.yml create mode 100644 detections/endpoint/crowdstrike_user_with_duplicate_password.yml diff --git a/detections/endpoint/crowdstrike_admin_weak_password_policy.yml b/detections/endpoint/crowdstrike_admin_weak_password_policy.yml new file mode 100644 index 0000000000..d06b56996c --- /dev/null +++ b/detections/endpoint/crowdstrike_admin_weak_password_policy.yml @@ -0,0 +1,59 @@ +name: Crowdstrike Admin Weak Password Policy +id: bb1481fd-23c0-4195-b6a0-94d746c9637c +version: 1 +date: '2024-07-15' +author: Teoderick Contreras, Splunk +data_source: [] +type: TTP +status: production +description: The following analytic detects CrowdStrike alerts for admin weak password policy violations, + identifying instances where administrative passwords do not meet security standards. + These alerts highlight significant vulnerabilities that could be exploited by attackers to gain unauthorized access. + Promptly addressing these alerts is crucial for maintaining robust security and protecting critical systems and data from potential threats. +search: '`crowdstrike_identities` primaryDisplayName = "*admin*" + | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user + | stats count min(_time) as firstTime max(_time) as lastTime by domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type + | where risk_type = "WEAK_PASSWORD_POLICY" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `crowdstrike_admin_weak_password_policy_filter`' +how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, + authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. + Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis. +known_false_positives: unknown +references: +- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf +tags: + analytic_story: + - Compromised Windows Host + asset_type: Endpoint + confidence: 80 + impact: 100 + message: Weak Password for Admin User found on $domain$ + mitre_attack_id: + - T1110 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - riskFactors{}.severity + - riskFactors{}.type + - roles{}.type + - accounts{}.domain + - accounts{}.dn + - accounts{}.samAccountName + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/admin_weak_password_policy/crowdstrike_weak_password_admin_cleaned.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities diff --git a/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml b/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml new file mode 100644 index 0000000000..c0280b56b7 --- /dev/null +++ b/detections/endpoint/crowdstrike_admin_with_duplicate_password.yml @@ -0,0 +1,58 @@ +name: Crowdstrike Admin With Duplicate Password +id: b8bccfbf-6ac2-40f2-83b6-e72b7efaa7d4 +version: 1 +date: '2024-07-15' +author: Teoderick Contreras, Splunk +data_source: [] +type: TTP +status: production +description: The following analytic detects CrowdStrike alerts for admin accounts with duplicate password risk, + identifying instances where administrative users share the same password. This practice significantly increases + the risk of unauthorized access and potential breaches. Addressing these alerts promptly is crucial for maintaining + strong security protocols, ensuring each admin account uses a unique, secure password to protect critical systems and data. +search: '`crowdstrike_identities` primaryDisplayName = "*admin*" + | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user + | stats count min(_time) as firstTime max(_time) as lastTime by domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type + | where risk_type = "DUPLICATE_PASSWORD" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `crowdstrike_admin_with_duplicate_password_filter`' +how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, + authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. + Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis. +known_false_positives: unknown +references: +- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf +tags: + analytic_story: + - Compromised Windows Host + asset_type: Endpoint + confidence: 80 + impact: 100 + message: Duplicate Password for Admin User found on $domain$ + mitre_attack_id: + - T1110 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - riskFactors{}.severity + - riskFactors{}.type + - roles{}.type + - accounts{}.domain + - accounts{}.dn + - accounts{}.samAccountName + risk_score: 80 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/admin_duplicate_password/crowdstrike_admin_dup_pwd_cleaned.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities diff --git a/detections/endpoint/crowdstrike_high_identity_risk_severity.yml b/detections/endpoint/crowdstrike_high_identity_risk_severity.yml new file mode 100644 index 0000000000..31137e1d61 --- /dev/null +++ b/detections/endpoint/crowdstrike_high_identity_risk_severity.yml @@ -0,0 +1,58 @@ +name: Crowdstrike High Identity Risk Severity +id: 0df524ad-6d78-4883-9987-d29418928103 +version: 1 +date: '2024-07-17' +author: Teoderick Contreras, Splunk +data_source: [] +type: TTP +status: production +description: The following analytic detects CrowdStrike alerts for High Identity Risk Severity with a risk score of 70 or higher. + These alerts indicate significant vulnerabilities in user identities, such as suspicious behavior or compromised credentials. + Promptly investigating and addressing these alerts is crucial to prevent potential security breaches and ensure the integrity + and protection of sensitive information and systems. +search: '`crowdstrike_identities` riskScoreSeverity="HIGH" OR riskScore >= 0.70 + | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user + | stats count min(_time) as firstTime max(_time) as lastTime by domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `crowdstrike_high_identity_risk_severity_filter`' +how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, + authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. + Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis. +known_false_positives: unknown +references: +- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf +tags: + analytic_story: + - Compromised Windows Host + asset_type: Endpoint + confidence: 90 + impact: 100 + message: High Identity Risk Score Severity found on $domain$ + mitre_attack_id: + - T1110 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - riskFactors{}.severity + - riskFactors{}.type + - roles{}.type + - accounts{}.domain + - accounts{}.dn + - accounts{}.samAccountName + risk_score: 90 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/high_risk_score/crowdstrike_high_riskscore_cleaned.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities \ No newline at end of file diff --git a/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml b/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml new file mode 100644 index 0000000000..d07b0f86aa --- /dev/null +++ b/detections/endpoint/crowdstrike_medium_identity_risk_severity.yml @@ -0,0 +1,58 @@ +name: Crowdstrike Medium Identity Risk Severity +id: c23b425c-9024-4bd7-b526-c18a4a51d93e +version: 1 +date: '2024-07-15' +author: Teoderick Contreras, Splunk +data_source: [] +type: TTP +status: production +description: The following analytic detects CrowdStrike alerts for Medium Identity Risk Severity with a risk score of 55 or higher. + These alerts indicate significant vulnerabilities in user identities, such as suspicious behavior or compromised credentials. + Promptly investigating and addressing these alerts is crucial to prevent potential security breaches and ensure the integrity + and protection of sensitive information and systems. +search: '`crowdstrike_identities` riskScoreSeverity = "MEDIUM" OR riskScore >= 0.55 AND riskScore < 0.70 + | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user + | stats count min(_time) as firstTime max(_time) as lastTime by domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `crowdstrike_medium_identity_risk_severity_filter`' +how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, + authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. + Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis. +known_false_positives: unknown +references: +- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf +tags: + analytic_story: + - Compromised Windows Host + asset_type: Endpoint + confidence: 70 + impact: 100 + message: Medium Identity Risk Score Severity found on $domain$ + mitre_attack_id: + - T1110 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - riskFactors{}.severity + - riskFactors{}.type + - roles{}.type + - accounts{}.domain + - accounts{}.dn + - accounts{}.samAccountName + risk_score: 70 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/riskscore/crowdstrike_riskscore_cleaned.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities \ No newline at end of file diff --git a/detections/endpoint/crowdstrike_medium_severity_alert.yml b/detections/endpoint/crowdstrike_medium_severity_alert.yml new file mode 100644 index 0000000000..b5957b67df --- /dev/null +++ b/detections/endpoint/crowdstrike_medium_severity_alert.yml @@ -0,0 +1,60 @@ +name: Crowdstrike Medium Severity Alert +id: 7e80d92a-6ec3-4eb1-a444-1480acfe2d14 +version: 1 +date: '2024-07-15' +author: Teoderick Contreras, Splunk +data_source: [] +type: Anomaly +status: production +description: The following analytic detects a CrowdStrike alert with MEDIUM severity indicates a potential threat that requires prompt attention. + This alert level suggests suspicious activity that may compromise security but is not immediately critical. + It typically involves detectable but non-imminent risks, such as unusual behavior or attempted policy violations, + which should be investigated further and mitigated quickly to prevent escalation of attacks. +search: '`crowdstrike_stream` + | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity + | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, src_host, user, description, type, count_alerts, severity + | where LIKE (severity, "%MEDIUM%") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `crowdstrike_medium_severity_alert_filter`' +how_to_implement: To implement CrowdStrike stream JSON logs, use the Falcon Streaming API. Set up an API client, + authenticate with your CrowdStrike credentials, and subscribe to the "CrowdStrike:Event:Streams:JSON" event stream. + Process and store the JSON logs as needed, integrating them into your logging or SIEM system for monitoring and analysis. +known_false_positives: unknown +references: +- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf +tags: + analytic_story: + - Compromised Windows Host + asset_type: Endpoint + confidence: 70 + impact: 70 + message: A MEDIUM Severity Crowdstrike Alert found in $src_host$ + mitre_attack_id: + - T1110 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - event.EndpointIp + - event.EndpointName + - event.UserName + - event.IncidentDescription + - event.IncidentType + - event.NumbersOfAlerts + - event.SeverityName + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/medium_alert/crowdstrike_medium_clean.log + sourcetype: CrowdStrike:Event:Streams:JSON + source: CrowdStrike:Event:Streams diff --git a/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml b/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml new file mode 100644 index 0000000000..dd22106a7f --- /dev/null +++ b/detections/endpoint/crowdstrike_multiple_low_severity_alerts.yml @@ -0,0 +1,62 @@ +name: Crowdstrike Multiple LOW Severity Alerts +id: 5c2c02d8-bee7-4f5c-9dea-e3e1012daddb +version: 1 +date: '2024-07-17' +author: Teoderick Contreras, Splunk +data_source: [] +type: Anomaly +status: production +description: The following analytic detects multiple CrowdStrike LOW severity alerts, + indicating a series of minor suspicious activities or policy violations. + These alerts are not immediately critical but should be reviewed to prevent potential threats. + They often highlight unusual behavior or low-level risks that, if left unchecked, could escalate + into more significant security issues. Regular monitoring and analysis of these alerts are essential + for maintaining robust security. +search: '`crowdstrike_stream` tag=alert event.SeverityName= LOW + | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity + | stats dc(type) as type_count, values(user) as users, values(description) as descriptions, values(type) as types, values(severity) count min(_time) as firstTime max(_time) as lastTime by src_ip src_host + | where type_count >= 3 + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `crowdstrike_multiple_low_severity_alerts_filter`' +how_to_implement: To implement CrowdStrike stream JSON logs, use the Falcon Streaming API. Set up an API client, + authenticate with your CrowdStrike credentials, and subscribe to the "CrowdStrike:Event:Streams:JSON" event stream. + Process and store the JSON logs as needed, integrating them into your logging or SIEM system for monitoring and analysis. +known_false_positives: unknown +references: +- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf +tags: + analytic_story: + - Compromised Windows Host + asset_type: Endpoint + confidence: 70 + impact: 70 + message: Several LOW severity alerts found in $src_host$ + mitre_attack_id: + - T1110 + observable: + - name: src_host + type: Hostname + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - event.EndpointIp + - event.EndpointName + - event.UserName + - event.IncidentDescription + - event.IncidentType + - event.NumbersOfAlerts + - event.SeverityName + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/multiple_low_alert/crowdstrike_multiple_low_cleaned.log + sourcetype: CrowdStrike:Event:Streams:JSON + source: CrowdStrike:Event:Streams diff --git a/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml b/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml new file mode 100644 index 0000000000..08c9e47f65 --- /dev/null +++ b/detections/endpoint/crowdstrike_privilege_escalation_for_non_admin_user.yml @@ -0,0 +1,60 @@ +name: Crowdstrike Privilege Escalation For Non-Admin User +id: 69e2860c-0e4b-40ae-9dc4-bf9e3bf2a548 +version: 1 +date: '2024-07-15' +author: Teoderick Contreras, Splunk +data_source: [] +type: Anomaly +status: production +description: The following analytic detects CrowdStrike alerts for privilege escalation attempts by non-admin users. + These alerts indicate unauthorized efforts by regular users to gain elevated permissions, posing a significant security risk. + Detecting and addressing these attempts promptly helps prevent potential breaches and ensures that user privileges remain properly managed, + maintaining the integrity of the organization's security protocols. +search: '`crowdstrike_stream` tag=alert + | rename event.EndpointIp as src_ip, event.EndpointName as src_host, event.UserName as user, event.IncidentDescription as description, event.IncidentType as type, event.NumbersOfAlerts as count_alerts, event.SeverityName as severity + | stats count min(_time) as firstTime max(_time) as lastTime by src_ip, src_host, user, description, type, count_alerts, severity + | where LIKE(type,"%Privilege escalation%") AND NOT LIKE(user, "%adm%") AND NOT LIKE(user, "%svc%") AND NOT LIKE(user, "%admin%") + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `crowdstrike_privilege_escalation_for_non_admin_user_filter`' +how_to_implement: To implement CrowdStrike stream JSON logs, use the Falcon Streaming API. Set up an API client, + authenticate with your CrowdStrike credentials, and subscribe to the "CrowdStrike:Event:Streams:JSON" event stream. + Process and store the JSON logs as needed, integrating them into your logging or SIEM system for monitoring and analysis. +known_false_positives: unknown +references: +- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf +tags: + analytic_story: + - Compromised Windows Host + asset_type: Endpoint + confidence: 70 + impact: 70 + message: A Privilege escalation happened in Non-Admin Account in $src_host$ + mitre_attack_id: + - T1110 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - event.EndpointIp + - event.EndpointName + - event.UserName + - event.IncidentDescription + - event.IncidentType + - event.NumbersOfAlerts + - event.SeverityName + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/privilege_escalation/crowdstrike_priv_esc_cleaned.log + sourcetype: CrowdStrike:Event:Streams:JSON + source: CrowdStrike:Event:Streams diff --git a/detections/endpoint/crowdstrike_user_weak_password_policy.yml b/detections/endpoint/crowdstrike_user_weak_password_policy.yml new file mode 100644 index 0000000000..c2b09d2c12 --- /dev/null +++ b/detections/endpoint/crowdstrike_user_weak_password_policy.yml @@ -0,0 +1,60 @@ +name: Crowdstrike User Weak Password Policy +id: b49b6ef4-57cd-4d42-bd7e-64e00f11cc87 +version: 1 +date: '2024-07-15' +author: Teoderick Contreras, Splunk +data_source: [] +type: Anomaly +status: production +description: The following analytic detects CrowdStrike alerts for weak password policy violations, + identifying instances where passwords do not meet the required security standards. + These alerts highlight potential vulnerabilities that could be exploited by attackers, emphasizing the need + for stronger password practices. Addressing these alerts promptly helps to enhance overall security + and protect sensitive information from unauthorized access. +search: '`crowdstrike_identities` primaryDisplayName != "*admin*" + | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user + | stats count min(_time) as firstTime max(_time) as lastTime by domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type + | where risk_type = "WEAK_PASSWORD_POLICY" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `crowdstrike_user_weak_password_policy_filter`' +how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, + authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. + Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis. +known_false_positives: unknown +references: +- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf +tags: + analytic_story: + - Compromised Windows Host + asset_type: Endpoint + confidence: 70 + impact: 70 + message: User Weak Password found on $domain$ + mitre_attack_id: + - T1110 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - riskFactors{}.severity + - riskFactors{}.type + - roles{}.type + - accounts{}.domain + - accounts{}.dn + - accounts{}.samAccountName + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/non_adminweak_password_policy/crowdstrike_user_weak_password_cleaned.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities diff --git a/detections/endpoint/crowdstrike_user_with_duplicate_password.yml b/detections/endpoint/crowdstrike_user_with_duplicate_password.yml new file mode 100644 index 0000000000..b7ae4192aa --- /dev/null +++ b/detections/endpoint/crowdstrike_user_with_duplicate_password.yml @@ -0,0 +1,59 @@ +name: Crowdstrike User with Duplicate Password +id: 386dd914-16e5-400b-9bf6-25572cc4415a +version: 1 +date: '2024-07-15' +author: Teoderick Contreras, Splunk +data_source: [] +type: Anomaly +status: production +description: The following analytic detects CrowdStrike alerts for non-admin accounts with duplicate password risk, + identifying instances where multiple non-admin users share the same password. This practice weakens security and increases + the potential for unauthorized access. Addressing these alerts is essential to ensure each user account has a unique, + strong password, thereby enhancing overall security and protecting sensitive information. +search: '`crowdstrike_identities` primaryDisplayName != "*admin*" + | rename riskFactors{}.severity as severity, riskFactors{}.type as risk_type, roles{}.type as role_type, accounts{}.domain as domain, accounts{}.dn as dn, accounts{}.samAccountName as user + | stats count min(_time) as firstTime max(_time) as lastTime by domain dn primaryDisplayName risk_type severity riskScore riskScoreSeverity user role_type + | where risk_type = "DUPLICATE_PASSWORD" + | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` + | `crowdstrike_user_with_duplicate_password_filter`' +how_to_implement: To implement crowdstrike:identities logs, use the Falcon Streaming API. Set up an API client, + authenticate with your CrowdStrike credentials, and subscribe to the "crowdstrike:identities" event stream. + Process and store the logs as needed, integrating them into your logging or SIEM system for monitoring and analysis. +known_false_positives: unknown +references: +- https://www.crowdstrike.com/wp-content/uploads/2022/12/CrowdStrike-Falcon-Event-Streams-Add-on-Guide-v3.pdf +tags: + analytic_story: + - Compromised Windows Host + asset_type: Endpoint + confidence: 70 + impact: 70 + message: User with Duplicate Password found on $domain$ + mitre_attack_id: + - T1110 + observable: + - name: user + type: User + role: + - Victim + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + required_fields: + - _time + - riskFactors{}.severity + - riskFactors{}.type + - roles{}.type + - accounts{}.domain + - accounts{}.dn + - accounts{}.samAccountName + risk_score: 49 + security_domain: endpoint +tests: +- name: True Positive Test + attack_data: + - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/suspicious_behaviour/crowdstrike_stream/user_duplicate_password/crowdstrike_user_dup_pwd_cleaned.log + sourcetype: crowdstrike:identities + source: crowdstrike:identities From f28b995ce39b5074c96746bfcca55ea99f0067c5 Mon Sep 17 00:00:00 2001 From: tccontre Date: Wed, 31 Jul 2024 11:10:41 +0200 Subject: [PATCH 2/4] crowdstrike_analytics --- contentctl.yml | 11 +++++++++-- macros/crowdstrike_identities.yml | 4 ++++ macros/crowdstrike_stream.yml | 4 ++++ stories/compromised_windows_host.yml | 21 +++++++++++++++++++++ 4 files changed, 38 insertions(+), 2 deletions(-) create mode 100644 macros/crowdstrike_identities.yml create mode 100644 macros/crowdstrike_stream.yml create mode 100644 stories/compromised_windows_host.yml diff --git a/contentctl.yml b/contentctl.yml index 0a5c64859c..6250faeed0 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 4.37.0 + version: 4.35.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU @@ -13,7 +13,7 @@ app: enrichments: false build_app: true build_api: true -build_ssa: false +build_ssa: true build_path: dist test_instance: splunk_app_username: admin @@ -182,4 +182,11 @@ apps: version: 1.9.2 description: description of app hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/url-toolbox_192.tgz +- uid: 5082 + title: CrowdStrike Falcon Event Streams Technical Add-On + appid: TA-crowdstrike-falcon-event-streams + version: 3.2.1 + description: description of app + hardcoded_path: https://attack-range-appbinaries.s3.us-west-2.amazonaws.com/Latest/crowdstrike-falcon-event-streams-technical-add-on_321.tgz + githash: d6fac80e6d50ae06b40f91519a98489d4ce3a3fd diff --git a/macros/crowdstrike_identities.yml b/macros/crowdstrike_identities.yml new file mode 100644 index 0000000000..54b5b08dd9 --- /dev/null +++ b/macros/crowdstrike_identities.yml @@ -0,0 +1,4 @@ +definition: sourcetype=crowdstrike:identities +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: crowdstrike_identities \ No newline at end of file diff --git a/macros/crowdstrike_stream.yml b/macros/crowdstrike_stream.yml new file mode 100644 index 0000000000..3237270c90 --- /dev/null +++ b/macros/crowdstrike_stream.yml @@ -0,0 +1,4 @@ +definition: sourcetype="CrowdStrike:Event:Streams:JSON" +description: customer specific splunk configurations(eg- index, source, sourcetype). + Replace the macro definition with configurations for your Splunk Environmnent. +name: crowdstrike_stream \ No newline at end of file diff --git a/stories/compromised_windows_host.yml b/stories/compromised_windows_host.yml new file mode 100644 index 0000000000..44746828e8 --- /dev/null +++ b/stories/compromised_windows_host.yml @@ -0,0 +1,21 @@ +name: Compromised Windows Host +id: 95c15513-180b-4534-9e34-a085a26ce481 +version: 1 +date: '2024-04-18' +author: Teoderick Contreras, Splunk +description: Monitor for activities and techniques associated with Compromised Windows Host attacks. + A compromised Windows host refers to a computer system running the Windows operating system that + has been infiltrated or attacked by unauthorized parties. Such compromises often result in security breaches, + data theft, malware infections, or unauthorized access, posing risks to sensitive information and system integrity. +narrative: In a tale of digital intrusion, a Windows host falls victim to cunning cyber attacks. + Through stealthy techniques, they breach defenses, exploiting vulnerabilities to infiltrate the system's. + Once inside, they wreak havoc, stealing sensitive data, planting malicious software, and casting shadows over the realm of cybersecurity. +references: [] +tags: + category: + - Adversary Tactics + product: + - Splunk Enterprise + - Splunk Enterprise Security + - Splunk Cloud + usecase: Advanced Threat Detection \ No newline at end of file From 9809f49b182802f8b4d5d839a90397d00448e0d9 Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 5 Aug 2024 14:35:48 -0700 Subject: [PATCH 3/4] Update contentctl.yml --- contentctl.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/contentctl.yml b/contentctl.yml index 6250faeed0..a715d29f54 100644 --- a/contentctl.yml +++ b/contentctl.yml @@ -3,7 +3,7 @@ app: uid: 3449 title: ES Content Updates appid: DA-ESS-ContentUpdate - version: 4.35.0 + version: 4.37.0 description: Explore the Analytic Stories included with ES Content Updates. prefix: ESCU label: ESCU @@ -13,7 +13,7 @@ app: enrichments: false build_app: true build_api: true -build_ssa: true +build_ssa: false build_path: dist test_instance: splunk_app_username: admin From 19b63ed0da1adfcd68f45efaefb11361b72394dd Mon Sep 17 00:00:00 2001 From: Bhavin Patel Date: Mon, 5 Aug 2024 17:33:49 -0700 Subject: [PATCH 4/4] update narrative --- stories/compromised_windows_host.yml | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/stories/compromised_windows_host.yml b/stories/compromised_windows_host.yml index 44746828e8..a4c8902e42 100644 --- a/stories/compromised_windows_host.yml +++ b/stories/compromised_windows_host.yml @@ -7,9 +7,7 @@ description: Monitor for activities and techniques associated with Compromised W A compromised Windows host refers to a computer system running the Windows operating system that has been infiltrated or attacked by unauthorized parties. Such compromises often result in security breaches, data theft, malware infections, or unauthorized access, posing risks to sensitive information and system integrity. -narrative: In a tale of digital intrusion, a Windows host falls victim to cunning cyber attacks. - Through stealthy techniques, they breach defenses, exploiting vulnerabilities to infiltrate the system's. - Once inside, they wreak havoc, stealing sensitive data, planting malicious software, and casting shadows over the realm of cybersecurity. +narrative: In a scenario of digital compromise, a Windows host becomes the target of sophisticated cyber attacks. Utilizing advanced persistent threat (APT) techniques, attackers bypass security measures and exploit system vulnerabilities to gain unauthorized access. Once inside the network, they execute a series of malicious activities, including exfiltrating sensitive data, deploying malware, and undermining the integrity of the cybersecurity infrastructure. references: [] tags: category: @@ -18,4 +16,4 @@ tags: - Splunk Enterprise - Splunk Enterprise Security - Splunk Cloud - usecase: Advanced Threat Detection \ No newline at end of file + usecase: Advanced Threat Detection