mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
updated generate to match javiers feedback
This commit is contained in:
d1vious
+6
-3
@@ -105,17 +105,20 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
|
||||
yaml.Dumper.ignore_aliases = lambda *args : True
|
||||
|
||||
# wiping old detections for SSA
|
||||
shutil.rmtree(OUTPUT_PATH + '/srs/*', ignore_errors=True)
|
||||
shutil.rmtree(OUTPUT_PATH + '/complex/*', ignore_errors=True)
|
||||
shutil.rmtree(OUTPUT_PATH + '/srs/', ignore_errors=True)
|
||||
shutil.rmtree(OUTPUT_PATH + '/complex/', ignore_errors=True)
|
||||
os.makedirs(OUTPUT_PATH + '/complex/')
|
||||
os.makedirs(OUTPUT_PATH + '/srs/')
|
||||
|
||||
for d in detections:
|
||||
# check if the search contains "stats", "first_time_event", or "adaptive_threshold" which would make it a complex pipeline
|
||||
pattern = re.compile('stats|first_time_event|adaptive_threshold')
|
||||
|
||||
if re.findall("stats|first_time_event|adaptive_threshold", d['search']):
|
||||
# it is a complex pipeline
|
||||
manifest_file = OUTPUT_PATH + '/complex/ssa___' + d['name'].lower().replace(" ", "_") + '.yml'
|
||||
print(d['name'])
|
||||
else:
|
||||
# it is a simple pipeline can be placed on SRS (Simple Rule Service)
|
||||
manifest_file = OUTPUT_PATH + '/srs/ssa___' + d['name'].lower().replace(" ", "_") + '.yml'
|
||||
|
||||
# remove unused fields
|
||||
|
||||
@@ -1,96 +0,0 @@
|
||||
author: Patrick Bareiss, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-22'
|
||||
description: The following detection identifies the usage of archive tools from the
|
||||
command line.
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node.
|
||||
id: 63614a58-10e2-4c6c-ae81-ea1113681439
|
||||
known_false_positives: False positives can be ligitmate usage of archive tools from
|
||||
the command line.
|
||||
name: Anomalous usage of Archive Tools
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1560/001/
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading
|
||||
of 7zip.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
|
||||
"string", null)), process=lower(ucast(map_get(input_event, "process"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
|
||||
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), parent_process=ucast(map_get(input_event, "parent_process"), "string", null),
|
||||
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where process_name
|
||||
IS NOT NULL AND parent_process_name IS NOT NULL | where like(process_name, "7z%")
|
||||
OR process_name="WinRAR.exe" OR like(process_name, "winzip%") | where like(parent_process_name,
|
||||
"%cmd.exe") OR like(parent_process_name, "%powershell.exe") | eval start_time=timestamp,
|
||||
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["event_id", event_id, "process_name", process_name, "parent_process_name",
|
||||
parent_process_name, "process_path", process_path]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Cobalt Strike
|
||||
- NOBELIUM Group
|
||||
confidence: 60
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Collection
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objective
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading
|
||||
of 7zip.
|
||||
mitre_attack_id:
|
||||
- T1560.001
|
||||
- T1560
|
||||
observable:
|
||||
- name: user
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- Processes.process_name
|
||||
- Processes.process
|
||||
- Processes.dest
|
||||
- Processes.user
|
||||
- Processes.parent_process_name
|
||||
- Processes.parent_process
|
||||
risk_score: 42
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Anomalous usage of Archive Tools Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1560.001/archive_tools/windows-security.log
|
||||
file_name: security.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for Anomalous usage of Archive Tools
|
||||
file: endpoint/ssa___anomalous_usage_of_archive_tools.yml
|
||||
name: Anomalous usage of Archive Tools
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: Anomaly
|
||||
version: 1
|
||||
@@ -1,126 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-24'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifites the use of Mimikatz modules attempting to perform Pass-the-Ticket,
|
||||
Golden or Silver Kerberos ticket attacks and Skeleton Key attack. This behavior
|
||||
is typically performed within interactive Mimikatz memory space, however it may
|
||||
be identified on the command-line. A Pass-the-Ticket (ptt) attack is performed once
|
||||
an adversary has established access to a single endpoint and retrieved the kerberos
|
||||
ticket to now begin moving laterally using this method. Typically, it blends in
|
||||
with logon activity as the ticket can be copied to another system and passed into
|
||||
the current session effectively simulating a logon without any communication with
|
||||
the Domain Controller. A Golden or Silver ticket attack requires some setup by the
|
||||
adversary, but once performed it will simulate lateral based authentication to additional
|
||||
endpoints.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 759a653f-cb92-40f9-94c9-ec4e47b0f709
|
||||
known_false_positives: None identified as this is strictly identifying known command-line
|
||||
attributes related to Mimikatz.
|
||||
name: Applying Stolen Credentials via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
- https://adsecurity.org/?p=1275
|
||||
- https://adsecurity.org/?p=1515
|
||||
- https://adsecurity.org/?page_id=1821#KERBEROSPTT
|
||||
- https://attack.mitre.org/software/S0002/
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1550.002/T1550.002.md#atomic-test-1---mimikatz-pass-the-hash
|
||||
risk_message: Mimikatz malware is violating authentication processes by injecting
|
||||
golden or silver Kerberos tickets or passing stolen authentication tokens. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line != null AND ( match_regex(cmd_line, /(?i)kerberos::ptt/)=true OR match_regex(cmd_line,
|
||||
/(?i)kerberos::golden/)=true OR match_regex(cmd_line, /(?i)kerberos::silver/)=true
|
||||
OR match_regex(cmd_line, /(?i)misc::skeleton/)=true ) | eval start_time = timestamp,
|
||||
end_time = timestamp, entities = mvappend( ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["event_id", event_id, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllMimikatzModules.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is violating authentication processes by injecting golden
|
||||
or silver Kerberos tickets or passing stolen authentication tokens. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
- T1134
|
||||
- T1543
|
||||
- T1547
|
||||
- T1548
|
||||
- T1554
|
||||
- T1556
|
||||
- T1558
|
||||
- T1558.002
|
||||
- T1558.001
|
||||
- T1003
|
||||
- T1003.001
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
- cmd_line
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Applying Stolen Credentials via Mimikatz modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
file_name: logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
description: Test applying stolen credentials detections
|
||||
file: endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
|
||||
name: Applying Stolen Credentials via Mimikatz modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 2
|
||||
-121
@@ -1,121 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-24'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifies commonly used PowerSploit modules that perform credential access,
|
||||
spoofing of authentication processes, user impersonation and attempting to manipulate
|
||||
tokens. Specifically, the following modules `Invoke-CredentialInjection`, `Invoke-TokenManipulation`,
|
||||
`Invoke-UserImpersonation`, `Get-System`, and `Invoke-RevertToSelf` were identfiied
|
||||
as modules used to access credentials. PowerSploit is an archived project on GitHub,
|
||||
but much of its modules and scripts are still utilized today by adversaries. This
|
||||
behavior is typically performed within interactive PowerShell sessions or injected
|
||||
into processes, however it may be identified on the command-line.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 270b482d-2af2-448f-9923-9cf005f61be4
|
||||
known_false_positives: None identified as this is strictly identifying known command-line
|
||||
attributes related to PowerSploit.
|
||||
name: Applying Stolen Credentials via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
- https://attack.mitre.org/software/S0194/
|
||||
risk_message: PowerSploit malware is violating authentication by injecting stolen
|
||||
credentials, manipulating authentication tokens or impersonating system or user
|
||||
accounts. Operation is performed at the device $dest_device_id$, by the account
|
||||
$dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Invoke-CredentialInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-TokenManipulation/)=true
|
||||
OR match_regex(cmd_line, /(?i)Invoke-UserImpersonation/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-System/)=true OR match_regex(cmd_line, /(?i)Invoke-RevertToSelf/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is violating authentication by injecting stolen credentials,
|
||||
manipulating authentication tokens or impersonating system or user accounts. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
- T1134
|
||||
- T1543
|
||||
- T1547
|
||||
- T1548
|
||||
- T1554
|
||||
- T1555
|
||||
- T1558
|
||||
- T1059.001
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
- cmd_line
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Applying Stolen Credentials via PowerSploit modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test applying stolen credentials detections
|
||||
file: endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
|
||||
name: Applying Stolen Credentials via PowerSploit
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 2
|
||||
-93
@@ -1,93 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-24'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifies the use of a DSInternals module, `Test-PasswordQuality`, that
|
||||
verifies password strength. Adversaries have utilized this module to determine password
|
||||
complexity or to identify accounts with weak passwords.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 5526d3a4-2497-4e8d-9d3c-7a34c9aace2f
|
||||
known_false_positives: None identified as this is strictly identifying known command-line
|
||||
attributes related to DSInternals.
|
||||
name: Assessment of Credential Strength via DSInternals modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
- https://attack.mitre.org/techniques/T1059/001/
|
||||
risk_message: DSInternals tool kit is assessing password strength at the device $dest_device_id$.
|
||||
Account attempting this operation is $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Test-PasswordQuality/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 85
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Credential Access
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals tool kit is assessing password strength at the device $dest_device_id$.
|
||||
Account attempting this operation is $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1098
|
||||
- T1087
|
||||
- T1201
|
||||
- T1552
|
||||
- T1555
|
||||
- T1059.001
|
||||
- T1059
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- cmd_line
|
||||
risk_score: 25
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 2
|
||||
@@ -1,106 +0,0 @@
|
||||
author: Teoderick Contreras, splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-24'
|
||||
description: The following analytic identifies Windows Service Control, `sc.exe`,
|
||||
attempting to delete a service. This is typically identified in parallel with other
|
||||
instances of service enumeration of attempts to stop a service and then delete it.
|
||||
Adversaries utilize this technique to terminate security services or other related
|
||||
services to continue there objective and evade detections.
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: a0c8c292-d01a-11eb-aa18-acde48001122
|
||||
known_false_positives: It is possible administrative scripts may start/stop/delete
|
||||
services. Filter as needed.
|
||||
name: Attempt To Delete Services
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1543.003/T1543.003.md
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
|
||||
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
|
||||
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line IS NOT NULL AND like(cmd_line, "%delete%") AND process_name = "sc.exe"
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- XMRig
|
||||
- Ransomware
|
||||
cis20:
|
||||
- CIS 8
|
||||
- CIS 13
|
||||
confidence: 60
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Privilege Escalation
|
||||
- Stage:Persistence
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a service.
|
||||
mitre_attack_id:
|
||||
- T1489
|
||||
- T1543
|
||||
- T1543.003
|
||||
nist:
|
||||
- PR.DS
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 36
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Attempt To delete Services Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
|
||||
file_name: sc_del.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for usage of sc.exe to delete a service
|
||||
file: endpoint/ssa___attempt_to_delete_services.yml
|
||||
name: Attempt To delete Services
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 3
|
||||
@@ -1,105 +0,0 @@
|
||||
author: Teoderick Contreras, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-24'
|
||||
description: The following analytic identifies Windows Service Control, `sc.exe`,
|
||||
attempting to disable a service. This is typically identified in parallel with other
|
||||
instances of service enumeration of attempts to stop a service and then disable
|
||||
it. Adversaries utilize this technique to terminate security services or other related
|
||||
services to continue there objective and evade detections.
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: afb31de4-d023-11eb-98d5-acde48001122
|
||||
known_false_positives: It is possible administrative scripts may start/stop/delete
|
||||
services. Filter as needed.
|
||||
name: Attempt To Disable Services
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
- https://app.any.run/tasks/c0f98850-af65-4352-9746-fbebadee4f05/
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1562.001/T1562.001.md#atomic-test-14---disable-arbitrary-security-windows-service
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service.
|
||||
search: '| from read_ssa_enriched_events() | eval _datamodels=ucast(map_get(input_event,
|
||||
"_datamodels"), "collection<string>", []), body={} | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
|
||||
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
|
||||
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line IS NOT NULL AND like(cmd_line, "%disabled%") AND like(cmd_line, "%config%")
|
||||
AND process_name="sc.exe" | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- XMRig
|
||||
- Ransomware
|
||||
cis20:
|
||||
- CIS 9
|
||||
- CIS 8
|
||||
confidence: 60
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Privilege Escalation
|
||||
- Stage:Persistence
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable a service.
|
||||
mitre_attack_id:
|
||||
- T1489
|
||||
nist:
|
||||
- PR.DS
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 36
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Attempt To Disable Services Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
|
||||
file_name: sc_disable.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for usage of sc.exe to disable a service
|
||||
file: endpoint/ssa___attempt_to_disable_services.yml
|
||||
name: Attempt To Disable Services
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 3
|
||||
@@ -1,99 +0,0 @@
|
||||
author: Michael Haag, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-12-07'
|
||||
description: This search looks for flags passed to bcdedit.exe modifications to the
|
||||
built-in Windows error recovery boot configurations. This is typically used by ransomware
|
||||
to prevent recovery.
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint_Processess` datamodel.
|
||||
id: 76d79d6e-25bb-40f6-b3b2-e0a6b7e5ea13
|
||||
known_false_positives: Administrators may modify the boot configuration.
|
||||
name: BCDEdit Failure Recovery Modification
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-4---windows---disable-windows-recovery-console-repair
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability
|
||||
to recover the endpoint.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
|
||||
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
|
||||
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="bcdedit.exe"
|
||||
AND (like (cmd_line, "%recoveryenabled%") AND like (cmd_line, "%no%")) | eval start_time=timestamp,
|
||||
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
|
||||
"parent_process_name", parent_process_name, "process_path", process_path]) | into
|
||||
write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Ryuk Ransomware
|
||||
- Ransomware
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Impact
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
|
||||
impact: 100
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting disable the ability
|
||||
to recover the endpoint.
|
||||
mitre_attack_id:
|
||||
- T1490
|
||||
nist:
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: BCDEdit Failure Recovery Modification - SSA Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
|
||||
file_name: windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
description: Test detection of BCDEdit Failure Recovery Modification
|
||||
file: endpoint/ssa___bcdedit_failure_recovery_modification.yml
|
||||
name: BCDEdit Failure Recovery Modification
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
-104
@@ -1,104 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-29'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifies modules within DSInternals that are used for extracting credentials
|
||||
from Active Directory. Modules include `ConvertFrom-ADManagedPasswordBlob`, `ConvertFrom-GPPrefPassword`,
|
||||
`ConvertFrom-UnicodePasswor`, `ConvertTo-GPPrefPassword`,`ConvertTo-KerberosKey`,
|
||||
`ConvertTo-LMHash`, `ConvertTo-NTHash` `ConvertTo-OrgIdHash` or `ConvertTo-UnicodePassword`.
|
||||
Adversaries may use these modules for decrypting or transforming the stored credentials.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 73e23834-c7ad-4860-bfd0-7d8ffe6527c2
|
||||
known_false_positives: None identified as this is strictly identifying known command-line
|
||||
attributes related to DSInternals.
|
||||
name: Credential Extraction indicative of use of DSInternals credential conversion
|
||||
modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
- https://attack.mitre.org/techniques/T1059/001/
|
||||
risk_message: DSInternals tool kit is converting stolen credential material to a form
|
||||
applicable to authentications. Operation is performed on the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via process $process_name$.
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
|
||||
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)ConvertFrom-ADManagedPasswordBlob/)=true
|
||||
OR match_regex(cmd_line, /(?i)ConvertFrom-GPPrefPassword/)=true OR match_regex(cmd_line,
|
||||
/(?i)ConvertFrom-UnicodePassword/)=true OR match_regex(cmd_line, /(?i)ConvertTo-GPPrefPassword/)=true
|
||||
OR match_regex(cmd_line, /(?i)ConvertTo-KerberosKey/)=true OR match_regex(cmd_line,
|
||||
/(?i)ConvertTo-LMHash/)=true OR match_regex(cmd_line, /(?i)ConvertTo-NTHash/)=true
|
||||
OR match_regex(cmd_line, /(?i)ConvertTo-OrgIdHash/)=true OR match_regex(cmd_line,
|
||||
/(?i)ConvertTo-UnicodePassword/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals tool kit is converting stolen credential material to a form
|
||||
applicable to authentications. Operation is performed on the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via process $process_name$.
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
- T1003.002
|
||||
- T1059.001
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- cmd_line
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 2
|
||||
-106
@@ -1,106 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-29'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. The following
|
||||
analytic identifies modules of DSInternals being used on the associated endpoint.
|
||||
Adversaries may use these modules for manipulating data related to Active Directory
|
||||
and credentials.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: 5d2172f0-8a7d-4ecd-aad9-2dcc95699e0d
|
||||
known_false_positives: None identified as this is strictly identifying known command-line
|
||||
attributes related to DSInternals.
|
||||
name: Credential Extraction indicative of use of DSInternals modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
- https://attack.mitre.org/techniques/T1059/001/
|
||||
risk_message: DSInternals tool kit is accessing sensitive credential material such
|
||||
as KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via process $process_name$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
|
||||
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Get-ADDBBackupKey/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ADDBDomainController/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-ADDBKdsRootKey/)=true OR match_regex(cmd_line, /(?i)Get-ADDBSchemaAttribute/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ADKeyCredential/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-ADReplAccount/)=true OR match_regex(cmd_line, /(?i)Get-ADReplBackupKey/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ADSIAccount/)=true OR match_regex(cmd_line, /(?i)Get-AzureADUserEx/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-BootKey/)=true OR match_regex(cmd_line, /(?i)Get-LsaBackupKey/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-LsaPolicyInformation/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-SamPasswordPolicy/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals tool kit is accessing sensitive credential material such as
|
||||
KDS root key, or accessing sensitive authentication infrastructure such as LsaPolicyInformation.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via process $process_name$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
- T1003.002
|
||||
- T1059.001
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 2
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-10-21'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. Credential
|
||||
extraction is often an illegal recovery of credential material from secured authentication
|
||||
resources and repositories. This process may also involve decryption or other transformations
|
||||
of the stored credential material. Mimikatz is a collection of tools and modules
|
||||
commonly employed in Windows exploits.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 966b635f-98e8-4aa4-9b49-47ed2cedcc85
|
||||
known_false_positives: None identified.
|
||||
name: Credential Extraction indicative of use of Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is extracting/decoding encoded credentials from stores
|
||||
such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)CRYPTO::Certificates/)=true OR match_regex(cmd_line, /(?i)CRYPTO::keys/)=true
|
||||
OR match_regex(cmd_line, /(?i)kerberos::list/)=true OR match_regex(cmd_line, /(?i)kerberos::tgt/)=true
|
||||
OR match_regex(cmd_line, /(?i)lsadump::sam/)=true OR match_regex(cmd_line, /(?i)lsadump::secrets/)=true
|
||||
OR match_regex(cmd_line, /(?i)lsadump::cache/)=true OR match_regex(cmd_line, /(?i)lsadump::lsa/)=true
|
||||
OR match_regex(cmd_line, /(?i)lsadump::trust/)=true OR match_regex(cmd_line, /(?i)lsadump::backupkeys/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Unusual Processes
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 95
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is extracting/decoding encoded credentials from stores
|
||||
such as SAM or LSA dumps. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 66
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-91
@@ -1,91 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-10-21'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. Credential
|
||||
extraction is often an illegal recovery of credential material from secured authentication
|
||||
resources and repositories. This process may also involve decryption or other transformations
|
||||
of the stored credential material. PowerSploit is a collection of Microsoft PowerShell
|
||||
modules commonly employed in exploits.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 5f1186a4-e681-446e-851c-dc9574ad28eb
|
||||
known_false_positives: None identified.
|
||||
name: Credential Extraction indicative of use of PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is extracting encoded credentials or spoofing automated
|
||||
logings. Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Get-ApplicationHost/)=true OR match_regex(cmd_line, /(?i)Get-CachedGPPPassword/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-GPPAutologon/)=true OR match_regex(cmd_line, /(?i)Get-GPPPassword/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-RegistryAutoLogon/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-SiteListPassword/)=true OR match_regex(cmd_line, /(?i)Get-SPNTicket/)=true
|
||||
OR match_regex(cmd_line, /(?i)Request-SPNTicket/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-VaultCredential/)=true OR match_regex(cmd_line, /(?i)Invoke-Kerberoast/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is extracting encoded credentials or spoofing automated
|
||||
logings. Operation is performed at the device $dest_device_id$, by the account
|
||||
$dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1003
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-109
@@ -1,109 +0,0 @@
|
||||
author: Teoderick Contreras, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-30'
|
||||
description: This analytic will detect a suspicious net.exe/net1.exe command-line
|
||||
to delete a user on a system. This technique may be use by an administrator for
|
||||
legitimate purposes, however this behavior has been used in the wild to impair some
|
||||
user or deleting adversaries tracks created during its lateral movement additional
|
||||
systems. During triage, review parallel processes for additional behavior. Identify
|
||||
any other user accounts created before or after.
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
|
||||
id: 8776d79c-d26e-11eb-9a56-acde48001122
|
||||
known_false_positives: System administrators or scripts may delete user accounts via
|
||||
this technique. Filter as needed.
|
||||
name: Delete A Net User
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user
|
||||
account.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
|
||||
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
|
||||
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line IS NOT NULL AND like(cmd_line, "%/delete%") AND (process_name="net1.exe"
|
||||
OR process_name="net.exe") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- XMRig
|
||||
- Ransomware
|
||||
cis20:
|
||||
- CIS 4
|
||||
- CIS 16
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete a user
|
||||
account.
|
||||
mitre_attack_id:
|
||||
- T1531
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 49
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Delete A Net User Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
|
||||
file_name: net_user_del.log
|
||||
source: WinEventLog:Security
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1531/atomic_red_team/security.log
|
||||
file_name: security.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for usage of net.exe or net1.exe to delete net user
|
||||
file: endpoint/ssa___delete_a_net_user.yml
|
||||
name: Delete A Net User
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: Anomaly
|
||||
version: 3
|
||||
@@ -1,92 +0,0 @@
|
||||
author: Teoderick Contreras, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-29'
|
||||
description: The following analytic identifies the use of `cacls.exe`, `icacls.exe`
|
||||
or `xcacls.exe` placing the deny permission on a file or directory. Adversaries
|
||||
perform this behavior to prevent responders from reviewing or gaining access to
|
||||
adversary files on disk.
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
|
||||
id: b76eae28-cd25-11eb-9c92-acde48001122
|
||||
known_false_positives: System administrators may use cacls utilities but this is not
|
||||
a common practice. Filter as needed.
|
||||
name: Deny Permission using Cacls Utility
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to deny
|
||||
a permission of a file or directory in host $dest_device_id$
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
|
||||
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
|
||||
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
|
||||
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
|
||||
"string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)deny/)=true
|
||||
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- XMRig
|
||||
cis20:
|
||||
- CIS 14
|
||||
- CIS 16
|
||||
confidence: 70
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A cacls process $process_name$ with commandline $cmd_line$ try to deny
|
||||
a permission of a file or directory in host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1222
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: user
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 35
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Deny Permission using Cacls Utility Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
file_name: all_icalc.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for usage of cacls deny permission to a file(s) or folder(s)
|
||||
file: endpoint/ssa___deny_permission_using_cacls_utility.yml
|
||||
name: Deny Permission using Cacls Utility
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 3
|
||||
@@ -1,87 +0,0 @@
|
||||
author: Jose Hernandez, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-29'
|
||||
description: The following analytic identifies credential dumping using comsvcs.dll
|
||||
with `regsvr32.exe`. This technique is common with adversaries who would like to
|
||||
dump the memory of lsass.exe and perform offline password cracking.
|
||||
how_to_implement: You must be ingesting endpoint data that tracks process activity,
|
||||
including Windows command line logging. You can see how we test this with [Event
|
||||
Code 4688](https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4688a)
|
||||
on the [attack_range](https://github.com/splunk/attack_range/blob/develop/ansible/roles/windows_common/tasks/windows-enable-4688-cmd-line-audit.yml).
|
||||
id: 76bb9e35-f314-4c3d-a385-83c72a13ce4e
|
||||
known_false_positives: False positives should be limited, filter as needed.
|
||||
name: Detect Dump LSASS Memory using comsvcs
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://2017.zeronights.org/wp-content/uploads/materials/ZN17_Kheirkhabarov_Hunting_for_Credentials_Dumping_in_Windows_Environment.pdf
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1003.001/T1003.001.md#atomic-test-3---dump-lsassexe-memory-using-comsvcsdll
|
||||
risk_message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$
|
||||
by user $dest_device_user$.
|
||||
search: '| from read_ssa_enriched_events() | eval tenant=ucast(map_get(input_event,
|
||||
"_tenant"), "string", null), machine=ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), timestamp=parse_long(ucast(map_get(input_event, "_time"), "string",
|
||||
null)), process=lower(ucast(map_get(input_event, "process"), "string", null)), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where process_name LIKE "%rundll32.exe%" AND match_regex(process,
|
||||
/(?i)comsvcs.dll[,\s]+MiniDump/)=true | eval start_time = timestamp, end_time =
|
||||
timestamp, entities = mvappend(machine), body=create_map(["event_id", event_id,
|
||||
"process_name", process_name, "process", process]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
asset_type: Endpoint
|
||||
cis20:
|
||||
- CIS 8
|
||||
- CIS 16
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A dump of lsass.exe was attempted using comsvcs.dll on endpoint $dest_device_id$
|
||||
by user $dest_device_user$.
|
||||
mitre_attack_id:
|
||||
- T1003.003
|
||||
- T1003
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _tenant
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Detect Dump LSASS Memory using comsvcs - SSA Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
|
||||
file_name: windows-security.log
|
||||
source: WinEventLog:Security
|
||||
description: Test credential dumping detections
|
||||
file: endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
|
||||
name: Detect Dump LSASS Memory using comsvcs
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 2
|
||||
@@ -1,103 +0,0 @@
|
||||
author: Ignacio Bermudez Corrales, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-10'
|
||||
description: The following analytic identifies parent processes, browsers, Windows
|
||||
terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
|
||||
many applications spawn cmd.exe natively or built into macros. Much of this will
|
||||
need to be tuned to further enhance the risk.
|
||||
how_to_implement: In order to successfully implement this analytic, you will need
|
||||
endpoint process data from a EDR product or Sysmon. This search has been modified
|
||||
to process raw sysmon data from attack_range's nxlogs on DSP.
|
||||
id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
|
||||
known_false_positives: There are circumstances where an application may legitimately
|
||||
execute and interact with the Windows command-line interface.
|
||||
name: Detect Prohibited Applications Spawning cmd exe
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1059/
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
|
||||
that warrants investigating.
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
|
||||
| eval process_name=ucast(map_get(input_event, "process_name"), "string", null),
|
||||
parent_process=lower(ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null)), cmd_line=lower(ucast(map_get(input_event, "process"),"string", null)), dest_user_id=ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null), event_id=ucast(map_get(input_event,"event_id"), "string", null)
|
||||
| where process_name="cmd.exe" | rex field=parent_process "(?<ParentBaseFileName>[^\\\\]+)$"
|
||||
| where ParentBaseFileName="winword.exe" OR ParentBaseFileName="excel.exe" OR ParentBaseFileName="outlook.exe"
|
||||
OR ParentBaseFileName="powerpnt.exe" OR ParentBaseFileName="visio.exe" OR ParentBaseFileName="mspub.exe"
|
||||
OR ParentBaseFileName="acrobat.exe" OR ParentBaseFileName="acrord32.exe" OR ParentBaseFileName="iexplore.exe"
|
||||
OR ParentBaseFileName="opera.exe" OR ParentBaseFileName="firefox.exe" OR (ParentBaseFileName="java.exe"
|
||||
AND (cmd_line IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%patch1-Hotfix1a%"))))
|
||||
OR ParentBaseFileName="powershell.exe" OR (ParentBaseFileName="chrome.exe" AND (cmd_line
|
||||
IS NULL OR (cmd_line IS NOT NULL AND NOT like(cmd_line, "%chrome-extension%"))))
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(dest_device_id,
|
||||
dest_user_id), body=create_map(["event_id", event_id, "process_name", process_name,
|
||||
"parent_process_name", parent_process, "cmd_line", cmd_line]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Suspicious Command-Line Executions
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
|
||||
that warrants investigating.
|
||||
mitre_attack_id:
|
||||
- T1059
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- cmd_line
|
||||
risk_score: 35
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Detect Prohibited Applications Spawning cmd exe Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
|
||||
file_name: windows-security.log
|
||||
source: WinEventLog:Security
|
||||
description: Detect Prohibited Applications Spawning cmd exe
|
||||
file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
|
||||
name: Detect Prohibited Applications Spawning cmd exe
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: Anomaly
|
||||
version: 2
|
||||
@@ -1,97 +0,0 @@
|
||||
author: Michael Haag, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-12-03'
|
||||
description: This analytic identifies commonly used command-line arguments used by
|
||||
`rclone.exe` to initiate a file transfer. Some arguments were negated as they are
|
||||
specific to the configuration used by adversaries. In particular, an adversary may
|
||||
list the files or directories of the remote file share using `ls` or `lsd`, which
|
||||
is not indicative of malicious behavior. During triage, at this stage of a ransomware
|
||||
event, exfiltration is about to occur or has already. Isolate the endpoint and continue
|
||||
investigating by review file modifications and parallel processes.
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint_Processess` datamodel.
|
||||
id: e8b74268-5454-11ec-a799-acde48001122
|
||||
known_false_positives: False positives should be limited as this is restricted to
|
||||
the Rclone process name. Filter or tune the analytic as needed.
|
||||
name: Detect RClone Command-Line Usage
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://redcanary.com/blog/rclone-mega-extortion/
|
||||
- https://www.fireeye.com/blog/threat-research/2021/05/shining-a-light-on-darkside-ransomware-operations.html
|
||||
- https://thedfirreport.com/2021/03/29/sodinokibi-aka-revil-ransomware/
|
||||
- https://thedfirreport.com/2021/11/29/continuing-the-bazar-ransomware-story/
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a remote
|
||||
cloud service to move files or folders.
|
||||
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="rclone.exe"
|
||||
AND (like (cmd_line, "%copy%") OR like (cmd_line, "%mega%")OR like (cmd_line, "%pcloud%")
|
||||
OR like (cmd_line, "%ftp%") OR like (cmd_line, "%--config%") OR like (cmd_line,
|
||||
"%--progress%") OR like (cmd_line, "%--no-check-certificate%") OR like (cmd_line,
|
||||
"%--ignore-existing%") OR like (cmd_line, "%--auto-confirm%") OR like (cmd_line,
|
||||
"%--transfers%") OR like (cmd_line, "%--multi-thread-streams%")) | eval start_time=timestamp,
|
||||
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null))
|
||||
| eval body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- DarkSide Ransomware
|
||||
- Ransomware
|
||||
automated_detection_testing: passed
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Exfiltration
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1020/windows-security.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exfiltration
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to connect to a
|
||||
remote cloud service to move files or folders.
|
||||
mitre_attack_id:
|
||||
- T1020
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 35
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-104
@@ -1,104 +0,0 @@
|
||||
author: Teoderick Contreras, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-30'
|
||||
description: This analytic will identify a suspicious command-line that disables a
|
||||
user account using the native `net.exe` or `net1.exe` utility to Windows. This technique
|
||||
may used by the adversaries to interrupt availability of accounts and continue the
|
||||
impact against the organization.
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed net.exe/net1.exe may be
|
||||
used.
|
||||
id: ba858b08-d26c-11eb-af9b-acde48001122
|
||||
known_false_positives: System administrators or automated scripts may disable an account
|
||||
but not a common practice. Filter as needed.
|
||||
name: Disable Net User Account
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
|
||||
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
|
||||
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line IS NOT NULL AND like(cmd_line, "%/active:no%") AND like(cmd_line, "%user%")
|
||||
AND (process_name="net1.exe" OR process_name="net.exe") | eval start_time=timestamp,
|
||||
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
|
||||
"parent_process_name", parent_process_name, "process_path", process_path]) | into
|
||||
write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- XMRig
|
||||
- Ransomware
|
||||
cis20:
|
||||
- CIS 4
|
||||
- CIS 16
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to disable accounts.
|
||||
mitre_attack_id:
|
||||
- T1489
|
||||
- T1078
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: user
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 49
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Disable Net User Account Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
|
||||
file_name: net_user_dis.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for usage of net.exe or net1.exe to disable net user
|
||||
file: endpoint/ssa___disable_net_user_account.yml
|
||||
name: Disable Net User Account
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 3
|
||||
@@ -1,104 +0,0 @@
|
||||
author: Michael Haag, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-12-07'
|
||||
description: This search is to detect potential DNS exfiltration using nslookup application.
|
||||
This technique are seen in couple of malware and APT group to exfiltrated collected
|
||||
data in a infected machine or infected network. This detection is looking for unique
|
||||
use of nslookup where it tries to use specific record type, TXT, A, AAAA, that are
|
||||
commonly used by attacker and also the retry parameter which is designed to query
|
||||
C2 DNS multiple tries.
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint_Processess` datamodel.
|
||||
id: 2452e632-9e0d-11eb-34ba-acde48001122
|
||||
known_false_positives: It is possible for some legitimate administrative utilities
|
||||
to use similar cmd_line parameters. Filter as needed.
|
||||
name: DNS Exfiltration Using Nslookup App
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
|
||||
- https://www.varonis.com/blog/dns-tunneling/
|
||||
- https://www.microsoft.com/security/blog/2021/01/20/deep-dive-into-the-solorigate-second-stage-activation-from-sunburst-to-teardrop-and-raindrop/
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related
|
||||
to DNS exfiltration.
|
||||
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="nslookup.exe"
|
||||
AND (like (cmd_line, "%-querytype=%") OR like (cmd_line, "%-qt=%") OR like (cmd_line,
|
||||
"%-q=%") OR like (cmd_line, "%-type=%") OR like (cmd_line, "%-retry=%")) | eval
|
||||
start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
|
||||
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
|
||||
process_path]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Suspicious DNS Traffic
|
||||
- Dynamic DNS
|
||||
- Command and Control
|
||||
- Data Exfiltration
|
||||
automated_detection_testing: passed
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Exfiltration
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ performing activity related
|
||||
to DNS exfiltration.
|
||||
mitre_attack_id:
|
||||
- T1048
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 72
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: DNS Exfiltration Using Nslookup App Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/nslookup_exfil/windows-sysmon.log
|
||||
file_name: windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
file: endpoint/ssa_dns_exfiltration_using_nslookup_app.yml
|
||||
name: DNS Exfiltration Using Nslookup App
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
-97
@@ -1,97 +0,0 @@
|
||||
author: Michael Haag, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-12-07'
|
||||
description: This search is to detect a suspicious fsutil process to zeroing a target
|
||||
file. This technique was seen in lockbit ransomware where it tries to zero out its
|
||||
malware path as part of its defense evasion after encrypting the compromised host.
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed net.exe may be used.
|
||||
id: f792cdc9-43ee-4429-a3c0-ffce4fed1a85
|
||||
known_false_positives: System administrators or scripts may delete user accounts via
|
||||
this technique. Filter as needed.
|
||||
name: Fsutil Zeroing File
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://app.any.run/tasks/e0ac072d-58c9-4f53-8a3b-3e491c7ac5db/
|
||||
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/fsutil-file
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file deletion.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
|
||||
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
|
||||
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="fsutil.exe"
|
||||
AND (like (cmd_line, "%setzerodata%")) | eval start_time=timestamp, end_time=timestamp,
|
||||
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null)), body=create_map(["event_id", event_id, "cmd_line",
|
||||
cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
|
||||
"process_path", process_path]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Ransomware
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- stage:Defense Evasion
|
||||
dataset: []
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ atempting to perform file
|
||||
deletion.
|
||||
mitre_attack_id:
|
||||
- T1070
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 54
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: FSUtil Zeroing File - SSA Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/fsutil_file_zero/windows-sysmon.log
|
||||
file_name: windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
description: Test detection of FSUtil Zeroing File
|
||||
file: endpoint/ssa___fsutil_zeroing_file.yml
|
||||
name: FSUtil Zeroing File
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,92 +0,0 @@
|
||||
author: Teoderick Contreras, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-30'
|
||||
description: The following analytic identifies the use of `cacls.exe`, `icacls.exe`
|
||||
or `xcacls.exe` placing the grant permission on a file or directory. Adversaries
|
||||
perform this behavior to allow components of their files to run, however it allows
|
||||
responders to review or gaining access to adversary files on disk.
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed icacls.exe may be used.
|
||||
id: c6da561a-cd29-11eb-ae65-acde48001122
|
||||
known_false_positives: System administrators may use cacls utilities but this is not
|
||||
a common practice. Filter as needed.
|
||||
name: Grant Permission Using Cacls Utility
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to grant
|
||||
user a permission to a file or directory in host $dest_device_id$
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
|
||||
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
|
||||
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
|
||||
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
|
||||
"string", null) | where cmd_line IS NOT NULL AND match_regex(cmd_line, /(?i)grant/)=true
|
||||
AND (process_name="cacls.exe" OR process_name="xcacls.exe" OR process_name="icacls.exe")
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- XMRig
|
||||
cis20:
|
||||
- CIS 14
|
||||
- CIS 16
|
||||
confidence: 70
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A cacls process $process_name$ with commandline $cmd_line$ try to grant
|
||||
user a permission to a file or directory in host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1222
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: user
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 35
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Grant Permission Using Cacls Utility Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
file_name: all_icalc.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for usage of cacls grant permission to a file(s) or folder(s)
|
||||
file: endpoint/ssa___grant_permission_using_cacls_utility.yml
|
||||
name: Grant Permission Using Cacls Utility
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 3
|
||||
-92
@@ -1,92 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that enable illegaly access user content,
|
||||
such as key logging, audio recording, screenshots, tapping into http and RDP sessions,
|
||||
etc.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 01fc7d91-eb0c-478e-8633-e4fa4904463a
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Access To User Content via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is tapping into user content - microphone, camera,
|
||||
ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Get-HttpStatus/)=true OR match_regex(cmd_line, /(?i)Get-Keystrokes/)=true OR
|
||||
match_regex(cmd_line, /(?i)Get-MicrophoneAudio/)=true OR match_regex(cmd_line, /(?i)Get-NetRDPSession/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-TimedScreenshot/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-WebConfig/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Exfiltration
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 85
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is tapping into user content - microphone, camera,
|
||||
ongoing HTTP or RDP session. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1021
|
||||
- T1113
|
||||
- T1123
|
||||
- T1563
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 85
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,93 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that create accounts illegaly.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 20fba62a-fa5b-46cc-b39f-473fa248fee2
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Account Creation via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is creating illegal domain accounts. Operation is
|
||||
performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)New-DomainUser/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Persistence
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1585/illegal_account_creation/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is creating illegal domain accounts. Operation is performed
|
||||
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1585
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Illegal Account Creation via PowerSploit modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal account creation detections
|
||||
file: endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
|
||||
name: Illegal Account Creation via PowerSploit modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,83 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that delete event logs.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 4ddb3b0d-f95f-4ae2-b4e8-663296453a7b
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Deletion of Logs via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is deleting event logs to cover tracks of malicious
|
||||
activity. Operation is performed at the device $dest_device_id$, by the account
|
||||
$dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)event::drop/)=true OR match_regex(cmd_line, /(?i)event::clear/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Log Manipulation
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070/illegal_log_deletion/logAllMimikatzModules.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is deleting event logs to cover tracks of malicious activity.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1070
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 50
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-85
@@ -1,85 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of DSInternals modules that enable or disable accounts illegaly.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 3e0f9962-9989-445f-878c-939443326b63
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Enabling or Disabling of Accounts via DSInternals modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
risk_message: DSInternals malware is illegally enabling or disabling accounts. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Disable-ADDBAccount/)=true OR match_regex(cmd_line, /(?i)Enable-ADDBAccount/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals malware is illegally enabling or disabling accounts. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-89
@@ -1,89 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of DSInternals modules for illegal management of Active Directoty
|
||||
elements and policies.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: a587ca9f-c138-47b4-ba51-699f319b8cc5
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Management of Active Directory Elements and Policies via DSInternals
|
||||
modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
risk_message: DSInternals malware is controlling infrastructure by modifying Active
|
||||
Directory elements, domain controllers, and policies. Operation is performed at
|
||||
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Remove-ADDBObject/)=true OR match_regex(cmd_line, /(?i)Set-ADDBDomainController/)=true
|
||||
OR match_regex(cmd_line, /(?i)Set-ADDBPrimaryGroup/)=true OR match_regex(cmd_line,
|
||||
/(?i)Set-LsaPolicyInformation/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllDSInternalsModules.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals malware is controlling infrastructure by modifying Active Directory
|
||||
elements, domain controllers, and policies. Operation is performed at the device
|
||||
$dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1098
|
||||
- T1207
|
||||
- T1484
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that enable illegal management of computers
|
||||
and Active Directory elements.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 75760c11-7d48-4968-b828-013b299e8f6d
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Management of Computers and Active Directory Elements via PowerSploit
|
||||
modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is controlling infrastructure by modifying Active
|
||||
Directory elements or local Master Boot Records. Operation is performed at the device
|
||||
$dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Set-DomainObject/)=true OR match_regex(cmd_line, /(?i)Set-ADObject/)=true OR
|
||||
match_regex(cmd_line, /(?i)Set-DomainObjectOwner/)=true OR match_regex(cmd_line,
|
||||
/(?i)Set-MasterBootRecord/)=true )
|
||||
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1484/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is controlling infrastructure by modifying Active Directory
|
||||
elements or local Master Boot Records. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1098
|
||||
- T1207
|
||||
- T1484
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-104
@@ -1,104 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that illegaly elevate general privileges
|
||||
or ensure persistence, e.g., enable manipulation of registry, task scheduling, persistent
|
||||
WMI, access to OS objects under desired identities.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 88c10ee9-fe72-4bce-b343-5b129044b991
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Privilege Elevation and Persistence via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is planting attack persistence elements, altering
|
||||
privileges and access controls. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Add-DomainObjectAcl/)=true OR match_regex(cmd_line, /(?i)Add-ObjectAcl/)=true
|
||||
OR match_regex(cmd_line, /(?i)Enable-Privilege/)=true OR match_regex(cmd_line, /(?i)New-ElevatedPersistenceOption/)=true
|
||||
OR match_regex(cmd_line, /(?i)New-UserPersistenceOption/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Malicious PowerShell
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Privilege Escalation
|
||||
- Stage:Command And Control
|
||||
- Stage:Persistence
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is planting attack persistence elements, altering privileges
|
||||
and access controls. Operation is performed at the device $dest_device_id$, by
|
||||
the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1053
|
||||
- T1134
|
||||
- T1548
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Illegal Privilege Elevation and Persistence via PowerSploit modules - SSA
|
||||
Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test privilege elevation and persistence detections
|
||||
file: endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
|
||||
name: Illegal Privilege Elevation and Persistence via PowerSploit modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,97 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for illegal privilege elevation.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 2f873b1f-6352-4844-b7b9-b419f09a42c7
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Privilege Elevation via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is setting highest privileges to malicious entities.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)privilege::debug/)=true OR match_regex(cmd_line, /(?i)token::elevate/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Privilege Escalation
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Privilege Escalation
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is setting highest privileges to malicious entities. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1134
|
||||
- T1548
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Illegal Privilege Elevation via Mimikatz modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
|
||||
file_name: logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal privilege elevation detections
|
||||
file: endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
|
||||
name: Illegal Privilege Elevation via Mimikatz modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
-100
@@ -1,100 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for illegal control over services and processes,
|
||||
including the authentication service.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: aaf3adf1-73e1-4477-b4ee-3771898964f1
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Service and Process Control via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is controlling computer's processess and services.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)process::start/)=true OR match_regex(cmd_line, /(?i)service::\+/)=true OR match_regex(cmd_line,
|
||||
/(?i)service::\-/)=true OR match_regex(cmd_line, /(?i)service::start/)=true OR match_regex(cmd_line,
|
||||
/(?i)service::stop/)=true OR match_regex(cmd_line, /(?i)service::suspend/)=true
|
||||
OR match_regex(cmd_line, /(?i)misc::memssp/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Service Abuse
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is controlling computer's processess and services. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
- T1106
|
||||
- T1569
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Illegal Service and Process Control via Mimikatz modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
file_name: logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal service and process control detections
|
||||
file: endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
|
||||
name: Illegal Service and Process Control via Mimikatz modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
-110
@@ -1,110 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-09'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that enable illegal control of services
|
||||
and processes, such as installing or spoofing of malicious services, injecting malicious
|
||||
code in DLLs and EXEs, invoking shell code and WMI commands, modifying access to
|
||||
service objects, etc.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 0e910e5b-309d-4bc3-8af2-0030c02aa353
|
||||
known_false_positives: None identified.
|
||||
name: Illegal Service and Process Control via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is controlling computer's processess and services.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Install-SSP/)=true OR match_regex(cmd_line, /(?i)Set-CriticalProcess/)=true
|
||||
OR match_regex(cmd_line, /(?i)Install-ServiceBinary/)=true OR match_regex(cmd_line,
|
||||
/(?i)Restore-ServiceBinary/)=true OR match_regex(cmd_line, /(?i)Write-ServiceBinary/)=true
|
||||
OR match_regex(cmd_line, /(?i)Set-ServiceBinaryPath/)=true OR match_regex(cmd_line,
|
||||
/(?i)Invoke-ReflectivePEInjection/)=true OR match_regex(cmd_line, /(?i)Invoke-DllInjection/)=true
|
||||
OR match_regex(cmd_line, /(?i)Invoke-ServiceAbuse/)=true OR match_regex(cmd_line,
|
||||
/(?i)Invoke-Shellcode/)=true OR match_regex(cmd_line, /(?i)Invoke-WScriptUACBypass/)=true
|
||||
OR match_regex(cmd_line, /(?i)Invoke-WmiCommand/)=true OR match_regex(cmd_line,
|
||||
/(?i)Write-HijackDll/)=true OR match_regex(cmd_line, /(?i)Add-ServiceDacl/)=true
|
||||
)
|
||||
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Service Abuse
|
||||
- Malicious PowerShell
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Credential Access
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is controlling computer's processess and services.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1055
|
||||
- T1106
|
||||
- T1569
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Illegal Service and Process Control via PowerSploit modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal service and process control detections
|
||||
file: endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
|
||||
name: Illegal Service and Process Control via PowerSploit modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,96 +0,0 @@
|
||||
author: Teoderick Contreras, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-30'
|
||||
description: This analytic identifies suspicious modification of ACL permission to
|
||||
a files or folder to make it available to everyone or to a specific user. This technique
|
||||
may be used by the adversary to evade ACLs or protected files access. This changes
|
||||
is commonly configured by the file or directory owner with appropriate permission.
|
||||
This behavior raises suspicion if this command is seen on an endpoint utilized by
|
||||
an account with no permission to do so.
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA. Tune and filter known instances where renamed cacls.exe may be used.
|
||||
id: 9ae9a48a-cdbe-11eb-875a-acde48001122
|
||||
known_false_positives: System administrators may use this windows utility. filter
|
||||
is needed.
|
||||
name: Modify ACLs Permission Of Files Or Folders
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
risk_message: A cacls process $process_name$ with commandline $cmd_line$ try to modify
|
||||
a permission of a file or directory in host $dest_device_id$
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=ucast(map_get(input_event, "process"), "string",
|
||||
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
|
||||
process_path=ucast(map_get(input_event, "process_path"), "string", null), parent_process_name=ucast(map_get(input_event,
|
||||
"parent_process_name"), "string", null), event_id=ucast(map_get(input_event, "event_id"),
|
||||
"string", null) | where cmd_line IS NOT NULL AND like(cmd_line, "%/G%") AND (match_regex(cmd_line,
|
||||
/(?i)everyone:/)=true OR match_regex(cmd_line, /(?i)SYSTEM:/)=true) AND (process_name="cacls.exe"
|
||||
OR process_name="xcacls.exe" OR process_name="icacls.exe") | eval start_time=timestamp,
|
||||
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
|
||||
"parent_process_name", parent_process_name, "process_path", process_path]) | into
|
||||
write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- XMRig
|
||||
cis20:
|
||||
- CIS 8
|
||||
- CIS 13
|
||||
confidence: 70
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A cacls process $process_name$ with commandline $cmd_line$ try to modify
|
||||
a permission of a file or directory in host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1222
|
||||
nist:
|
||||
- PR.DS
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: user
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 35
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Modify ACLs Permission Of Files Or Folders Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
|
||||
file_name: all_icalc.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for modifying permission of a file(s) or folder(s) using cacls
|
||||
utility.
|
||||
file: endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
|
||||
name: Modify ACLs Permission Of Files Or Folders
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: Anomaly
|
||||
version: 2
|
||||
-62
@@ -1,62 +0,0 @@
|
||||
author: Xiao Lin, Splunk
|
||||
datamodel: []
|
||||
date: '2020-08-25'
|
||||
description: Malicious mails can conduct phishing that induces readers to open attachment,
|
||||
click links or trigger third party service. This detect uses Natural Language Processing
|
||||
(NLP) approach to analyze an email message's content (Sender, Subject and Body)
|
||||
and judge whether it is a phishing email. The detection adopts a deep learning (neural
|
||||
network) model that employs character level embeddings plus LSTM layers to perform
|
||||
classification. The model is pre-trained and then published as ONNX format. Current
|
||||
sample model is trained using the dataset published at https://github.com/splunk/attack_data/tree/master/datasets/T1566_Phishing_Email/splunk_train.json
|
||||
User are expected to re-train the model by combining with their own training data
|
||||
for better accuracy using the provided model file (SMLE notebook). DSP pipeline
|
||||
then processes the email message and passes it as an event to Apply ML Models function,
|
||||
which returns the probability of a phishing email. Current implementation assumes
|
||||
the email is fed to DSP in JSON format contains at least email's sender, subject
|
||||
and its message body, including reply content, if any.
|
||||
how_to_implement: Events are fed to DSP contains at least email's sender, subject
|
||||
and its message body.
|
||||
id: 4b237388-dfa1-41a6-91d4-4de2d598376f
|
||||
known_false_positives: Because of imbalance of anomaly data in training, the model
|
||||
will less likely report false positive. Instead, the model is more prone to false
|
||||
negative. Current best recall score is ~85%
|
||||
name: Phishing Email Detection by Machine Learning Method - SSA
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
search: '| from read_ssa_enriched_events() | eval eventLine=concat(ucast(map_get(input_event,
|
||||
"From"), "string", " "), " ", ucast(map_get(input_event, "Subject"), "string", "
|
||||
"), " ", ucast(map_get(input_event, "Content"), "string", " "), " "),
|
||||
_time=map_get(input_event, "_time") | where eventLine IS NOT NULL | eval mapC={"
|
||||
": 32, "!": 33, "\"": 34, "#": 35, "$": 36, "%": 37, "&": 38, "`": 39, "(": 40,
|
||||
")": 41, "*": 42, "+": 43, ",": 44, "-": 45, ".": 46, "/": 47, "0": 48, "1": 49,
|
||||
"2": 50, "3": 51, "4": 52, "5": 53, "6": 54, "7": 55, "8": 56, "9": 57, ":": 58,
|
||||
";": 59, "<": 60, "=": 61, ">": 62, "?": 63, "@": 64, "A": 65, "B": 66, "C": 67,
|
||||
"D": 68, "E": 69, "F": 70, "G": 71, "H": 72, "I": 73, "J": 74, "K": 75, "L": 76,
|
||||
"M": 77, "N": 78, "O": 79, "P": 80, "Q": 81, "R": 82, "S": 83, "T": 84, "U": 85,
|
||||
"V": 86, "W": 87, "X": 88, "Y": 89, "Z": 90, "[": 91, "\\": 92, "]": 93, "^": 94,
|
||||
"_": 95, "`": 96, "a": 97, "b": 98, "c": 99, "d": 100, "e": 101, "f": 102, "g":
|
||||
103, "h": 104, "i": 105, "j": 106, "k": 107, "l": 108, "m": 109, "n": 110, "o":
|
||||
111, "p": 112, "q": 113, "r": 114, "s": 115, "t": 116, "u": 117, "v": 118, "w":
|
||||
119, "x": 120, "y": 121, "z": 122, "{": 123, "|": 124, "}": 125, "~": 126}, ml_in
|
||||
= for_each(iterator(mvrange(1,129), "i"), cast(map_get(mapC, substr(eventLine, i,
|
||||
1)), "float") ) | apply_model connection_id="YOUR_S3_ONNX_CONNECTOR_ID" name="phishing_email_v8"
|
||||
path="s3://smle-experiments/models/phishing_email" | eval probability = mvindex(ml_out,
|
||||
0) | where probability > 0.5 | eval start_time=_time, end_time=_time, entities="TBD",
|
||||
body="TBD" | select probability, body, entities, start_time, end_time | into write_ssa_detected_events();'
|
||||
tags:
|
||||
cis20:
|
||||
- CIS 8
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
mitre_attack_id:
|
||||
- T1566
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
risk_severity: low
|
||||
security_domain: mail server
|
||||
type: Anomaly
|
||||
version: 1
|
||||
-96
@@ -1,96 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-04'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of PowerSploit modules that facilitate access probing with admin
|
||||
credentials as well as probing access to system services.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: d405af5d-99f1-45af-8dfb-b8f98b764247
|
||||
known_false_positives: None identified.
|
||||
name: Probing Access with Stolen Credentials via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is probing access with stolen credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Test-AdminAccess/)=true OR match_regex(cmd_line, /(?i)Invoke-CheckLocalAdminAccess/)=true
|
||||
OR match_regex(cmd_line, /(?i)Test-ServiceDaclPermission/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Privilege Escalation
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Credential Access
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is probing access with stolen credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_user_id
|
||||
- dest_device_id
|
||||
risk_score: 60
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Probing Access with Stolen Credentials via PowerSploit modules - SSA Unit
|
||||
test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test access probing with stolen credentials detections
|
||||
file: endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
|
||||
name: Probing Access with Stolen Credentials via PowerSploit modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-85
@@ -1,85 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for discovery of accounts and groups and access
|
||||
to them.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 1bce67aa-3fc4-4886-9089-67f0bfebbef6
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Accounts and Groups via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is searching for and using specific accounts and groups.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)net::user/)=true OR match_regex(cmd_line, /(?i)net::group/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is searching for and using specific accounts and groups.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1087
|
||||
- T1484
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-109
@@ -1,109 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that discover accounts, groups and policies
|
||||
that can be accessed or taken over.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 63422f8e-766c-468f-8133-2ba6795e263b
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Accounts Groups and Policies via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is searching for and using specific accounts, groups
|
||||
and policies, such as the last logged on account, a local Net group, etc. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Find-DomainLocalGroupMember/)=true OR match_regex(cmd_line, /(?i)Invoke-EnumerateLocalAdmin/)=true
|
||||
OR match_regex(cmd_line, /(?i)Find-DomainUserEvent/)=true OR match_regex(cmd_line,
|
||||
/(?i)Invoke-EventHunter/)=true OR match_regex(cmd_line, /(?i)Find-DomainUserLocation/)=true
|
||||
OR match_regex(cmd_line, /(?i)Invoke-UserHunter/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DomainForeignGroupMember/)=true OR match_regex(cmd_line, /(?i)Find-ForeignGroup/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainForeignUser/)=true OR match_regex(cmd_line,
|
||||
/(?i)Find-ForeignUser/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPO/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetGPO/)=true OR match_regex(cmd_line, /(?i)Get-DomainGPOComputerLocalGroupMapping/)=true
|
||||
OR match_regex(cmd_line, /(?i)Find-GPOComputerAdmin/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DomainGPOLocalGroup/)=true OR match_regex(cmd_line, /(?i)Get-NetGPOGroup/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainGPOUserLocalGroupMapping/)=true OR match_regex(cmd_line,
|
||||
/(?i)Find-GPOLocation/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroup/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetGroup/)=true OR match_regex(cmd_line, /(?i)Get-DomainGroupMember/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetGroupMember/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DomainManagedSecurityGroup/)=true OR match_regex(cmd_line, /(?i)Find-ManagedSecurityGroups/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainOU/)=true OR match_regex(cmd_line, /(?i)Get-NetOU/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainUser/)=true OR match_regex(cmd_line, /(?i)Get-NetUser/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainUserEvent/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-UserEvent/)=true OR match_regex(cmd_line, /(?i)Get-NetLocalGroup/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetLocalGroupMember/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-NetLoggedon/)=true OR match_regex(cmd_line, /(?i)Get-RegLoggedOn/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-WMIRegLastLoggedOn/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-LastLoggedOn/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is searching for and using specific accounts, groups
|
||||
and policies, such as the last logged on account, a local Net group, etc. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1078
|
||||
- T1087
|
||||
- T1484
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-98
@@ -1,98 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules for reconnaissance and access to elements
|
||||
of Active Directory infrastructure, such as domain identifiers, AD sites and forests,
|
||||
and trust relations.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: db08ac40-ee14-43e9-9a75-dddd059ef812
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Active Directoty Infrastructure via PowerSploit
|
||||
modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is seaching for or accessing Active Directory objects
|
||||
such as domain sites, domain trusts, AD forests, etc. Operation is performed at
|
||||
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Get-DomainSID/)=true OR match_regex(cmd_line, /(?i)Get-DomainSite/)=true OR
|
||||
match_regex(cmd_line, /(?i)Get-NetSite/)=true OR match_regex(cmd_line, /(?i)Get-DomainSubnet/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetSubnet/)=true OR match_regex(cmd_line, /(?i)Get-DomainTrust/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetDomainTrust/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DomainTrustMapping/)=true OR match_regex(cmd_line, /(?i)Invoke-MapDomainTrust/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-Forest/)=true OR match_regex(cmd_line, /(?i)Get-NetForest/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ForestDomain/)=true OR match_regex(cmd_line, /(?i)Get-NetForestDomain/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ForestGlobalCatalog/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-NetForestCatalog/)=true OR match_regex(cmd_line, /(?i)Get-ForestTrust/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetForestTrust/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is seaching for or accessing Active Directory objects
|
||||
such as domain sites, domain trusts, AD forests, etc. Operation is performed at
|
||||
the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1199
|
||||
- T1482
|
||||
- T1590
|
||||
- T1591
|
||||
- T1595
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that discover computers, servers and domains
|
||||
that can be accessed or taken over.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: fe1c4c5a-09f3-4b43-8129-560a7f38a08b
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Computers and Domains via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is seaching for or accessing domain controllers,
|
||||
computers, file servers, etc. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Get-ComputerDetail/)=true OR match_regex(cmd_line, /(?i)Get-Domain/)=true OR
|
||||
match_regex(cmd_line, /(?i)Get-NetDomain/)=true OR match_regex(cmd_line, /(?i)Get-DomainComputer/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetComputer/)=true OR match_regex(cmd_line, /(?i)Get-DomainController/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-NetDomainController/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DomainFileServer/)=true OR match_regex(cmd_line, /(?i)Get-NetFileServer/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is seaching for or accessing domain controllers, computers,
|
||||
file servers, etc. Operation is performed at the device $dest_device_id$, by the
|
||||
account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1592
|
||||
- T1590
|
||||
- T1087
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-81
@@ -1,81 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for discovery of computers and servers and access
|
||||
to them.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 48664505-7d22-44ee-87d2-4c8a5bdc3d14
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Computers via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is collecting information about computers. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)net::ServerInfo/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is collecting information about computers. Operation is
|
||||
performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1592
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 50
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-98
@@ -1,98 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that discover and access operating system
|
||||
elements, such as processes, services, registry locations, security packages and
|
||||
files.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: c1d33ad9-1727-4f9f-a474-4adbe4fed68a
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Operating System Elements via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is searching for and tapping into ongoing processes,
|
||||
mounted drives or other operating system elements. Operation is performed at the
|
||||
device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Find-DomainProcess/)=true OR match_regex(cmd_line, /(?i)Invoke-ProcessHunter/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ServiceDetail/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-WMIProcess/)=true OR match_regex(cmd_line, /(?i)Get-NetProcess/)=true OR
|
||||
match_regex(cmd_line, /(?i)Get-SecurityPackage/)=true OR match_regex(cmd_line, /(?i)Find-DomainObjectPropertyOutlier/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainObject/)=true OR match_regex(cmd_line, /(?i)Get-ADObject/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-WMIRegMountedDrive/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-RegistryMountedDrive/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is searching for and tapping into ongoing processes,
|
||||
mounted drives or other operating system elements. Operation is performed at the
|
||||
device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1057
|
||||
- T1083
|
||||
- T1592.002
|
||||
- T1046
|
||||
- T1012
|
||||
- T1007
|
||||
- T1047
|
||||
- T1592
|
||||
- T1518
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-80
@@ -1,80 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for discovery and access to services and processes.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 0243d37c-57c1-4182-bfd1-39b212255fc8
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Processes and Services via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is listing processes and services. Operation is performed
|
||||
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)process::list/)=true OR match_regex(cmd_line, /(?i)service::list/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is listing processes and services. Operation is performed
|
||||
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1007
|
||||
- T1046
|
||||
- T1057
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 50
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-85
@@ -1,85 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for discovery and access to network shares.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: c97b6eb9-1d8b-4017-bbbb-2af7fc17bc3f
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Shared Resources via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is searching for and accessing network shares. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)net::share/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Lateral Movement
|
||||
- Stage:Collection
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is searching for and accessing network shares. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1021
|
||||
- T1039
|
||||
- T1135
|
||||
- T1021.002
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules that discover and access network and distributed
|
||||
file system shares.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 6b7ca431-6b1e-4b40-9589-21cb368e369e
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance and Access to Shared Resources via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is searching for and accessing network shares. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Find-DomainShare/)=true OR match_regex(cmd_line, /(?i)Invoke-ShareFinder/)=true
|
||||
OR match_regex(cmd_line, /(?i)Find-InterestingDomainShareFile/)=true OR match_regex(cmd_line,
|
||||
/(?i)Invoke-FileFinder/)=true OR match_regex(cmd_line, /(?i)Find-InterestingFile/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainDFSShare/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DFSshare/)=true OR match_regex(cmd_line, /(?i)Get-NetShare/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Lateral Movement
|
||||
- Stage:Collection
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is searching for and accessing network shares. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1021
|
||||
- T1039
|
||||
- T1135
|
||||
- T1021.002
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-101
@@ -1,101 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of PowerSploit modules that discover opportunities for malicious
|
||||
access and persistence. Some examples include access to admin accounts, weak access
|
||||
control policies, landing paths for dropping malicious software or data to exfiltrate,
|
||||
registry locations to land autorun parameters, task scheduling opportunities, as
|
||||
well as services and system files that can be compromised.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 3d8bd7f3-1061-4ac7-9225-6764cc0684d7
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Access and Persistence Opportunities via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is searching for an entry point into the infrastructure,
|
||||
such as local admin accounts, opportunities to hijack processes, unattended install
|
||||
files, or modifiable access objects. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Find-LocalAdminAccess/)=true OR match_regex(cmd_line, /(?i)Find-InterestingDomainAcl/)=true
|
||||
OR match_regex(cmd_line, /(?i)Invoke-ACLScanner/)=true OR match_regex(cmd_line,
|
||||
/(?i)Find-PathDLLHijack/)=true OR match_regex(cmd_line, /(?i)Find-ProcessDLLHijack/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainObjectAcl/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-ObjectAcl/)=true OR match_regex(cmd_line, /(?i)Get-DomainPolicy/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ModifiablePath/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-ModifiableRegistryAutoRun/)=true OR match_regex(cmd_line, /(?i)Get-ModifiableScheduledTaskFile/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-ModifiableService/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-ModifiableServiceFile/)=true OR match_regex(cmd_line, /(?i)Get-PathAcl/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-UnattendedInstallFile/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-UnquotedService/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is searching for an entry point into the infrastructure,
|
||||
such as local admin accounts, opportunities to hijack processes, unattended install
|
||||
files, or modifiable access objects. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1053
|
||||
- T1068
|
||||
- T1078
|
||||
- T1543
|
||||
- T1547
|
||||
- T1574
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 60
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-06'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies access to PowerSploit modules for reconnaissance of connectivity.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 525d32fd-65dd-4732-9b72-3cfc7ddddbd2
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Connectivity via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is performing port scans or searching for various
|
||||
connectivity details such as DNS data, proxies, or ongoing RDP connections. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Get-DomainDNSRecord/)=true OR match_regex(cmd_line, /(?i)Get-DNSRecord/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-DomainDNSZone/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-DNSZone/)=true OR match_regex(cmd_line, /(?i)Invoke-ReverseDnsLookup/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-WMIRegCachedRDPConnection/)=true OR match_regex(cmd_line,
|
||||
/(?i)Get-CachedRDPConnection/)=true OR match_regex(cmd_line, /(?i)Get-WMIRegProxy/)=true
|
||||
OR match_regex(cmd_line, /(?i)Get-Proxy/)=true OR match_regex(cmd_line, /(?i)Invoke-Portscan/)=true
|
||||
)
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is performing port scans or searching for various connectivity
|
||||
details such as DNS data, proxies, or ongoing RDP connections. Operation is performed
|
||||
at the device $dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1021
|
||||
- T1039
|
||||
- T1135
|
||||
- T1021.002
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
Vendored
-91
@@ -1,91 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-03'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies reconnaissance of credential stores and use of CryptoAPI services by
|
||||
Mimikatz modules.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 5facee5b-79e4-47ab-b0e6-c625acc0554f
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Credential Stores and Services via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is searching for and accessing credential stores. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)crypto::capi/)=true OR match_regex(cmd_line, /(?i)crypto::cng/)=true OR match_regex(cmd_line,
|
||||
/(?i)crypto::providers/)=true OR match_regex(cmd_line, /(?i)crypto::stores/)=true
|
||||
OR match_regex(cmd_line, /(?i)crypto::sc/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Credential Access
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is searching for and accessing credential stores. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1098
|
||||
- T1590.001
|
||||
- T1078
|
||||
- T1589.001
|
||||
- T1590
|
||||
- T1068
|
||||
- T1589
|
||||
- T1590.003
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-83
@@ -1,83 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of PowerSploit modules for assessment of presence of defensive tools.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 24b4e659-63a2-4e7b-89ac-87dd659c7110
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Defensive Tools via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is looking for presence of anti virus software.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Find-AVSignature/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 40
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is looking for presence of anti virus software. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1592.002
|
||||
- T1595.002
|
||||
- T1592
|
||||
- T1595
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 40
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-82
@@ -1,82 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of PowerSploit modules for assessment of privilege escalation opportunities.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: b9b4492c-2af8-449b-beb4-b1b78d963321
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Privilege Escalation Opportunities via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is engaging its privilege escalation module. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Invoke-PrivescAudit/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is engaging its privilege escalation module. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 60
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
-90
@@ -1,90 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-05'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies use of Mimikatz modules for discovery of process or service hijacking
|
||||
opportunities via Microsoft Detours compatibility. Microsoft Detours is an open
|
||||
source library for intercepting, monitoring and instrumenting binary functions on
|
||||
Microsoft Windows. Detours intercepts Win32 functions by re-writing the in-memory
|
||||
code for target functions. The Detours package also contains utilities to attach
|
||||
arbitrary DLLs and data segments called payloads to any Win32 binary.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: fc5c1cbd-7494-4314-aad2-458d6fd4fada
|
||||
known_false_positives: None identified.
|
||||
name: Reconnaissance of Process or Service Hijacking Opportunities via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
- https://en.wikipedia.org/wiki/Microsoft_Detours
|
||||
risk_message: Mimikatz malware is looking for and invoking Microsoft Detours package
|
||||
that enables spoofing of in-memory code. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)misc::detours/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Discovery Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Recon
|
||||
- Stage:Command And Control
|
||||
- Consequence:Loss Of Control
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is looking for and invoking Microsoft Detours package
|
||||
that enables spoofing of in-memory code. Operation is performed at the device
|
||||
$dest_device_id$, by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1543
|
||||
- T1055
|
||||
- T1574
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- process
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
risk_score: 70
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,105 +0,0 @@
|
||||
author: Teoderick Contreras, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-30'
|
||||
description: The following analytic identifies the resizing of shadowstorage using
|
||||
vssadmin.exe to avoid the shadow volumes being made again. This technique is typically
|
||||
found used by adversaries during a ransomware event and a precursor to deleting
|
||||
the shadowstorage.
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: dbc30554-d27e-11eb-9e5e-acde48001122
|
||||
known_false_positives: System administrators may resize the shadowstorage for valid
|
||||
purposes. Filter as needed.
|
||||
name: Resize Shadowstorage Volume
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
|
||||
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow
|
||||
copy to perform offline password cracking.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
|
||||
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
|
||||
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line IS NOT NULL AND like(cmd_line, "%resize%") AND like(cmd_line, "%shadowstorage%")
|
||||
AND like(cmd_line, "%maxsize%") AND process_name="vssadmin.exe" | eval start_time=timestamp,
|
||||
end_time=timestamp, entities=mvappend(ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), ucast(map_get(input_event, "dest_device_id"), "string", null)),
|
||||
body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name", process_name,
|
||||
"parent_process_name", parent_process_name, "process_path", process_path]) | into
|
||||
write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Clop Ransomware
|
||||
- Ransomware
|
||||
cis20:
|
||||
- CIS 10
|
||||
- CIS 13
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to create a shadow
|
||||
copy to perform offline password cracking.
|
||||
mitre_attack_id:
|
||||
- T1489
|
||||
nist:
|
||||
- PR.DS
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 64
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Resize Shadowstorage Volume Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
|
||||
file_name: windows-security.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for resizing the shadow storage of a machine
|
||||
file: endpoint/ssa___resize_shadowstorage_volume.yml
|
||||
name: Resize Shadowstorage Volume
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 3
|
||||
@@ -1,110 +0,0 @@
|
||||
author: Teoderick Contreras, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-15'
|
||||
description: This analytic will detect the execution of sdelete.exe attempting to
|
||||
delete potentially important files that may related to adversary or insider threats
|
||||
to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
|
||||
to securely delete files on disk. This tool is commonly used to clear tracks and
|
||||
artifact on the targeted host.
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
|
||||
confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
|
||||
endpoint product.
|
||||
id: fcc52b9a-4616-11ec-8454-acde48001122
|
||||
known_false_positives: False positives should be limited, filter as needed.
|
||||
name: Sdelete Application Execution
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
|
||||
risk_message: Sdelete process $process_name$ executed on $dest_device_id$ attempting
|
||||
to permanently delete files by $dest_user_id$.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
|
||||
"string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
|
||||
null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
|
||||
parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
|
||||
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
|
||||
IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
|
||||
(like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
|
||||
OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
|
||||
%") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
|
||||
"%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
|
||||
"%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
|
||||
"%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
|
||||
"%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
|
||||
"%.bmp%") OR like (cmd_line, "%.7z%") OR like (cmd_line, "%.zip%") OR like (cmd_line,
|
||||
"%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
|
||||
"%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "process_path", process_path, "parent_process_name", parent_process_name,
|
||||
"parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Information Sabotage
|
||||
confidence: 70
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Execution
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
|
||||
impact: 60
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: Sdelete process $process_name$ executed on $dest_device_id$ attempting
|
||||
to permanently delete files by $dest_user_id$.
|
||||
mitre_attack_id:
|
||||
- T1485
|
||||
- T1070.004
|
||||
- T1070
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest
|
||||
- user
|
||||
- parent_process_name
|
||||
- parent_process
|
||||
- process_name
|
||||
- process
|
||||
- process_id
|
||||
- process_path
|
||||
- cmd_line
|
||||
risk_score: 42
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Sdelete Application Execution Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
|
||||
file_name: security.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for sdelete execution command
|
||||
file: endpoint/ssa___sdelete_application_execution.yml
|
||||
name: Sdelete Application Execution
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: Anomaly
|
||||
version: 1
|
||||
@@ -1,106 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-03'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies illegal setting of credentials via DSInternals modules.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: d5ef590f-9bde-49eb-9c63-2f5b62a65b9c
|
||||
known_false_positives: None identified.
|
||||
name: Setting Credentials via DSInternals modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/MichaelGrafnetter/DSInternals
|
||||
risk_message: DSInternals malware is accessing, using or setting Active Directory
|
||||
or Azure credentials and accounts. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), process_path=ucast(map_get(input_event,
|
||||
"process_path"), "string", null), cmd_line=ucast(map_get(input_event, "process"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line != null AND ( match_regex(cmd_line, /(?i)Add-ADDBSidHistory/)=true
|
||||
OR match_regex(cmd_line, /(?i)Add-ADReplNgcKey/)=true OR match_regex(cmd_line, /(?i)Set-ADDBAccountPassword/)=true
|
||||
OR match_regex(cmd_line, /(?i)Set-ADDBAccountPasswordHash/)=true OR match_regex(cmd_line,
|
||||
/(?i)Set-ADDBBootKey/)=true OR match_regex(cmd_line, /(?i)Set-SamAccountPasswordHash/)=true
|
||||
OR match_regex(cmd_line, /(?i)Set-AzureADUserEx/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Source:Cloud Data
|
||||
- Stage:Credential Access
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllDSInternalsModules.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: DSInternals malware is accessing, using or setting Active Directory or
|
||||
Azure credentials and accounts. Operation is performed at the device $dest_device_id$,
|
||||
by the account $dest_user_id$ via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Setting Credentials via DSInternals modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
|
||||
file_name: logAllDSInternalsModules.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal credential setting detections
|
||||
file: endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
|
||||
name: Setting Credentials via DSInternals modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,96 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-03'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies illegal setting of credentials via Mimikatz modules.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: c8b84699-7652-4363-910f-efd1ca82f780
|
||||
known_false_positives: None identified.
|
||||
name: Setting Credentials via Mimikatz modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/gentilkiwi/mimikatz
|
||||
risk_message: Mimikatz malware is accessing, using or setting account credentials.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)misc::addsid/)=true OR match_regex(cmd_line, /(?i)CRYPTO::scauth/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllMimikatzModules.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Mimikatz malware is accessing, using or setting account credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Setting Credentials via Mimikatz modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
|
||||
file_name: logAllMimikatzModules.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal credential setting detections
|
||||
file: endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
|
||||
name: Setting Credentials via Mimikatz modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,96 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-11-03'
|
||||
deprecated: true
|
||||
description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
|
||||
Research team, this means that it will no longer be maintained or supported. If
|
||||
you have any questions feel free to email us at: research@splunk.com. This detection
|
||||
identifies illegal setting of credentials via PowerSploit modules.'
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest,
|
||||
including the event ID 4688 with enabled command line logging.
|
||||
id: 07b2a501-f967-4ddc-9f56-2dce46dfce44
|
||||
known_false_positives: None identified.
|
||||
name: Setting Credentials via PowerSploit modules
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/PowerShellMafia/PowerSploit
|
||||
risk_message: PowerSploit malware is setting passwords on Active Directory accounts.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
search: '| from read_ssa_enriched_events()
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line != null AND ( match_regex(cmd_line,
|
||||
/(?i)Set-DomainUserPassword/)=true )
|
||||
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend( ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Persistence Techniques
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
- Consequence:Loss Of Control
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1098/account_manipulation/logAllPowerSploitModulesWithOldNames.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: PowerSploit malware is setting passwords on Active Directory accounts.
|
||||
Operation is performed at the device $dest_device_id$, by the account $dest_user_id$
|
||||
via command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1068
|
||||
- T1078
|
||||
- T1098
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- _time
|
||||
risk_score: 90
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Setting Credentials via PowerSploit modules - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
|
||||
file_name: logAllPowerSploitModulesWithOldNames.log
|
||||
source: WinEventLog:Security
|
||||
description: Test illegal credential setting detections
|
||||
file: endpoint/ssa___setting_credentials_via_powersploit_modules.yml
|
||||
name: Setting Credentials via PowerSploit modules
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,102 +0,0 @@
|
||||
author: Michael Haag, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-12-07'
|
||||
description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator
|
||||
Tool) that delete backup files. This is typically used by ransomware to prevent
|
||||
recovery.
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint_Processess` datamodel.
|
||||
id: 71efbf52-4dbb-4c00-a520-306aa546cbb7
|
||||
known_false_positives: Administrators may modify the boot configuration.
|
||||
name: WBAdmin Delete System Backups
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md
|
||||
- https://thedfirreport.com/2020/10/08/ryuks-return/
|
||||
- https://attack.mitre.org/techniques/T1490/
|
||||
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/wbadmin
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system
|
||||
backups.
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"),
|
||||
"string", null)), process_name=lower(ucast(map_get(input_event, "process_name"),
|
||||
"string", null)), process_path=ucast(map_get(input_event, "process_path"), "string",
|
||||
null), parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
|
||||
null), event_id=ucast(map_get(input_event, "event_id"), "string", null) | where
|
||||
cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="wbadmin.exe"
|
||||
AND like (cmd_line, "%delete%") OR like (cmd_line, "%catalog%") OR like (cmd_line,
|
||||
"%systemstatebackup%") | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name, "parent_process_name", parent_process_name, "process_path", process_path])
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Ryuk Ransomware
|
||||
- Ransomware
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 50
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- stage:Defense Evasion
|
||||
dataset: []
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ attempting to delete system
|
||||
backups.
|
||||
mitre_attack_id:
|
||||
- T1490
|
||||
nist:
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 15
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: WBAdmin Delete System Backups - SSA Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1490/atomic_red_team/windows-sysmon.log
|
||||
file_name: windows-sysmon.log
|
||||
source: XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
|
||||
description: Test detection of WBAdmin Delete System Backups
|
||||
file: endpoint/ssa___wbadmin_delete_system_backups.yml
|
||||
name: WBAdmin Delete System Backups
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
@@ -1,97 +0,0 @@
|
||||
author: Teoderick Contreras, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-06-15'
|
||||
description: The wevtutil.exe application is the windows event log utility. This searches
|
||||
for wevtutil.exe with parameters for clearing the application, security, setup,
|
||||
powershell, sysmon, or system event logs.
|
||||
how_to_implement: You must be ingesting data that records process activity from your
|
||||
hosts to populate the Endpoint data model in the Processes node. You must also be
|
||||
ingesting logs with both the process name and command line from your endpoints.
|
||||
The command-line arguments are mapped to the "process" field in the Endpoint data
|
||||
model.
|
||||
id: 5438113c-cdd9-11eb-93b8-acde48001122
|
||||
known_false_positives: The wevtutil.exe application is a legitimate Windows event
|
||||
log utility. Administrators may use it to manage Windows event logs.
|
||||
name: WevtUtil Usage To Clear Logs
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://www.splunk.com/en_us/blog/security/detecting-clop-ransomware.html
|
||||
risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear
|
||||
event logs in host $dest_device_id$
|
||||
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line IS NOT NULL AND like(cmd_line, "% cl %") AND (match_regex(cmd_line,
|
||||
/(?i)security/)=true OR match_regex(cmd_line, /(?i)system/)=true OR match_regex(cmd_line,
|
||||
/(?i)sysmon/)=true OR match_regex(cmd_line, /(?i)application/)=true OR match_regex(cmd_line,
|
||||
/(?i)setup/)=true OR match_regex(cmd_line, /(?i)powershell/)=true) AND process_name="wevtutil.exe"
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
|
||||
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
|
||||
process_path]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Log Manipulation
|
||||
- Ransomware
|
||||
- Clop Ransomware
|
||||
cis20:
|
||||
- CIS 8
|
||||
- CIS 13
|
||||
confidence: 90
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A wevtutil process $process_name$ with commandline $cmd_line$ to clear
|
||||
event logs in host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1070
|
||||
- T1070.001
|
||||
nist:
|
||||
- PR.DS
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: user
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 63
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: WevtUtil Usage To Clear Logs Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
|
||||
file_name: clear_evt.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for wevtutil clear logs command
|
||||
file: endpoint/ssa___wevtutil_usage_to_clear_logs.yml
|
||||
name: WevtUtil Usage To Clear Logs
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 2
|
||||
@@ -1,93 +0,0 @@
|
||||
author: Teoderick Contreras, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-06-15'
|
||||
description: This search is to detect execution of wevtutil.exe to disable logs. This
|
||||
technique was seen in several ransomware to disable the event logs to evade alerts
|
||||
and detections in compromised host.
|
||||
how_to_implement: You must be ingesting data that records process activity from your
|
||||
hosts to populate the Endpoint data model in the Processes node. You must also be
|
||||
ingesting logs with both the process name and command line from your endpoints.
|
||||
The command-line arguments are mapped to the "process" field in the Endpoint data
|
||||
model.
|
||||
id: a4bdc944-cdd9-11eb-ac97-acde48001122
|
||||
known_false_positives: network operator may disable audit event logs for debugging
|
||||
purposes.
|
||||
name: Wevtutil Usage To Disable Logs
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://www.bleepingcomputer.com/news/security/new-ransom-x-ransomware-used-in-texas-txdot-cyberattack/
|
||||
risk_message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
|
||||
event logs in host $dest_device_id$
|
||||
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where cmd_line IS NOT NULL AND like(cmd_line, "% sl %") AND like(cmd_line, "%/e:false%")
|
||||
AND process_name="wevtutil.exe" | eval start_time=timestamp, end_time=timestamp,
|
||||
entities=mvappend(ucast(map_get(input_event, "dest_user_id"), "string", null), ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null)) | eval body=create_map(["event_id", event_id,
|
||||
"cmd_line", cmd_line, "process_name", process_name, "parent_process_name", parent_process_name,
|
||||
"process_path", process_path]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Windows Log Manipulation
|
||||
- Ransomware
|
||||
cis20:
|
||||
- CIS 8
|
||||
- CIS 13
|
||||
confidence: 90
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A wevtutil process $process_name$ with commandline $cmd_line$ to disable
|
||||
event logs in host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1070
|
||||
- T1070.001
|
||||
nist:
|
||||
- PR.DS
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: user
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 63
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Wevtutil Usage To Disable Logs Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
|
||||
file_name: disable_evt.log
|
||||
source: WinEventLog:Security
|
||||
description: Test for wevtutil disable logs command
|
||||
file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml
|
||||
name: Wevtutil Usage To Disable Logs
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 2
|
||||
@@ -1,115 +0,0 @@
|
||||
author: Michael Haag, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-12-03'
|
||||
description: 'The following analytic identifies the use of Windows Curl.exe uploading
|
||||
a file to a remote destination. \
|
||||
|
||||
`-T` or `--upload-file` is used when a file is to be uploaded to a remotge destination.
|
||||
\
|
||||
|
||||
`-d` or `--data` POST is the HTTP method that was invented to send data to a receiving
|
||||
web application, and it is, for example, how most common HTML forms on the web work.
|
||||
\
|
||||
|
||||
HTTP multipart formposts are done with `-F`, but this appears to not be compatible
|
||||
with the Windows version of Curl. Will update if identified adversary tradecraft.
|
||||
\
|
||||
|
||||
Adversaries may use one of the three methods based on the remote destination and
|
||||
what they are attempting to upload (zip vs txt). During triage, review parallel
|
||||
processes for further behavior. In addition, identify if the upload was successful
|
||||
in network logs. If a file was uploaded, isolate the endpoint and review.'
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint_Processess` datamodel.
|
||||
id: cc8d046a-543b-11ec-b864-acde48001122
|
||||
known_false_positives: False positives may be limited to source control applications
|
||||
and may be required to be filtered out.
|
||||
name: Windows Curl Upload to Remote Destination
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://everything.curl.dev/usingcurl/uploads
|
||||
- https://techcommunity.microsoft.com/t5/containers/tar-and-curl-come-to-windows/ba-p/382409
|
||||
- https://twitter.com/d1r4c/status/1279042657508081664?s=20
|
||||
risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote
|
||||
destination.
|
||||
search: '| from read_ssa_enriched_events() | where "Endpoint_Processes" IN(_datamodels)
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), process_name=ucast(map_get(input_event,
|
||||
"process_name"), "string", null), process_path=ucast(map_get(input_event, "process_path"),
|
||||
"string", null), parent_process_name=ucast(map_get(input_event, "parent_process_name"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
|
||||
| where cmd_line IS NOT NULL AND process_name IS NOT NULL AND process_name="curl.exe"
|
||||
AND (like (cmd_line, "%-T %") OR like (cmd_line, "%--upload-file %")OR like (cmd_line,
|
||||
"%-d %") OR like (cmd_line, "%--data %") OR like (cmd_line, "%-F %"))
|
||||
|
||||
| eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)) | eval body=create_map(["event_id", event_id, "cmd_line", cmd_line,
|
||||
"process_name", process_name, "parent_process_name", parent_process_name, "process_path",
|
||||
process_path]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Ingress Tool Transfer
|
||||
automated_detection_testing: passed
|
||||
confidence: 100
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Defense Evasion
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Exfiltration
|
||||
message: An instance of $parent_process_name$ spawning $process_name$ was identified
|
||||
on endpoint $dest_device_id$ by user $dest_user_id$ uploading a file to a remote
|
||||
destination.
|
||||
mitre_attack_id:
|
||||
- T1105
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: parent_process_name
|
||||
role:
|
||||
- Parent Process
|
||||
type: Parent Process
|
||||
- name: process_name
|
||||
role:
|
||||
- Child Process
|
||||
type: Process
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- dest_device_id
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- process_path
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 80
|
||||
risk_severity: high
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Windows Curl Upload to Remote Destination Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1105/atomic_red_team/windows-security.log
|
||||
file_name: windows-security.log
|
||||
source: WinEventLog:Security
|
||||
file: endpoint/ssa___windows_curl_upload_to_remote_destination.yml
|
||||
name: Windows Curl Upload to Remote Destination
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: TTP
|
||||
version: 1
|
||||
-94
@@ -1,94 +0,0 @@
|
||||
author: Xiao Lin, Splunk
|
||||
datamodel:
|
||||
- Certificates
|
||||
date: '2020-10-21'
|
||||
description: This search detects a potential kerberoasting attack via service principal
|
||||
name requests
|
||||
how_to_implement: The test data is converted from Windows Security Event logs generated
|
||||
from Attach Range simulation and used in SPL search and extended to SPL2
|
||||
id: dabdd6d7-3e10-42be-8711-4e124f7a3850
|
||||
known_false_positives: Older systems that support kerberos RC4 by default NetApp may
|
||||
generate false positives
|
||||
name: Detect Kerberoasting
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- Initial ESCU implementation by Jose Hernandez and Patrick Bareiss
|
||||
risk_message: Kerberoasting malware is potentially applying stolen credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via command
|
||||
$cmd_line$
|
||||
search: ' | from read_ssa_enriched_events() | eval _time=map_get(input_event, "_time"),
|
||||
EventCode=map_get(input_event, "event_code"), TicketOptions=map_get(input_event,
|
||||
"ticket_options"), TicketEncryptionType=map_get(input_event, "ticket_encryption_type"),
|
||||
ServiceName=map_get(input_event, "service_name"), ServiceID=map_get(input_event,
|
||||
"service_id"), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
|
||||
event_id=ucast(map_get(input_event, "event_id"), "string", null) | where EventCode="4769"
|
||||
AND TicketOptions="0x40810000" AND TicketEncryptionType="0x17" | first_time_event
|
||||
input_columns=["EventCode","TicketOptions","TicketEncryptionType","ServiceName","ServiceID"]
|
||||
| where first_time_EventCode_TicketOptions_TicketEncryptionType_ServiceName_ServiceID
|
||||
| eval start_time=_time, end_time=_time | eval body=create_map(["event_id", event_id,
|
||||
"EventCode", EventCode, "ServiceName", ServiceName, "TicketOptions", TicketOptions,
|
||||
"TicketEncryptionType", TicketEncryptionType]), entities = mvappend(ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null)) | select start_time, end_time, entities, body | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Credential Dumping
|
||||
cis20:
|
||||
- CIS 8
|
||||
- CIS 16
|
||||
confidence: 20
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
impact: 70
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: Kerberoasting malware is potentially applying stolen credentials. Operation
|
||||
is performed at the device $dest_device_id$, by the account $dest_user_id$ via
|
||||
command $cmd_line$
|
||||
mitre_attack_id:
|
||||
- T1558.003
|
||||
- T1558
|
||||
nist:
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: cmd_line
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- service_name
|
||||
- _time
|
||||
- event_code
|
||||
- ticket_encryption_type
|
||||
- service_id
|
||||
- ticket_options
|
||||
risk_score: 14
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Detect Kerberoasting - SSA Unit test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
|
||||
file_name: windows-security.log
|
||||
source: WinEventLog:Security
|
||||
description: Test detection of kerberoasting
|
||||
file: endpoint/ssa___detect_kerberoasting.yml
|
||||
name: Detect kerberoasting
|
||||
pass_condition: '@count_eq(0)'
|
||||
type: TTP
|
||||
version: 2
|
||||
@@ -1,64 +0,0 @@
|
||||
author: Patrick Bareiss, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Filesystem
|
||||
date: '2021-12-07'
|
||||
description: This detection detects a high amount of office file copied. This can
|
||||
be an indicator for a malicious insider.
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
|
||||
id: 3c6594a9-8df6-45a1-9357-d73b62083c63
|
||||
known_false_positives: user may copy a lot of office fies from one folder to another
|
||||
name: Excessive Number of Office Files Copied
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
risk_message: High number of files copied
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string",
|
||||
null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event,
|
||||
"file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"),
|
||||
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
|
||||
| where "Endpoint_Filesystem" IN(_datamodels) | where action="created" | where like(file_name,
|
||||
"%.doc%") OR like(file_name, "%.xls%") OR like(file_name, "%.ppt%") | stats count(file_name)
|
||||
AS count BY dest_user_id, dest_device_id, span(timestamp, 10m) | where count > 20
|
||||
| eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id,
|
||||
dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story: []
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Exfitration
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: High number of files copied
|
||||
mitre_attack_id:
|
||||
- T1048.003
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- action
|
||||
- process
|
||||
- file_name
|
||||
- file_path
|
||||
risk_score: 72
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Excessive Number of Office Files Copied Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1048.003/mass_file_creation/windows-sysmon.log
|
||||
file_name: sysmon.log
|
||||
source: xmlwineventlog
|
||||
description: Test for Excessive Number of Office Files Copied
|
||||
file: endpoint/ssa___excessive_number_of_office_files_copied.yml
|
||||
name: Excessive Number of Office Files Copied
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: Anomaly
|
||||
version: 1
|
||||
@@ -1,89 +0,0 @@
|
||||
author: Ignacio Bermudez Corrales, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-30'
|
||||
description: This search looks for command-line arguments that use a `/c` parameter
|
||||
to execute a command that has not previously been seen. This is an implementation
|
||||
on SPL2 of the rule `First time seen command line argument` by @bpatel. 'The following
|
||||
analytic identifies first time seen command-line arguments on a single endpoint.
|
||||
The analytic looks for arguments instantiated by `cmd.exe /c` and the associated
|
||||
command-line. Adversaries automate or spawn multiple processes using this method,
|
||||
this analytic may assist with identifying the first time it's been found on this
|
||||
endpoint.'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting
|
||||
logs with the process name, parent process, and command-line executions from your
|
||||
endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the
|
||||
Sysmon TA.
|
||||
id: fc0edc95-ff2b-48b0-9f6f-63da3789fd23
|
||||
known_false_positives: Legitimate programs use command-line arguments to execute.
|
||||
Verify the command-line arguments to check what command/program is being executed.
|
||||
Filtering will be needed.
|
||||
name: First time seen command line argument
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
risk_message: A process $process_name$ ha been identified in the environment with
|
||||
a command-line $cmd_line$ not previously seen before on host $dest_device_id$
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval dest_user_id=ucast(map_get(input_event, "dest_user_id"),
|
||||
"string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string",
|
||||
null), process_name=ucast(map_get(input_event, "process_name"), "string", null),
|
||||
cmd_line=ucast(map_get(input_event, "process"), "string", null), cmd_line_norm=lower(cmd_line),
|
||||
cmd_line_norm=replace(cmd_line_norm, /[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}/,
|
||||
"GUID"), cmd_line_norm=replace(cmd_line_norm, /(?<=\s)+\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/,
|
||||
"\\PATH"), /* replaces " \\Something\\Something\\command.ext" => "PATH\\command.ext"
|
||||
*/ cmd_line_norm=replace(cmd_line_norm, /\w:\\[^:]*(?=\\.*\.\w{3}(\s|$)+)/, "\\PATH"),
|
||||
/* replaces "C:\\Something\\Something\\command.ext" => "PATH\\command.ext" */ cmd_line_norm=replace(cmd_line_norm,
|
||||
/\d+/, "N"), event_id=ucast(map_get(input_event, "event_id"), "string", null) |
|
||||
where process_name="cmd.exe" AND match_regex(ucast(cmd_line, "string", ""), /.*
|
||||
\/[cC] .*/)=true | select process_name, cmd_line, cmd_line_norm, timestamp, dest_device_id,
|
||||
dest_user_id | first_time_event input_columns=["cmd_line_norm"] | where first_time_cmd_line_norm
|
||||
| eval start_time = timestamp, end_time = timestamp, entities = mvappend(dest_device_id,
|
||||
dest_user_id), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
|
||||
process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 3
|
||||
- CIS 8
|
||||
confidence: 60
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Command and Control
|
||||
- Actions on Objectives
|
||||
message: A process $process_name$ ha been identified in the environment with a command-line
|
||||
$cmd_line$ not previously seen before on host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1059
|
||||
- T1202
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: user
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
- cmd_line
|
||||
risk_score: 30
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: Anomaly
|
||||
version: 4
|
||||
@@ -1,85 +0,0 @@
|
||||
author: Patrick Bareiss, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Filesystem
|
||||
date: '2021-12-07'
|
||||
description: This detection detects a high amount of file deletions in a short time
|
||||
for specific file types. This can be an indicator for a malicious insider.
|
||||
how_to_implement: To successfully implement this search you need to be ingesting information
|
||||
on process that include the name of the process responsible for the changes from
|
||||
your endpoints into the `Endpoint` datamodel in the `Filesytem` node.
|
||||
id: b6200efd-13bd-4336-920a-057b25bbcfaf
|
||||
known_false_positives: user may delete bunch of pictures or files in a folder.
|
||||
name: High File Deletion Frequency
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://www.fireeye.com/blog/threat-research/2020/10/fin11-email-campaigns-precursor-for-ransomware-data-theft.html
|
||||
- https://blog.virustotal.com/2020/11/keep-your-friends-close-keep-ransomware.html
|
||||
risk_message: High frequency file deletion activity detected on host $Computer$
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval action=ucast(map_get(input_event, "action"), "string",
|
||||
null), process=ucast(map_get(input_event, "process"), "string", null), file_name=ucast(map_get(input_event,
|
||||
"file_name"), "string", null), file_path=ucast(map_get(input_event, "file_path"),
|
||||
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null)
|
||||
| where "Endpoint_Filesystem" IN(_datamodels) | where action="deleted" | where like(file_name,
|
||||
"%.cmd") OR like(file_name, "%.ini") OR like(file_name, "%.gif") OR like(file_name,
|
||||
"%.jpg") OR like(file_name, "%.jpeg") OR like(file_name, "%.db") OR like(file_name,
|
||||
"%.doc%") OR like(file_name, "%.ps1") OR like(file_name, "%.xls%") OR like(file_name,
|
||||
"%.ppt%") OR like(file_name, "%.bmp") OR like(file_name, "%.zip") OR like(file_name,
|
||||
"%.rar") OR like(file_name, "%.7z") OR like(file_name, "%.chm") OR like(file_name,
|
||||
"%.png") OR like(file_name, "%.log") OR like(file_name, "%.vbs") OR like(file_name,
|
||||
"%.js") | stats count(file_name) AS count BY dest_user_id, dest_device_id, span(timestamp,
|
||||
10m) | where count > 20 | eval start_time=window_start, end_time=window_end, entities=mvappend(dest_user_id,
|
||||
dest_device_id), body=create_map(["count", count]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Clop Ransomware
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:Endpoint
|
||||
- Stage:Execution
|
||||
dataset:
|
||||
- https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log
|
||||
impact: 90
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: High frequency file deletion activity detected on host $Computer$
|
||||
mitre_attack_id:
|
||||
- T1485
|
||||
observable:
|
||||
- name: user
|
||||
role:
|
||||
- Victim
|
||||
type: User
|
||||
- name: Computer
|
||||
role:
|
||||
- Victim
|
||||
type: Endpoint
|
||||
- name: deleted_files
|
||||
role:
|
||||
- Target
|
||||
type: File Name
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- action
|
||||
- process
|
||||
- file_name
|
||||
- file_path
|
||||
risk_score: 72
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: High File Deletion Frequency Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/excessive_file_deletions/windows-sysmon.log
|
||||
file_name: sysmon.log
|
||||
source: xmlwineventlog
|
||||
description: Test for High File Deletion Frequency
|
||||
file: endpoint/ssa___high_file_deletion_frequency.yml
|
||||
name: High File Deletion Frequency
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: Anomaly
|
||||
version: 1
|
||||
-95
@@ -1,95 +0,0 @@
|
||||
author: Ignacio Bermudez Corrales, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-08-25'
|
||||
description: Attacker activity may compromise executing several LOLBAS applications
|
||||
in conjunction to accomplish their objectives. We are looking for more than usual
|
||||
LOLBAS applications over a window of time, by building profiles per machine.
|
||||
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
|
||||
id: 59c0dd70-169c-4900-9a1f-bfcf13302f93
|
||||
known_false_positives: 'Some administrative tasks may involve multiple use of LOLBAS
|
||||
applications in a short period of time. This might trigger false positives at the
|
||||
beginning when it hasn''t collected yet enough data to construct the baseline.
|
||||
|
||||
'
|
||||
name: More than usual number of LOLBAS applications in short time period
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
|
||||
risk_message: A system process $process_name$ with commandline $cmd_line$ spawn iin
|
||||
short period of time in host $dest_device_id$
|
||||
search: ' | from read_ssa_enriched_events() | eval device=ucast(map_get(input_event,
|
||||
"dest_device_id"), "string", null), process_name=lower(ucast(map_get(input_event,
|
||||
"process_name"), "string", null)), timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | where process_name=="regsvcs.exe" OR process_name=="ftp.exe"
|
||||
OR process_name=="dfsvc.exe" OR process_name=="rasautou.exe" OR process_name=="schtasks.exe"
|
||||
OR process_name=="xwizard.exe" OR process_name=="findstr.exe" OR process_name=="esentutl.exe"
|
||||
OR process_name=="cscript.exe" OR process_name=="reg.exe" OR process_name=="csc.exe"
|
||||
OR process_name=="atbroker.exe" OR process_name=="print.exe" OR process_name=="pcwrun.exe"
|
||||
OR process_name=="vbc.exe" OR process_name=="rpcping.exe" OR process_name=="wsreset.exe"
|
||||
OR process_name=="ilasm.exe" OR process_name=="certutil.exe" OR process_name=="replace.exe"
|
||||
OR process_name=="mshta.exe" OR process_name=="bitsadmin.exe" OR process_name=="wscript.exe"
|
||||
OR process_name=="ieexec.exe" OR process_name=="cmd.exe" OR process_name=="microsoft.workflow.compiler.exe"
|
||||
OR process_name=="runscripthelper.exe" OR process_name=="makecab.exe" OR process_name=="forfiles.exe"
|
||||
OR process_name=="desktopimgdownldr.exe" OR process_name=="control.exe" OR process_name=="msbuild.exe"
|
||||
OR process_name=="register-cimprovider.exe" OR process_name=="tttracer.exe" OR process_name=="ie4uinit.exe"
|
||||
OR process_name=="sc.exe" OR process_name=="bash.exe" OR process_name=="hh.exe"
|
||||
OR process_name=="cmstp.exe" OR process_name=="mmc.exe" OR process_name=="jsc.exe"
|
||||
OR process_name=="scriptrunner.exe" OR process_name=="odbcconf.exe" OR process_name=="extexport.exe"
|
||||
OR process_name=="msdt.exe" OR process_name=="diskshadow.exe" OR process_name=="extrac32.exe"
|
||||
OR process_name=="eventvwr.exe" OR process_name=="mavinject.exe" OR process_name=="regasm.exe"
|
||||
OR process_name=="gpscript.exe" OR process_name=="rundll32.exe" OR process_name=="regsvr32.exe"
|
||||
OR process_name=="regedit.exe" OR process_name=="msiexec.exe" OR process_name=="gfxdownloadwrapper.exe"
|
||||
OR process_name=="presentationhost.exe" OR process_name=="regini.exe" OR process_name=="wmic.exe"
|
||||
OR process_name=="runonce.exe" OR process_name=="syncappvpublishingserver.exe" OR
|
||||
process_name=="verclsid.exe" OR process_name=="psr.exe" OR process_name=="infdefaultinstall.exe"
|
||||
OR process_name=="explorer.exe" OR process_name=="expand.exe" OR process_name=="installutil.exe"
|
||||
OR process_name=="netsh.exe" OR process_name=="wab.exe" OR process_name=="dnscmd.exe"
|
||||
OR process_name=="at.exe" OR process_name=="pcalua.exe" OR process_name=="cmdkey.exe"
|
||||
OR process_name=="msconfig.exe" | stats count(process_name) as lolbas_counter by
|
||||
device,span(timestamp, 300s) | eval lolbas_counter=lolbas_counter*1.0 | rename window_end
|
||||
as timestamp | adaptive_threshold algorithm="quantile" value="lolbas_counter" entity="device"
|
||||
window=2419200000L | where label AND quantile>0.99 | eval start_time = window_start,
|
||||
end_time = timestamp, entities = mvappend(device), body=create_map(["lolbas_counter",
|
||||
lolbas_counter, "quantile", quantile, "device", device]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 50
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
impact: 50
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
message: A system process $process_name$ with commandline $cmd_line$ spawn iin short
|
||||
period of time in host $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1059
|
||||
- T1053
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: process_name
|
||||
role:
|
||||
- Others
|
||||
type: processname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- dest_device_id
|
||||
- _time
|
||||
- process_name
|
||||
risk_score: 25
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
type: Anomaly
|
||||
version: 2
|
||||
-102
@@ -1,102 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Authentication
|
||||
date: '2021-11-30'
|
||||
description: This detection identifies potential Pass the Token or Pass the Hash credential
|
||||
stealing. We detect the main side effect of these attacks, which is a transition
|
||||
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
|
||||
by a detination device.
|
||||
how_to_implement: You must be ingesting Windows Security logs from endpoint devices,
|
||||
i.e., destinations of interest. Please make sure that event ID 4624 is being logged.
|
||||
id: 82e76b80-5cdb-4899-9b43-85dbe777b36d
|
||||
known_false_positives: Environments in which NTLM is used extremely rarely and for
|
||||
benign purposes (such as a rare use of SMB shares).
|
||||
name: Potential Pass the Token or Hash Observed at the Destination Device
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1550/002/
|
||||
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
|
||||
risk_message: Potential lateral movement and credential stealing via Pass the Token
|
||||
or Pass the Hash techniques. Operation is performed via credentials of the account
|
||||
$dest_user_id$ and observed by the destination device $dest_device_id$
|
||||
search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
dest_user=lower(ucast(map_get(input_event, "dest_user_primary_artifact"), "string",
|
||||
null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string", null),
|
||||
dest_device_id= ucast(map_get(input_event, "dest_device_id"), "string", null),
|
||||
signature_id= lower(ucast(map_get(input_event, "signature_id"), "string", null)),
|
||||
authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
|
||||
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
|
||||
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
|
||||
AND dest_user_id != null AND dest_device_id != null
|
||||
|
||||
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
|
||||
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
|
||||
|
||||
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
|
||||
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
|
||||
endNTLMTime by dest_user_id, dest_user, dest_device_id, span(timestamp, 86400s)
|
||||
|
||||
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
|
||||
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
|
||||
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
|
||||
|
||||
| eval start_time=ucast(startNTLMTime, "long", null), end_time=ucast(endNTLMTime,
|
||||
"long", null), entities=mvappend(dest_user_id, dest_device_id), body=create_map(["event_id",
|
||||
event_id, "total_kerberos", totalKerberos, "total_ntlm", totalNtlm, "analysis_start_time",
|
||||
startTime, "analysis_end_time", endTime, "pth_start_time", startNTLMTime, "pth_end_time",
|
||||
endNTLMTime])
|
||||
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 90
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
- Stage:Lateral Movement
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Lateral Movement
|
||||
message: Potential lateral movement and credential stealing via Pass the Token or
|
||||
Pass the Hash techniques. Operation is performed via credentials of the account
|
||||
$dest_user_id$ and observed by the destination device $dest_device_id$
|
||||
mitre_attack_id:
|
||||
- T1550
|
||||
- T1550.002
|
||||
nist:
|
||||
- PR.PT
|
||||
- PR.AT
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Other
|
||||
type: Hostname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- signature_id
|
||||
- dest_user
|
||||
- dest_user_id
|
||||
- dest_device_id
|
||||
- authentication_method
|
||||
risk_score: 72
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 3
|
||||
Vendored
-103
@@ -1,103 +0,0 @@
|
||||
author: Stanislav Miskovic, Splunk
|
||||
datamodel:
|
||||
- Authentication
|
||||
date: '2021-11-05'
|
||||
description: This detection identifies potential Pass the Token or Pass the Hash credential
|
||||
stealing. We detect the main side effect of these attacks, which is a transition
|
||||
from the dominant Kerberos logins to rare NTLM logins for a given user, as reported
|
||||
by an event-collecting device (i.e., a specific domain controller or an endpoint
|
||||
destination).
|
||||
how_to_implement: You must be ingesting Windows Security logs from devices of interest
|
||||
- at least from domain controllers. Please make sure that event ID 4624 is being
|
||||
logged.
|
||||
id: 1058ba3e-a698-49bc-a1e5-7cedece4ea87
|
||||
known_false_positives: Environments in which NTLM is used extremely rarely and for
|
||||
benign purposes (such as a rare use of SMB shares).
|
||||
name: Potential Pass the Token or Hash Observed by an Event Collecting Device
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://attack.mitre.org/techniques/T1550/002/
|
||||
- https://www.offensive-security.com/metasploit-unleashed/psexec-pass-hash/
|
||||
risk_message: Potential lateral movement and credential stealing via Pass the Token
|
||||
or Pass the Hash techniques. Operation is performed via credentials of the account
|
||||
$dest_user_id$ and observed by the logging device $origin_device_id$
|
||||
search: '| from read_ssa_enriched_events() | where "Authentication" IN(_datamodels)
|
||||
|
||||
| eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null)),
|
||||
dest_user= lower(ucast(map_get(input_event, "dest_user_primary_artifact"),
|
||||
"string", null)), dest_user_id= ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), origin_device_id= ucast(map_get(input_event, "origin_device_id"), "string",
|
||||
null), signature_id= lower(ucast(map_get(input_event, "signature_id"), "string",
|
||||
null)), authentication_method= lower(ucast(map_get(input_event, "authentication_method"),
|
||||
"string", null)), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where signature_id = "4624" AND (authentication_method="ntlmssp" OR authentication_method="kerberos")
|
||||
AND dest_user_id != null AND origin_device_id != null
|
||||
|
||||
| eval isKerberos=if(authentication_method == "kerberos", 1, 0), isNtlm=if(authentication_method
|
||||
== "ntlmssp", 1, 0), timeNTLM=if(isNtlm > 0, timestamp, null)
|
||||
|
||||
| stats sum(isKerberos) as totalKerberos, sum(isNtlm) as totalNtlm, min(timestamp) as
|
||||
startTime, min(timeNTLM) as startNTLMTime, max(timestamp) as endTime, max(timeNTLM) as
|
||||
endNTLMTime by dest_user_id, dest_user, origin_device_id, span(timestamp, 86400s)
|
||||
|
||||
| where NOT dest_user="-" AND totalKerberos > 0 AND totalNtlm > 0 AND endTime -
|
||||
startTime > 1800000 AND (totalKerberos > 10 * totalNtlm AND totalKerberos > 50) AND
|
||||
(endTime - startTime) > 3 * (endNTLMTime - startNTLMTime)
|
||||
|
||||
| eval start_time=startNTLMTime, end_time=endNTLMTime, entities=mvappend(dest_user_id,
|
||||
origin_device_id), body=create_map(["event_id", event_id, "total_kerberos", totalKerberos,
|
||||
"total_ntlm", totalNtlm, "analysis_start_time", startTime, "analysis_end_time",
|
||||
endTime, "detection_start_time", startNTLMTime, "detection_end_time", endNTLMTime])
|
||||
|
||||
| into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Active Directory Lateral Movement
|
||||
asset_type: Windows
|
||||
cis20:
|
||||
- CIS 16
|
||||
- CIS 20
|
||||
confidence: 80
|
||||
context:
|
||||
- Source:AD
|
||||
- Source:Endpoint
|
||||
- Stage:Credential Access
|
||||
- Stage:Lateral Movement
|
||||
impact: 80
|
||||
kill_chain_phases:
|
||||
- Lateral Movement
|
||||
message: Potential lateral movement and credential stealing via Pass the Token or
|
||||
Pass the Hash techniques. Operation is performed via credentials of the account
|
||||
$dest_user_id$ and observed by the logging device $origin_device_id$
|
||||
mitre_attack_id:
|
||||
- T1550
|
||||
- T1550.002
|
||||
nist:
|
||||
- PR.PT
|
||||
- PR.AT
|
||||
- PR.AC
|
||||
- PR.IP
|
||||
observable:
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Actor
|
||||
type: User
|
||||
- name: origin_device_id
|
||||
role:
|
||||
- Other
|
||||
type: Hostname
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- _time
|
||||
- signature_id
|
||||
- dest_user
|
||||
- dest_user_id
|
||||
- origin_device_id
|
||||
- authentication_method
|
||||
risk_score: 64
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: TTP
|
||||
version: 2
|
||||
@@ -1,88 +0,0 @@
|
||||
author: Peter Gael, Splunk; Ignacio Bermudez Corrales, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2021-11-30'
|
||||
description: An attacker may use LOLBAS tools spawned from vulnerable applications
|
||||
not typically used by system administrators. This analytic leverages the Splunk
|
||||
Streaming ML DSP plugin to find rare parent/child relationships. The list of application
|
||||
has been extracted from https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
|
||||
how_to_implement: Collect endpoint data such as sysmon or 4688 events.
|
||||
id: cf090c78-bcc6-11eb-8529-0242ac130003
|
||||
known_false_positives: Some custom tools used by administrators could be used rarely
|
||||
to launch remotely applications. This might trigger false positives at the beginning
|
||||
when it has not collected yet enough data to construct the baseline.
|
||||
name: Rare Parent-Child Process Relationship
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references:
|
||||
- https://github.com/LOLBAS-Project/LOLBAS/tree/master/yml/OSBinaries
|
||||
search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval parent_process=lower(ucast(map_get(input_event,
|
||||
"parent_process_name"), "string", null)), parent_process_name=mvindex(split(parent_process,
|
||||
"\\"), -1), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
|
||||
null)), cmd_line=ucast(map_get(input_event, "process"), "string", null), dest_user_id=ucast(map_get(input_event,
|
||||
"dest_user_id"), "string", null), dest_device_id=ucast(map_get(input_event, "dest_device_id"),
|
||||
"string", null), event_id=ucast(map_get(input_event, "event_id"), "string", null)
|
||||
| where parent_process_name!=null | select parent_process_name, process_name, cmd_line,
|
||||
timestamp, dest_device_id, dest_user_id | conditional_anomaly conditional="parent_process_name"
|
||||
target="process_name" | where (process_name="powershell.exe" OR process_name="regsvcs.exe"
|
||||
OR process_name="ftp.exe" OR process_name="dfsvc.exe" OR process_name="rasautou.exe"
|
||||
OR process_name="schtasks.exe" OR process_name="xwizard.exe" OR process_name="findstr.exe"
|
||||
OR process_name="esentutl.exe" OR process_name="cscript.exe" OR process_name="reg.exe"
|
||||
OR process_name="csc.exe" OR process_name="atbroker.exe" OR process_name="print.exe"
|
||||
OR process_name="pcwrun.exe" OR process_name="vbc.exe" OR process_name="rpcping.exe"
|
||||
OR process_name="wsreset.exe" OR process_name="ilasm.exe" OR process_name="certutil.exe"
|
||||
OR process_name="replace.exe" OR process_name="mshta.exe" OR process_name="bitsadmin.exe"
|
||||
OR process_name="wscript.exe" OR process_name="ieexec.exe" OR process_name="cmd.exe"
|
||||
OR process_name="microsoft.workflow.compiler.exe" OR process_name="runscripthelper.exe"
|
||||
OR process_name="makecab.exe" OR process_name="forfiles.exe" OR process_name="desktopimgdownldr.exe"
|
||||
OR process_name="control.exe" OR process_name="msbuild.exe" OR process_name="register-cimprovider.exe"
|
||||
OR process_name="tttracer.exe" OR process_name="ie4uinit.exe" OR process_name="sc.exe"
|
||||
OR process_name="bash.exe" OR process_name="hh.exe" OR process_name="cmstp.exe"
|
||||
OR process_name="mmc.exe" OR process_name="jsc.exe" OR process_name="scriptrunner.exe"
|
||||
OR process_name="odbcconf.exe" OR process_name="extexport.exe" OR process_name="msdt.exe"
|
||||
OR process_name="diskshadow.exe" OR process_name="extrac32.exe" OR process_name="eventvwr.exe"
|
||||
OR process_name="mavinject.exe" OR process_name="regasm.exe" OR process_name="gpscript.exe"
|
||||
OR process_name="rundll32.exe" OR process_name="regsvr32.exe" OR process_name="regedit.exe"
|
||||
OR process_name="msiexec.exe" OR process_name="gfxdownloadwrapper.exe" OR process_name="presentationhost.exe"
|
||||
OR process_name="regini.exe" OR process_name="wmic.exe" OR process_name="runonce.exe"
|
||||
OR process_name="syncappvpublishingserver.exe" OR process_name="verclsid.exe" OR
|
||||
process_name="psr.exe" OR process_name="infdefaultinstall.exe" OR process_name="explorer.exe"
|
||||
OR process_name="expand.exe" OR process_name="installutil.exe" OR process_name="netsh.exe"
|
||||
OR process_name="wab.exe" OR process_name="dnscmd.exe" OR process_name="at.exe"
|
||||
OR process_name="pcalua.exe" OR process_name="cmdkey.exe" OR process_name="msconfig.exe")
|
||||
| eval input = (-1)*log(output) | adaptive_threshold algorithm="gaussian" threshold=0.001
|
||||
window=604800000L | where label AND input > mean | eval start_time = timestamp,
|
||||
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body =
|
||||
create_map(["process_name", process_name, "parent_process_name", parent_process_name,
|
||||
"input", input, "mean", mean, "variance", variance, "output", output, "cmd_line",
|
||||
cmd_line]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 8
|
||||
kill_chain_phases:
|
||||
- Exploitation
|
||||
mitre_attack_id:
|
||||
- T1203
|
||||
- T1059
|
||||
- T1053
|
||||
- T1072
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process
|
||||
- process_name
|
||||
- parent_process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- cmd_line
|
||||
risk_severity: low
|
||||
security_domain: endpoint
|
||||
type: Anomaly
|
||||
version: 2
|
||||
@@ -1,87 +0,0 @@
|
||||
author: Ignacio Bermudez Corrales, Splunk
|
||||
datamodel:
|
||||
- Endpoint_Processes
|
||||
date: '2020-10-06'
|
||||
description: Command lines that are extremely long may be indicative of malicious
|
||||
activity on your hosts. This search leverages the Splunk Streaming ML DSP plugin
|
||||
to help identify command lines with lengths that are unusual for a given user. This
|
||||
detection is inspired on Unusually Long Command Line authored by Rico Valdez.
|
||||
how_to_implement: You must be ingesting sysmon endpoint data that monitors command
|
||||
lines.
|
||||
id: 58f43aba-1775-445e-b19c-be2b87d83ae3
|
||||
known_false_positives: This detection may flag suspiciously long command lines when
|
||||
there is not sufficient evidence (samples) for a given process that this detection
|
||||
is tracking; or when there is high variability in the length of the command line
|
||||
for the tracked process. Also, some legitimate applications may use long command
|
||||
lines. Such is the case of Ansible, that encodes Powershell scripts using long base64.
|
||||
Attackers may use this technique to obfuscate their payloads.
|
||||
name: Unusually Long Command Line
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
references: []
|
||||
risk_message: A process $process_name$ with a long commandline $cmd_line$ executed
|
||||
in host $dest_device_id$
|
||||
search: ' | from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,
|
||||
"_time"), "string", null)) | eval cmd_line=ucast(map_get(input_event, "process"),
|
||||
"string", null), dest_user_id=ucast(map_get(input_event, "dest_user_id"), "string",
|
||||
null), dest_device_id=ucast(map_get(input_event, "dest_device_id"), "string", null),
|
||||
process_name=ucast(map_get(input_event, "process_name"), "string", null), event_id=ucast(map_get(input_event,
|
||||
"event_id"), "string", null) | where cmd_line!=null and dest_user_id!=null | eval
|
||||
cmd_line_norm=replace(cast(cmd_line, "string"), /\s(--?\w+)|(\/\w+)/, " ARG"), cmd_line_norm=replace(cmd_line_norm,
|
||||
/\w:\\[^\s]+/, "PATH"), cmd_line_norm=replace(cmd_line_norm, /\d+/, "N"), input=parse_double(len(coalesce(cmd_line_norm,
|
||||
""))) | select timestamp, process_name, dest_device_id, dest_user_id, cmd_line,
|
||||
input | adaptive_threshold algorithm="quantile" entity="process_name" window=60480000
|
||||
| where label AND quantile>0.99 | first_time_event input_columns=["dest_device_id",
|
||||
"cmd_line"] | where first_time_dest_device_id_cmd_line | eval start_time = timestamp,
|
||||
end_time = timestamp, entities = mvappend(dest_device_id, dest_user_id), body=create_map(["event_id",
|
||||
event_id, "cmd_line", cmd_line, "process_name", process_name]) | into write_ssa_detected_events();'
|
||||
tags:
|
||||
analytic_story:
|
||||
- Unusual Processes
|
||||
cis20:
|
||||
- CIS 8
|
||||
confidence: 40
|
||||
context:
|
||||
- source:endpoint
|
||||
- stage: Defense Evasion
|
||||
impact: 30
|
||||
kill_chain_phases:
|
||||
- Actions on Objectives
|
||||
message: A process $process_name$ with a long commandline $cmd_line$ executed in
|
||||
host $dest_device_id$
|
||||
nist:
|
||||
- PR.PT
|
||||
- DE.CM
|
||||
observable:
|
||||
- name: dest_device_id
|
||||
role:
|
||||
- Victim
|
||||
type: Hostname
|
||||
- name: dest_user_id
|
||||
role:
|
||||
- Victim
|
||||
type: user
|
||||
product:
|
||||
- Splunk Behavioral Analytics
|
||||
required_fields:
|
||||
- process_name
|
||||
- _time
|
||||
- dest_device_id
|
||||
- dest_user_id
|
||||
- process
|
||||
risk_score: 12
|
||||
risk_severity: medium
|
||||
security_domain: endpoint
|
||||
test:
|
||||
name: Unusually Long Command Line - SSA Unit Test
|
||||
tests:
|
||||
- attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/unusally_cmd_line/windows-security.log
|
||||
file_name: windows-security.log
|
||||
source: WinEventLog:Security
|
||||
description: Test unusually long command lines
|
||||
file: endpoint/ssa___unusually_long_command_line.yml
|
||||
name: Unusually Long Command Line
|
||||
pass_condition: '@count_gt(0)'
|
||||
type: Anomaly
|
||||
version: 1
|
||||
Reference in New Issue
Block a user