diff --git a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml index 6025bbdde9..402a9f2174 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_infrastructure_api_calls.yml @@ -60,10 +60,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.command + - Change.All_Changes.status + - Change.All_Changes.user - _time - - All_Changes.command - - All_Changes.user - - All_Changes.status risk_score: 15 security_domain: network supported_tas: diff --git a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml index 30100483c7..2ee081faff 100644 --- a/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml +++ b/detections/cloud/abnormally_high_number_of_cloud_security_group_api_calls.yml @@ -5,21 +5,21 @@ date: '2020-09-07' author: David Dorsey, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search will detect a spike in the number of API calls made to your cloud infrastructure environment about security groups by a user. search: '| tstats count as security_group_api_calls values(All_Changes.command) as - command from datamodel=Change.All_Changes where All_Changes.object_category=firewall AND All_Changes.status=success - by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` | eval - HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval DayOfWeek=strftime(_time, - "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek <= 5, 0, 1) | join user HourOfDay - isWeekend [ summary cloud_excessive_security_group_api_calls_v1] | where cardinality - >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 | rename - "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 | eval expected_upper_threshold - = mvindex(split(mvindex(BoundaryRanges, -1), ":"), 0) | where security_group_api_calls - > expected_upper_threshold | eval distance_from_threshold = security_group_api_calls - - expected_upper_threshold | table _time, user, command, security_group_api_calls, - expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`' + command from datamodel=Change.All_Changes where All_Changes.object_category=firewall + AND All_Changes.status=success by All_Changes.user _time span=1h | `drop_dm_object_name("All_Changes")` + | eval HourOfDay=strftime(_time, "%H") | eval HourOfDay=floor(HourOfDay/4)*4 | eval + DayOfWeek=strftime(_time, "%w") | eval isWeekend=if(DayOfWeek >= 1 AND DayOfWeek + <= 5, 0, 1) | join user HourOfDay isWeekend [ summary cloud_excessive_security_group_api_calls_v1] + | where cardinality >=16 | apply cloud_excessive_security_group_api_calls_v1 threshold=0.005 + | rename "IsOutlier(security_group_api_calls)" as isOutlier | where isOutlier=1 + | eval expected_upper_threshold = mvindex(split(mvindex(BoundaryRanges, -1), ":"), + 0) | where security_group_api_calls > expected_upper_threshold | eval distance_from_threshold + = security_group_api_calls - expected_upper_threshold | table _time, user, command, + security_group_api_calls, expected_upper_threshold, distance_from_threshold | `abnormally_high_number_of_cloud_security_group_api_calls_filter`' how_to_implement: You must be ingesting your cloud infrastructure logs. You also must run the baseline search `Baseline Of Cloud Security Group API Calls Per User` to create the probability density function model. @@ -65,11 +65,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.command + - Change.All_Changes.object_category + - Change.All_Changes.status + - Change.All_Changes.user - _time - - All_Changes.command - - All_Changes.object_category - - All_Changes.status - - All_Changes.user risk_score: 15 security_domain: network supported_tas: diff --git a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml index 931bf81982..c96b4df089 100644 --- a/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml +++ b/detections/cloud/aws_create_policy_version_to_allow_all_resources.yml @@ -63,9 +63,8 @@ tags: - Splunk Cloud required_fields: - _time + - errorCode - eventName - userAgent - - errorCode - - requestParameters.userName risk_score: 49 security_domain: network diff --git a/detections/cloud/aws_createaccesskey.yml b/detections/cloud/aws_createaccesskey.yml index b0a79677d4..4e3e4e131b 100644 --- a/detections/cloud/aws_createaccesskey.yml +++ b/detections/cloud/aws_createaccesskey.yml @@ -9,16 +9,12 @@ description: This search looks for AWS CloudTrail events where a user A who has permission to create access keys, makes an API call to create access keys for another user B. Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com errorCode = success - | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0) - | search match=0 - | stats - count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName - src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.principalId - user_arn - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - |`aws_createaccesskey_filter`' +search: '`cloudtrail` eventName = CreateAccessKey userAgent !=console.amazonaws.com + errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName),1,0) + | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime by + requestParameters.userName src eventName eventSource aws_account_id errorCode userAgent + eventID awsRegion userIdentity.principalId user_arn | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` |`aws_createaccesskey_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible @@ -69,9 +65,8 @@ tags: - Splunk Cloud required_fields: - _time + - errorCode - eventName - userAgent - - errorCode - - requestParameters.userName risk_score: 63 security_domain: network diff --git a/detections/cloud/aws_createloginprofile.yml b/detections/cloud/aws_createloginprofile.yml index 5a203a77d8..f634bb8135 100644 --- a/detections/cloud/aws_createloginprofile.yml +++ b/detections/cloud/aws_createloginprofile.yml @@ -67,9 +67,8 @@ tags: - Splunk Cloud required_fields: - _time + - errorCode - eventName - userAgent - - errorCode - - requestParameters.userName risk_score: 72 security_domain: network diff --git a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml index 677fc3cbd7..b6465ac9ea 100644 --- a/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml +++ b/detections/cloud/aws_cross_account_activity_from_previously_unseen_account.yml @@ -5,7 +5,7 @@ date: '2020-05-28' author: Rico Valdez, Splunk type: Anomaly datamodel: -- Authentication +- Authentication.Authentication description: This search looks for AssumeRole events where an IAM role in a different account is requested for the first time. search: '| tstats min(_time) as firstTime max(_time) as lastTime from datamodel=Authentication.Authentication @@ -68,11 +68,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Authentication.Authentication.signature + - Authentication.Authentication.src + - Authentication.Authentication.user + - Authentication.Authentication.user_role + - Authentication.Authentication.vendor_account - _time - - Authentication.signature - - Authentication.vendor_account - - Authentication.user - - Authentication.user_role - - Authentication.src risk_score: 15 security_domain: network diff --git a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml index 170a48597e..fc1585a97a 100644 --- a/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml +++ b/detections/cloud/aws_detect_users_creating_keys_with_encrypt_policy_without_mfa.yml @@ -55,11 +55,9 @@ tags: - Splunk Cloud required_fields: - _time + - awsRegion + - eventID - eventName - eventSource - - eventID - - awsRegion - - requestParameters.policy - - userIdentity.principalId risk_score: 25 security_domain: threat diff --git a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml index c77f2d28d6..f9f17d7bf8 100644 --- a/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml +++ b/detections/cloud/aws_detect_users_with_kms_keys_performing_encryption_s3.yml @@ -55,11 +55,7 @@ tags: required_fields: - _time - eventName - - requestParameters.x-amz-server-side-encryption - - requestParameters.bucketName - - requestParameters.x-amz-copy-source - - requestParameters.key - - userAgent - region + - userAgent risk_score: 15 security_domain: threat diff --git a/detections/cloud/aws_ecr_container_scanning_findings_high.yml b/detections/cloud/aws_ecr_container_scanning_findings_high.yml index 87d84d5761..2d44e34c86 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_high.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_high.yml @@ -55,14 +55,11 @@ tags: - Splunk Cloud - Dev Sec Ops Analytics required_fields: - - eventSource - - eventName - - responseElements.imageScanFindings.findings{} - awsRegion - - requestParameters.imageId.imageDigest - - requestParameters.repositoryName + - eventName + - eventSource + - src_ip - user - userName - - src_ip risk_score: 70 security_domain: network diff --git a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml index 323d73cd38..fd60926050 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_low_informational_unknown.yml @@ -54,14 +54,11 @@ tags: - Splunk Cloud - Dev Sec Ops Analytics required_fields: - - eventSource - - eventName - - responseElements.imageScanFindings.findings{} - awsRegion - - requestParameters.imageId.imageDigest - - requestParameters.repositoryName + - eventName + - eventSource + - src_ip - user - userName - - src_ip risk_score: 7 security_domain: network diff --git a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml index caa5ed111f..802cc204a5 100644 --- a/detections/cloud/aws_ecr_container_scanning_findings_medium.yml +++ b/detections/cloud/aws_ecr_container_scanning_findings_medium.yml @@ -53,14 +53,11 @@ tags: - Splunk Cloud - Dev Sec Ops Analytics required_fields: - - eventSource - - eventName - - responseElements.imageScanFindings.findings{} - awsRegion - - requestParameters.imageId.imageDigest - - requestParameters.repositoryName + - eventName + - eventSource + - src_ip - user - userName - - src_ip risk_score: 21 security_domain: network diff --git a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml index 16e9d78c38..c9df1597d1 100644 --- a/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml +++ b/detections/cloud/aws_ecr_container_upload_outside_business_hours.yml @@ -55,14 +55,11 @@ tags: - Splunk Cloud - Dev Sec Ops Analytics required_fields: - - eventSource - - eventName - awsRegion - - requestParameters.imageTag - - requestParameters.registryId - - requestParameters.repositoryName + - eventName + - eventSource + - src_ip - user - userName - - src_ip risk_score: 49 security_domain: network diff --git a/detections/cloud/aws_ecr_container_upload_unknown_user.yml b/detections/cloud/aws_ecr_container_upload_unknown_user.yml index 11a89ff300..e84b281fd9 100644 --- a/detections/cloud/aws_ecr_container_upload_unknown_user.yml +++ b/detections/cloud/aws_ecr_container_upload_unknown_user.yml @@ -55,14 +55,11 @@ tags: - Splunk Cloud - Dev Sec Ops Analytics required_fields: - - eventSource - - eventName - awsRegion - - requestParameters.imageTag - - requestParameters.registryId - - requestParameters.repositoryName + - eventName + - eventSource + - src_ip - user - userName - - src_ip risk_score: 49 security_domain: network diff --git a/detections/cloud/aws_excessive_security_scanning.yml b/detections/cloud/aws_excessive_security_scanning.yml index 690360f6f2..5726014cc5 100644 --- a/detections/cloud/aws_excessive_security_scanning.yml +++ b/detections/cloud/aws_excessive_security_scanning.yml @@ -62,9 +62,8 @@ tags: - _time - eventName - src - - userAgent - user - - userIdentity.arn + - userAgent risk_object: src risk_object_type: system risk_score: 18 diff --git a/detections/cloud/aws_iam_accessdenied_discovery_events.yml b/detections/cloud/aws_iam_accessdenied_discovery_events.yml index fce7e3c4ed..684b0a2f7d 100644 --- a/detections/cloud/aws_iam_accessdenied_discovery_events.yml +++ b/detections/cloud/aws_iam_accessdenied_discovery_events.yml @@ -56,11 +56,10 @@ tags: - Splunk Security Analytics for AWS required_fields: - _time + - errorCode - eventName - eventSource - userAgent - - errorCode - - userIdentity.type risk_object: src_ip risk_object_type: system risk_score: 10 diff --git a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml index 10c379a951..f65d9bf2fd 100644 --- a/detections/cloud/aws_iam_assume_role_policy_brute_force.yml +++ b/detections/cloud/aws_iam_assume_role_policy_brute_force.yml @@ -63,9 +63,8 @@ tags: - Splunk Security Analytics for AWS required_fields: - _time + - errorCode - eventName - userAgent - - errorCode - - requestParameters.policyName risk_score: 28 security_domain: access diff --git a/detections/cloud/aws_iam_delete_policy.yml b/detections/cloud/aws_iam_delete_policy.yml index 88f7e99926..a660da48aa 100644 --- a/detections/cloud/aws_iam_delete_policy.yml +++ b/detections/cloud/aws_iam_delete_policy.yml @@ -60,9 +60,8 @@ tags: - Splunk Security Analytics for AWS required_fields: - _time + - errorCode - eventName - userAgent - - errorCode - - requestParameters.policyArn risk_score: 10 security_domain: access diff --git a/detections/cloud/aws_iam_failure_group_deletion.yml b/detections/cloud/aws_iam_failure_group_deletion.yml index efbceee4a2..1d1c542886 100644 --- a/detections/cloud/aws_iam_failure_group_deletion.yml +++ b/detections/cloud/aws_iam_failure_group_deletion.yml @@ -63,9 +63,8 @@ tags: - Splunk Security Analytics for AWS required_fields: - _time + - errorCode - eventName - userAgent - - errorCode - - requestParameters.groupName risk_score: 5 security_domain: cloud diff --git a/detections/cloud/aws_iam_successful_group_deletion.yml b/detections/cloud/aws_iam_successful_group_deletion.yml index c39a47fc4d..1151093bf2 100644 --- a/detections/cloud/aws_iam_successful_group_deletion.yml +++ b/detections/cloud/aws_iam_successful_group_deletion.yml @@ -63,9 +63,8 @@ tags: - Splunk Security Analytics for AWS required_fields: - _time + - errorCode - eventName - userAgent - - errorCode - - requestParameters.groupName risk_score: 5 security_domain: cloud diff --git a/detections/cloud/aws_lambda_updatefunctioncode.yml b/detections/cloud/aws_lambda_updatefunctioncode.yml index af5ab9bcdd..e66938e559 100644 --- a/detections/cloud/aws_lambda_updatefunctioncode.yml +++ b/detections/cloud/aws_lambda_updatefunctioncode.yml @@ -61,8 +61,7 @@ tags: - Splunk Cloud required_fields: - _time - - eventName - - userAgent - errorCode + - eventName risk_score: 63 security_domain: cloud diff --git a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml index 028c55621a..68831ab3fc 100644 --- a/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml +++ b/detections/cloud/aws_network_access_control_list_created_with_all_open_ports.yml @@ -71,14 +71,7 @@ tags: required_fields: - _time - eventName - - requestParameters.ruleAction - - requestParameters.egress - - requestParameters.aclProtocol - - requestParameters.portRange.to - - requestParameters.portRange.from - - requestParameters.cidrBlock - - userName - - userIdentity.principalId - userAgent + - userName risk_score: 48 security_domain: network diff --git a/detections/cloud/aws_network_access_control_list_deleted.yml b/detections/cloud/aws_network_access_control_list_deleted.yml index 5a09c419bf..87e690e8e6 100644 --- a/detections/cloud/aws_network_access_control_list_deleted.yml +++ b/detections/cloud/aws_network_access_control_list_deleted.yml @@ -62,10 +62,8 @@ tags: required_fields: - _time - eventName - - requestParameters.egress - - userName - - userIdentity.principalId - src - userAgent + - userName risk_score: 5 security_domain: network diff --git a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml index 0610fb3962..d97a41e36f 100644 --- a/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml +++ b/detections/cloud/aws_saml_access_by_provider_user_and_principal.yml @@ -63,11 +63,7 @@ tags: required_fields: - _time - eventName - - requestParameters.principalArn - - requestParameters.roleArn - - requestParameters.roleSessionName - recipientAccountId - - responseElements.issuer - sourceIPAddress - userAgent risk_score: 64 diff --git a/detections/cloud/aws_saml_update_identity_provider.yml b/detections/cloud/aws_saml_update_identity_provider.yml index b9f00c6653..d08e2e54a5 100644 --- a/detections/cloud/aws_saml_update_identity_provider.yml +++ b/detections/cloud/aws_saml_update_identity_provider.yml @@ -59,10 +59,6 @@ tags: - _time - eventName - eventType - - requestParameters.sAMLProviderArn - - userIdentity.sessionContext.sessionIssuer.arn - sourceIPAddress - - userIdentity.accessKeyId - - userIdentity.principalId risk_score: 64 security_domain: threat diff --git a/detections/cloud/aws_setdefaultpolicyversion.yml b/detections/cloud/aws_setdefaultpolicyversion.yml index 6f90e57391..5981e95073 100644 --- a/detections/cloud/aws_setdefaultpolicyversion.yml +++ b/detections/cloud/aws_setdefaultpolicyversion.yml @@ -66,10 +66,9 @@ tags: - Splunk Cloud required_fields: - _time - - eventName - - userAgent - errorCode - - requestParameters.userName + - eventName - eventSource + - userAgent risk_score: 30 security_domain: threat diff --git a/detections/cloud/aws_updateloginprofile.yml b/detections/cloud/aws_updateloginprofile.yml index bb8525ded2..a08579f14d 100644 --- a/detections/cloud/aws_updateloginprofile.yml +++ b/detections/cloud/aws_updateloginprofile.yml @@ -9,16 +9,12 @@ description: This search looks for AWS CloudTrail events where a user A who has permission to update login profile, makes an API call to update login profile for another user B . Attackers have been know to use this technique for Privilege Escalation in case new victim(user B) has more permissions than old victim(user B) -search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com errorCode = success - | eval match=if(match(userIdentity.userName,requestParameters.userName), 1,0) - | search match=0 - | stats - count min(_time) as firstTime max(_time) as lastTime by requestParameters.userName - src eventName eventSource aws_account_id errorCode userAgent eventID awsRegion userIdentity.userName - user_arn - | `security_content_ctime(firstTime)` - | `security_content_ctime(lastTime)` - | `aws_updateloginprofile_filter`' +search: ' `cloudtrail` eventName = UpdateLoginProfile userAgent !=console.amazonaws.com + errorCode = success | eval match=if(match(userIdentity.userName,requestParameters.userName), + 1,0) | search match=0 | stats count min(_time) as firstTime max(_time) as lastTime + by requestParameters.userName src eventName eventSource aws_account_id errorCode + userAgent eventID awsRegion userIdentity.userName user_arn | `security_content_ctime(firstTime)` + | `security_content_ctime(lastTime)` | `aws_updateloginprofile_filter`' how_to_implement: You must install splunk AWS add on and Splunk App for AWS. This search works with AWS CloudTrail logs. known_false_positives: While this search has no known false positives, it is possible @@ -65,9 +61,8 @@ tags: - Splunk Cloud required_fields: - _time + - errorCode - eventName - userAgent - - errorCode - - requestParameters.userName risk_score: 30 security_domain: threat diff --git a/detections/cloud/circle_ci_disable_security_job.yml b/detections/cloud/circle_ci_disable_security_job.yml index 53814e0f32..cd9eef026d 100644 --- a/detections/cloud/circle_ci_disable_security_job.yml +++ b/detections/cloud/circle_ci_disable_security_job.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud - Dev Sec Ops Analytics - required_fields: - - _times + required_fields: [] risk_score: 72 security_domain: network diff --git a/detections/cloud/circle_ci_disable_security_step.yml b/detections/cloud/circle_ci_disable_security_step.yml index 38af4b677a..de6eec9a16 100644 --- a/detections/cloud/circle_ci_disable_security_step.yml +++ b/detections/cloud/circle_ci_disable_security_step.yml @@ -47,7 +47,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud - Dev Sec Ops Analytics - required_fields: - - _times + required_fields: [] risk_score: 72 security_domain: network diff --git a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml index b8ec68216c..c527c1593d 100644 --- a/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml +++ b/detections/cloud/cloud_api_calls_from_previously_unseen_user_roles.yml @@ -5,7 +5,7 @@ date: '2020-09-04' author: David Dorsey, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for new commands from each user role. search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime from datamodel=Change.All_Changes where All_Changes.user_type=AssumedRole AND All_Changes.status=success by All_Changes.user, @@ -60,12 +60,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.command + - Change.All_Changes.object + - Change.All_Changes.status + - Change.All_Changes.user + - Change.All_Changes.user_type - _time - - All_Changes.user - - All_Changes.user_type - - All_Changes.status - - All_Changes.command - - All_Changes.object risk_score: 36 security_domain: threat supported_tas: diff --git a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml index 6caa388503..401c02cac1 100644 --- a/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml +++ b/detections/cloud/cloud_compute_instance_created_by_previously_unseen_user.yml @@ -5,7 +5,7 @@ date: '2021-07-13' author: Rico Valdez, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud compute instances created by users who have not created them before. search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, @@ -62,11 +62,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.action + - Change.All_Changes.object + - Change.All_Changes.user + - Change.All_Changes.vendor_region - _time - - All_Changes.object - - All_Changes.action - - All_Changes.user - - All_Changes.vendor_region risk_score: 18 security_domain: threat supported_tas: diff --git a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml index c963597bcb..eb374abef1 100644 --- a/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml +++ b/detections/cloud/cloud_compute_instance_created_in_previously_unused_region.yml @@ -5,18 +5,18 @@ date: '2020-09-02' author: David Dorsey, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks at cloud-infrastructure events where an instance is created in any region within the last hour and then compares it to a lookup file of previously seen regions where instances have been created. search: '| tstats earliest(_time) as firstTime latest(_time) as lastTime values(All_Changes.object_id) - as dest, count from datamodel=Change.All_Changes where All_Changes.action=created by All_Changes.vendor_region, - All_Changes.user | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_regions - vendor_region as vendor_region OUTPUTNEW firstTimeSeen, enough_data | eventstats - max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) - | where isnull(firstTimeSeenRegion) OR firstTimeSeenRegion > relative_time(now(), - "-24h@h") | table firstTime, user, dest, count , vendor_region | `security_content_ctime(firstTime)` - | `cloud_compute_instance_created_in_previously_unused_region_filter`' + as dest, count from datamodel=Change.All_Changes where All_Changes.action=created + by All_Changes.vendor_region, All_Changes.user | `drop_dm_object_name("All_Changes")` + | lookup previously_seen_cloud_regions vendor_region as vendor_region OUTPUTNEW + firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where + enough_data=1 | eval firstTimeSeenRegion=min(firstTimeSeen) | where isnull(firstTimeSeenRegion) + OR firstTimeSeenRegion > relative_time(now(), "-24h@h") | table firstTime, user, + dest, count , vendor_region | `security_content_ctime(firstTime)` | `cloud_compute_instance_created_in_previously_unused_region_filter`' how_to_implement: You must be ingesting your cloud infrastructure logs from your cloud provider. You should run the baseline search `Previously Seen Cloud Regions - Initial` to build the initial table of images observed and times. You must also enable the @@ -67,11 +67,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.action + - Change.All_Changes.object_id + - Change.All_Changes.user + - Change.All_Changes.vendor_region - _time - - All_Changes.object_id - - All_Changes.action - - All_Changes.vendor_region - - All_Changes.user risk_score: 42 security_domain: threat supported_tas: diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml index 5b4851a0ae..16c81db993 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_image.yml @@ -4,8 +4,7 @@ version: 1 date: '2018-10-12' author: David Dorsey, Splunk type: Anomaly -datamodel: -- Change +datamodel: [] description: This search looks for cloud compute instances being created with previously unseen image IDs. search: '| tstats count earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) @@ -63,10 +62,6 @@ tags: - Splunk Cloud required_fields: - _time - - All_Changes.object_id - - All_Changes.action - - All_Changes.Instance_Changes.image_id - - All_Changes.user risk_score: 36 security_domain: threat supported_tas: diff --git a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml index 1498019242..f84b8965a7 100644 --- a/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml +++ b/detections/cloud/cloud_compute_instance_created_with_previously_unseen_instance_type.yml @@ -4,8 +4,7 @@ version: 1 date: '2020-09-12' author: David Dorsey, Splunk type: Anomaly -datamodel: -- Change +datamodel: [] description: Find EC2 instances being created with previously unseen instance types. search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime values(All_Changes.object_id) as dest, count from datamodel=Change where All_Changes.action=created by All_Changes.Instance_Changes.instance_type, @@ -63,10 +62,6 @@ tags: - Splunk Cloud required_fields: - _time - - All_Changes.object_id - - All_Changes.action - - All_Changes.Instance_Changes.instance_type - - All_Changes.user risk_score: 30 security_domain: threat supported_tas: diff --git a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml index 5bf2246bf0..64a28f125c 100644 --- a/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml +++ b/detections/cloud/cloud_instance_modified_with_previously_unseen_user.yml @@ -5,7 +5,7 @@ date: '2020-07-29' author: Rico Valdez, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud instances being modified by users who have not previously modified them. search: '| tstats `security_content_summariesonly` count earliest(_time) as firstTime, @@ -62,13 +62,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.action + - Change.All_Changes.change_type + - Change.All_Changes.command + - Change.All_Changes.object_id + - Change.All_Changes.status + - Change.All_Changes.user - _time - - All_Changes.object_id - - All_Changes.command - - All_Changes.action - - All_Changes.change_type - - All_Changes.status - - All_Changes.user risk_score: 42 security_domain: threat supported_tas: diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml index 0cf7d9894d..5d8602e23a 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_city.yml @@ -5,7 +5,7 @@ date: '2020-10-09' author: Rico Valdez, Bhavin Patel, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud provisioning activities from previously unseen cities. Provisioning activities are defined broadly as any event that runs or creates something. @@ -81,13 +81,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.action + - Change.All_Changes.command + - Change.All_Changes.object + - Change.All_Changes.src + - Change.All_Changes.status + - Change.All_Changes.user - _time - - All_Changes.action - - All_Changes.status - - All_Changes.src - - All_Changes.user - - All_Changes.object - - All_Changes.command risk_score: 18 security_domain: threat supported_tas: diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml index dbb77c2335..e557d6ba57 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_country.yml @@ -5,7 +5,7 @@ date: '2020-10-09' author: Rico Valdez, Bhavin Patel, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud provisioning activities from previously unseen countries. Provisioning activities are defined broadly as any event that runs or creates something. @@ -81,13 +81,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.action + - Change.All_Changes.command + - Change.All_Changes.object + - Change.All_Changes.src + - Change.All_Changes.status + - Change.All_Changes.user - _time - - All_Changes.action - - All_Changes.status - - All_Changes.src - - All_Changes.user - - All_Changes.object - - All_Changes.command risk_score: 42 security_domain: threat supported_tas: diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml index 5c86c14cb0..96fe8ed2f5 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_ip_address.yml @@ -5,14 +5,14 @@ date: '2020-08-16' author: Rico Valdez, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud provisioning activities from previously unseen IP addresses. Provisioning activities are defined broadly as any event that runs or creates something. search: '| tstats earliest(_time) as firstTime, latest(_time) as lastTime, values(All_Changes.object_id) - as object_id from datamodel=Change.All_Changes where (All_Changes.action=started OR All_Changes.action=created) - All_Changes.status=success by All_Changes.src, All_Changes.user, All_Changes.command - | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources + as object_id from datamodel=Change.All_Changes where (All_Changes.action=started + OR All_Changes.action=created) All_Changes.status=success by All_Changes.src, All_Changes.user, + All_Changes.command | `drop_dm_object_name("All_Changes")` | lookup previously_seen_cloud_provisioning_activity_sources src as src OUTPUT firstTimeSeen, enough_data | eventstats max(enough_data) as enough_data | where enough_data=1 | eval firstTimeSeenSrc=min(firstTimeSeen) | where isnull(firstTimeSeenSrc) OR firstTimeSeenSrc > relative_time(now(), `previously_unseen_cloud_provisioning_activity_window`) @@ -80,13 +80,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.action + - Change.All_Changes.command + - Change.All_Changes.object_id + - Change.All_Changes.src + - Change.All_Changes.status + - Change.All_Changes.user - _time - - All_Changes.object_id - - All_Changes.action - - All_Changes.status - - All_Changes.src - - All_Changes.user - - All_Changes.command risk_score: 42 security_domain: threat supported_tas: diff --git a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml index 48456c0769..ffaa76a33a 100644 --- a/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml +++ b/detections/cloud/cloud_provisioning_from_previously_unseen_region.yml @@ -5,7 +5,7 @@ date: '2020-08-16' author: Rico Valdez, Bhavin Patel, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search looks for cloud provisioning activities from previously unseen regions. Provisioning activities are defined broadly as any event that runs or creates something. @@ -81,13 +81,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.action + - Change.All_Changes.command + - Change.All_Changes.object + - Change.All_Changes.src + - Change.All_Changes.status + - Change.All_Changes.user - _time - - All_Changes.action - - All_Changes.status - - All_Changes.src - - All_Changes.user - - All_Changes.object - - All_Changes.command risk_score: 42 security_domain: threat supported_tas: diff --git a/detections/cloud/detect_aws_console_login_by_new_user.yml b/detections/cloud/detect_aws_console_login_by_new_user.yml index b3f286b339..3c8f045e3d 100644 --- a/detections/cloud/detect_aws_console_login_by_new_user.yml +++ b/detections/cloud/detect_aws_console_login_by_new_user.yml @@ -5,7 +5,7 @@ date: '2020-05-28' author: Rico Valdez, Splunk type: Hunting datamodel: -- Authentication +- Authentication.Authentication description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. @@ -62,8 +62,8 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Authentication.Authentication.signature + - Authentication.Authentication.user - _time - - Authentication.signature - - Authentication.user risk_score: 30 security_domain: threat diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml index e1604415d7..6baaa7ce05 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_city.yml @@ -5,7 +5,7 @@ date: '2020-10-07' author: Bhavin Patel, Splunk type: Hunting datamodel: -- Authentication +- Authentication.Authentication description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. @@ -71,9 +71,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Authentication.Authentication.signature + - Authentication.Authentication.src + - Authentication.Authentication.user - _time - - Authentication.signature - - Authentication.user - - Authentication.src risk_score: 18 security_domain: threat diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml index f017005eef..8e859915e3 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_country.yml @@ -5,7 +5,7 @@ date: '2020-10-07' author: Bhavin Patel, Splunk type: Hunting datamodel: -- Authentication +- Authentication.Authentication description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. @@ -71,9 +71,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Authentication.Authentication.signature + - Authentication.Authentication.src + - Authentication.Authentication.user - _time - - Authentication.signature - - Authentication.user - - Authentication.src risk_score: 42 security_domain: threat diff --git a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml index ef02104408..4442bdd943 100644 --- a/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml +++ b/detections/cloud/detect_aws_console_login_by_user_from_new_region.yml @@ -5,7 +5,7 @@ date: '2020-10-07' author: Bhavin Patel, Splunk type: Hunting datamodel: -- Authentication +- Authentication.Authentication description: This search looks for AWS CloudTrail events wherein a console login event by a user was recorded within the last hour, then compares the event to a lookup file of previously seen users (by ARN values) who have logged into the console. @@ -71,9 +71,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Authentication.Authentication.signature + - Authentication.Authentication.src + - Authentication.Authentication.user - _time - - Authentication.signature - - Authentication.user - - Authentication.src risk_score: 36 security_domain: threat diff --git a/detections/cloud/detect_new_open_s3_buckets.yml b/detections/cloud/detect_new_open_s3_buckets.yml index 2cf1e5d425..ae0f045832 100644 --- a/detections/cloud/detect_new_open_s3_buckets.yml +++ b/detections/cloud/detect_new_open_s3_buckets.yml @@ -64,13 +64,11 @@ tags: - Splunk Cloud required_fields: - _time - - eventSource - eventName - - requestParameters.bucketName - - user_arn - - userIdentity.principalId - - userAgent - - uri + - eventSource - permission + - uri + - userAgent + - user_arn risk_score: 48 security_domain: threat diff --git a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml index 95fec6af8a..5f40339495 100644 --- a/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml +++ b/detections/cloud/detect_new_open_s3_buckets_over_aws_cli.yml @@ -68,16 +68,9 @@ tags: - Splunk Cloud required_fields: - _time - - eventSource - - eventName - - requestParameters.accessControlList.x-amz-grant-read-acp - - requestParameters.accessControlList.x-amz-grant-write - - requestParameters.accessControlList.x-amz-grant-write-acp - - requestParameters.accessControlList.x-amz-grant-full-control - - requestParameters.bucketName - - userIdentity.userName - - userIdentity.principalId - - userAgent - bucketName + - eventName + - eventSource + - userAgent risk_score: 48 security_domain: threat diff --git a/detections/cloud/detect_shared_ec2_snapshot.yml b/detections/cloud/detect_shared_ec2_snapshot.yml index e297f4c0d5..fbb3b4d6b9 100644 --- a/detections/cloud/detect_shared_ec2_snapshot.yml +++ b/detections/cloud/detect_shared_ec2_snapshot.yml @@ -62,12 +62,11 @@ tags: - Splunk Cloud required_fields: - _time - - eventName - - user_arn - - src_ip - - requestParameters.attributeType - aws_account_id - - vendor_region + - eventName + - src_ip - user_agent + - user_arn + - vendor_region risk_score: 48 security_domain: threat diff --git a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml index db578d529d..3c177468f1 100644 --- a/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml +++ b/detections/cloud/detect_spike_in_aws_security_hub_alerts_for_ec2_instance.yml @@ -48,13 +48,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Resources{}.Type - Title - Types{} + - _time + - dest + - severity - vendor_account - vendor_region - - severity - - dest risk_score: 15 security_domain: endpoint diff --git a/detections/cloud/github_dependabot_alert.yml b/detections/cloud/github_dependabot_alert.yml index 0ac8b391b0..0c9555ba56 100644 --- a/detections/cloud/github_dependabot_alert.yml +++ b/detections/cloud/github_dependabot_alert.yml @@ -50,16 +50,6 @@ tags: - Dev Sec Ops Analytics required_fields: - _time - - alert.id - - repository.full_name - - repository.html_url - action - - alert.affected_package_name - - alert.affected_range - - alert.created_at - - alert.external_identifier - - alert.external_reference - - alert.fixed_in - - alert.severity risk_score: 27 security_domain: network diff --git a/detections/cloud/github_pull_request_from_unknown_user.yml b/detections/cloud/github_pull_request_from_unknown_user.yml index 82025ef1a6..e1cc6f1814 100644 --- a/detections/cloud/github_pull_request_from_unknown_user.yml +++ b/detections/cloud/github_pull_request_from_unknown_user.yml @@ -48,18 +48,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud - Dev Sec Ops Analytics - required_fields: - - _time - - alert.id - - repository.full_name - - repository.html_url - - action - - alert.affected_package_name - - alert.affected_range - - alert.created_at - - alert.external_identifier - - alert.external_reference - - alert.fixed_in - - alert.severity + required_fields: [] risk_score: 27 security_domain: network diff --git a/detections/cloud/gsuite_drive_share_in_external_email.yml b/detections/cloud/gsuite_drive_share_in_external_email.yml index 04a38dc077..2dafc2f6f8 100644 --- a/detections/cloud/gsuite_drive_share_in_external_email.yml +++ b/detections/cloud/gsuite_drive_share_in_external_email.yml @@ -60,12 +60,8 @@ tags: - Dev Sec Ops Analytics required_fields: - _time - - parameters.doc_title - - src_domain - dest_domain - email - - parameters.visibility - - parameters.owner - - parameters.doc_type + - src_domain risk_score: 72 security_domain: endpoint diff --git a/detections/cloud/gsuite_email_suspicious_attachment.yml b/detections/cloud/gsuite_email_suspicious_attachment.yml index 9c9133fe0b..7cd945a00f 100644 --- a/detections/cloud/gsuite_email_suspicious_attachment.yml +++ b/detections/cloud/gsuite_email_suspicious_attachment.yml @@ -58,13 +58,8 @@ tags: - Dev Sec Ops Analytics required_fields: - _time - - attachment{}.file_extension_type - - attachment{}.sha256 - - destination{}.service - num_message_attachments - payload_size - subject - - destination{}.address - - source.address risk_score: 49 security_domain: endpoint diff --git a/detections/cloud/gsuite_suspicious_shared_file_name.yml b/detections/cloud/gsuite_suspicious_shared_file_name.yml index b65fe208be..a5dfc2d571 100644 --- a/detections/cloud/gsuite_suspicious_shared_file_name.yml +++ b/detections/cloud/gsuite_suspicious_shared_file_name.yml @@ -65,12 +65,7 @@ tags: - Dev Sec Ops Analytics required_fields: - _time - - parameters.doc_title - - src_domain - dest_domain - email - - parameters.visibility - - parameters.owner - - parameters.doc_type risk_score: 21 security_domain: endpoint diff --git a/detections/cloud/kubernetes_scanner_image_pulling.yml b/detections/cloud/kubernetes_scanner_image_pulling.yml index cd76a25d77..dca89a3004 100644 --- a/detections/cloud/kubernetes_scanner_image_pulling.yml +++ b/detections/cloud/kubernetes_scanner_image_pulling.yml @@ -47,13 +47,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud - Dev Sec Ops Analytics - required_fields: - - object.message - - source.host - - object.involvedObject.name - - object.involvedObject.namespace - - object.involvedObject.kind - - object.message - - object.reason + required_fields: [] risk_score: 81 security_domain: network diff --git a/detections/cloud/o365_add_app_role_assignment_grant_user.yml b/detections/cloud/o365_add_app_role_assignment_grant_user.yml index 731f801395..53c95353e6 100644 --- a/detections/cloud/o365_add_app_role_assignment_grant_user.yml +++ b/detections/cloud/o365_add_app_role_assignment_grant_user.yml @@ -61,13 +61,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Workload - - Operation - - Actor{}.ID - - Actor{}.Type - ActorIpAddress - - dest + - Operation - ResultStatus + - Workload + - _time + - dest risk_score: 18 security_domain: threat diff --git a/detections/cloud/o365_added_service_principal.yml b/detections/cloud/o365_added_service_principal.yml index 08efdec24d..2bc704ace6 100644 --- a/detections/cloud/o365_added_service_principal.yml +++ b/detections/cloud/o365_added_service_principal.yml @@ -60,13 +60,8 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Workload - - signature - - Actor{}.ID - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - Target{}.ID - ActorIpAddress + - Workload + - _time risk_score: 42 security_domain: threat diff --git a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml index aaee2fa67e..7e22c1899e 100644 --- a/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml +++ b/detections/cloud/o365_bypass_mfa_via_trusted_ip.yml @@ -62,14 +62,10 @@ tags: - Splunk Cloud required_fields: - _time - - signature - - ModifiedProperties{}.Name - - ModifiedProperties{}.NewValue - - ModifiedProperties{}.OldValue - - user - - vendor_account - - status - - user_id - action + - status + - user + - user_id + - vendor_account risk_score: 42 security_domain: threat diff --git a/detections/cloud/o365_disable_mfa.yml b/detections/cloud/o365_disable_mfa.yml index 3a7ef5e300..4b68714a8e 100644 --- a/detections/cloud/o365_disable_mfa.yml +++ b/detections/cloud/o365_disable_mfa.yml @@ -53,13 +53,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - Operation - - UserType - - user - - status - - signature - - dest - ResultStatus + - UserType + - _time risk_score: 64 security_domain: threat diff --git a/detections/cloud/o365_new_federated_domain_added.yml b/detections/cloud/o365_new_federated_domain_added.yml index 7a416e6f60..0ad97dd812 100644 --- a/detections/cloud/o365_new_federated_domain_added.yml +++ b/detections/cloud/o365_new_federated_domain_added.yml @@ -60,14 +60,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Workload - - Operation - - Parameters{}.Value - ObjectId + - Operation - OrganizationName - OriginatingServer - UserId - UserKey + - Workload + - _time risk_score: 64 security_domain: threat diff --git a/detections/endpoint/7zip_commandline_to_smb_share_path.yml b/detections/endpoint/7zip_commandline_to_smb_share_path.yml index 71a2f82616..32a7a3ccbb 100644 --- a/detections/endpoint/7zip_commandline_to_smb_share_path.yml +++ b/detections/endpoint/7zip_commandline_to_smb_share_path.yml @@ -5,7 +5,7 @@ date: '2021-08-17' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious 7z process with commandline pointing to SMB network share. This technique was seen in CONTI LEAK tools where it use 7z to archive a sensitive files and place it in network share tmp folder. This search @@ -59,14 +59,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/account_discovery_with_net_app.yml b/detections/endpoint/account_discovery_with_net_app.yml index f5c8857b30..7849e9c8bf 100644 --- a/detections/endpoint/account_discovery_with_net_app.yml +++ b/detections/endpoint/account_discovery_with_net_app.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this search is to detect a potential account discovery series of command used by several malware or attack to recon the target machine. This technique is also seen in some note worthy malware like trickbot where it runs a cmd process, @@ -66,18 +66,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 5 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/active_setup_registry_autostart.yml b/detections/endpoint/active_setup_registry_autostart.yml index 86071ff0f0..dae2e86ad4 100644 --- a/detections/endpoint/active_setup_registry_autostart.yml +++ b/detections/endpoint/active_setup_registry_autostart.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of the active setup registry for persistence and privilege escalation. This technique was seen in several malware (poisonIvy), adware and APT to gain persistence to the compromised machine @@ -68,12 +69,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name risk_score: 64 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/add_defaultuser_and_password_in_registry.yml b/detections/endpoint/add_defaultuser_and_password_in_registry.yml index 52aae5c92b..bdd0483628 100644 --- a/detections/endpoint/add_defaultuser_and_password_in_registry.yml +++ b/detections/endpoint/add_defaultuser_and_password_in_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to @@ -62,11 +63,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/add_or_set_windows_defender_exclusion.yml b/detections/endpoint/add_or_set_windows_defender_exclusion.yml index be1e38c53e..bc069d2d73 100644 --- a/detections/endpoint/add_or_set_windows_defender_exclusion.yml +++ b/detections/endpoint/add_or_set_windows_defender_exclusion.yml @@ -5,7 +5,7 @@ date: '2021-11-25' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify a suspicious process command-line related to Windows Defender exclusion feature. This command is abused by adversaries, malware authors and red teams to bypass Windows Defender Antivirus products by excluding @@ -62,18 +62,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 64 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml index 41bc3e37ff..705328403e 100644 --- a/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml +++ b/detections/endpoint/allow_file_and_printing_sharing_in_firewall.yml @@ -5,7 +5,7 @@ date: '2021-06-23' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious modification of firewall to allow file and printer sharing. This technique was seen in ransomware to be able to discover more machine connected to the compromised host to encrypt more files @@ -42,18 +42,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 10d10e646c..cd8739451a 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This technique was identified when an adversary wants to grant remote access to a machine @@ -66,12 +67,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.dest - - Registry.user risk_score: 3 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index 644a57103f..0a90b9f6df 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-05-19' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic identifies suspicious PowerShell command to allow inbound traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index 87fcccb2b4..affb67c552 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -5,7 +5,7 @@ date: '2021-06-23' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious modification to the firewall to allow network discovery on a machine. This technique was seen in couple of ransomware (revil, reddot) to discover other machine connected to the compromised host to encrypt @@ -44,18 +44,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 06d6b5dcc7..185d4c1075 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic identifies a potential privilege escalation attempt to perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. @@ -67,11 +68,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 481f9a8198..8807ff0180 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -5,7 +5,7 @@ date: '2021-04-22' author: Michael Haag, Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies a 7z.exe spawned from `Rundll32.exe` or `Dllhost.exe`. It is assumed that the adversary has brought in `7z.exe` and `7z.dll`. It has been observed where an adversary will rename `7z.exe`. Additional coverage @@ -70,16 +70,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.parent_process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index ea941bfa39..1e3780936e 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -5,7 +5,7 @@ date: '2021-03-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of PowerShell downloading a file using `DownloadFile` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source @@ -74,18 +74,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 0b89645de4..f21bb0ca46 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -5,7 +5,7 @@ date: '2021-03-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of PowerShell downloading a file using `DownloadString` method. This particular method is utilized in many different PowerShell frameworks to download files and output to disk. Identify the source @@ -68,18 +68,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/attacker_tools_on_endpoint.yml b/detections/endpoint/attacker_tools_on_endpoint.yml index f29439bb45..9a97267731 100644 --- a/detections/endpoint/attacker_tools_on_endpoint.yml +++ b/detections/endpoint/attacker_tools_on_endpoint.yml @@ -5,7 +5,7 @@ date: '2021-11-04' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for execution of commonly used attacker tools on an endpoint. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -80,10 +80,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.process_name - - Processes.parent_process + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 64 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index 7c871d858f..5db06960d5 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Patrick Bareiss, Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Attempt To Add Certificate To Untrusted Store search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where `process_certutil` @@ -73,15 +73,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.parent_process - - Processes.process_id - - Processes.parent_process_id risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 4e742ebb72..57c9dbf4d1 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for attempts to stop security-related services on the endpoint. search: '| tstats `security_content_summariesonly` values(Processes.process) as process @@ -78,18 +78,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 20 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index da30681035..53b660b73b 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Monitor for execution of reg.exe with parameters specifying an export of keys that contain hashed credentials that attackers may try to crack offline. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -72,18 +72,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 90 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/auto_admin_logon_registry_entry.yml b/detections/endpoint/auto_admin_logon_registry_entry.yml index 7041013f6a..fc224895c7 100644 --- a/detections/endpoint/auto_admin_logon_registry_entry.yml +++ b/detections/endpoint/auto_admin_logon_registry_entry.yml @@ -5,7 +5,8 @@ date: '2020-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: this search is to detect a suspicious registry modification to implement auto admin logon to a host. This technique was seen in BlackMatter ransomware to automatically logon to the compromise host after triggering a safemode boot to @@ -62,11 +63,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index 6461f64403..05379ffc90 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -5,7 +5,8 @@ date: '2021-09-16' author: Michael Haag, Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: The search looks for a batch file (.bat) written to the Windows system directory tree. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Processes @@ -73,14 +74,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Processes.dest + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name - _time - - Filesystem.dest - - Filesystem.file_name - - Filesystem.user - - Filesystem.file_path - - Processes.process_id - - Processes.process_name - - Processes.dest risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml index 4bc260d08d..70babdaa80 100644 --- a/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml +++ b/detections/endpoint/bcdedit_command_back_to_normal_mode_boot.yml @@ -5,7 +5,7 @@ date: '2021-09-06' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious bcdedit commandline to configure the host from safe mode back to normal boot configuration. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode @@ -56,13 +56,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.parent_process - - Processes.dest - - Processes.user risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index fd4eacf029..c99acb8bd1 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -5,7 +5,7 @@ date: '2020-12-21' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for flags passed to bcdedit.exe modifications to the built-in Windows error recovery boot configurations. This is typically used by ransomware to prevent recovery. @@ -67,12 +67,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index 1f32249fd9..61c7ddc760 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` scheduling a BITS job to persist on an endpoint. The query identifies the parameters used to create, resume or add a file to a BITS @@ -72,18 +72,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index 740f549f79..2533b4c300 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following query identifies Microsoft Background Intelligent Transfer Service utility `bitsadmin.exe` using the `transfer` parameter to download a remote object. In addition, look for `download` or `upload` on the command-line, the switches @@ -78,18 +78,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 091aa6f61e..7e83ed3032 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -5,7 +5,7 @@ date: '2022-02-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Certutil.exe may download a file from a remote destination using `-urlcache`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will @@ -70,18 +70,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 90 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index aa671b6eb9..baacde78a3 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -5,7 +5,7 @@ date: '2022-02-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'Certutil.exe may download a file from a remote destination using `-VerifyCtl`. This behavior does require a URL to be passed on the command-line. In addition, `-f` (force) and `-split` (Split embedded ASN.1 elements, and save to files) will @@ -71,18 +71,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 90 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 45ba783055..078144cc1b 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -5,7 +5,7 @@ date: '2021-01-26' author: Rod Soto, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for arguments to certutil.exe indicating the manipulation or extraction of Certificate. This certificate can then be used to sign new authentication tokens specially inside Federated environments such as Windows ADFS. @@ -60,18 +60,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 9a0cfa8f5d..1db0d158f0 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -5,7 +5,7 @@ date: '2021-03-23' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: CertUtil.exe may be used to `encode` and `decode` a file, including PE and script code. Encoding will convert a file to base64 with `-----BEGIN CERTIFICATE-----` and `-----END CERTIFICATE-----` tags. Malicious usage will include decoding a encoded @@ -71,18 +71,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 40 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/change_default_file_association.yml b/detections/endpoint/change_default_file_association.yml index 282c29c085..74e0977ad0 100644 --- a/detections/endpoint/change_default_file_association.yml +++ b/detections/endpoint/change_default_file_association.yml @@ -5,7 +5,7 @@ date: '2021-09-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: This analytic is developed to detect suspicious registry modification to change the default file association of windows to malicious payload. This techninique was seen in some APT where it modify the default process to run file association, @@ -58,12 +58,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Registry.dest + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/change_to_safe_mode_with_network_config.yml b/detections/endpoint/change_to_safe_mode_with_network_config.yml index 90f758f46d..c696c951ba 100644 --- a/detections/endpoint/change_to_safe_mode_with_network_config.yml +++ b/detections/endpoint/change_to_safe_mode_with_network_config.yml @@ -5,7 +5,7 @@ date: '2021-09-06' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious bcdedit commandline to configure the host to boot in safe mode with network config. This technique was seen in blackMatter ransomware where it force the compromised host to boot in safe mode to continue @@ -55,13 +55,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.parent_process - - Processes.dest - - Processes.user risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/chcp_command_execution.yml b/detections/endpoint/chcp_command_execution.yml index dabadf67ed..277954819b 100644 --- a/detections/endpoint/chcp_command_execution.yml +++ b/detections/endpoint/chcp_command_execution.yml @@ -5,7 +5,7 @@ date: '2021-07-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect execution of chcp.exe application. this utility is used to change the active code page of the console. This technique was seen in icedid malware to know the locale region/language/country of the compromise host. @@ -55,14 +55,22 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - process_name - - process - - parent_process_name - - parent_process - - process_id - - parent_process_id - dest + - parent_process + - parent_process_id + - parent_process_name + - process + - process_id + - process_name - user risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/check_elevated_cmd_using_whoami.yml b/detections/endpoint/check_elevated_cmd_using_whoami.yml index 20d3b7f612..fac623301b 100644 --- a/detections/endpoint/check_elevated_cmd_using_whoami.yml +++ b/detections/endpoint/check_elevated_cmd_using_whoami.yml @@ -5,7 +5,7 @@ date: '2021-09-15' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious whoami execution to check if the cmd or shell instance process is with elevated privileges. This technique was seen in FIN7 js implant where it execute this as part of its data collection to the infected @@ -55,14 +55,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - - Processes.dest - - Processes.user risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index 5f95a83096..da0ddcdd31 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -5,7 +5,7 @@ date: '2021-06-10' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this search is to detect execution of `cipher.exe` to clear the unallocated sectors of a specific disk. This technique was seen in some ransomware to make it impossible to forensically recover deleted files. @@ -63,18 +63,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 90 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index ea8701cc6e..a4005492b7 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -5,7 +5,7 @@ date: '2021-03-17' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytics are designed to identifies some CLOP ransomware variant that using arguments to execute its main code or feature of its code. In this variant if the parameter is "runrun", CLOP ransomware will try to encrypt files @@ -67,18 +67,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 100 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml index 3fd889e83f..656e59ed24 100644 --- a/detections/endpoint/clop_ransomware_known_service_name.yml +++ b/detections/endpoint/clop_ransomware_known_service_name.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-03-17' author: Teoderick Contreras type: TTP -datamodel: -- Endpoint +datamodel: [] description: This detection is to identify the common service name created by the CLOP ransomware as part of its persistence and high privilege code execution in the infected machine. Ussually CLOP ransomware use StartServiceCtrlDispatcherW API @@ -61,11 +60,6 @@ tags: - Splunk Cloud required_fields: - EventCode - - cmdline - _time - - parent_process_name - - process_name - - OriginalFileName - - process_path risk_score: 100 security_domain: endpoint diff --git a/detections/endpoint/cmd_carry_out_string_command_parameter.yml b/detections/endpoint/cmd_carry_out_string_command_parameter.yml index da15eb4ccf..e9993abfb0 100644 --- a/detections/endpoint/cmd_carry_out_string_command_parameter.yml +++ b/detections/endpoint/cmd_carry_out_string_command_parameter.yml @@ -5,7 +5,7 @@ date: '2022-01-18' author: Teoderick Contreras, Bhavin Patel, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies command-line arguments where `cmd.exe /c` is used to execute a program. `cmd /c` is used to run commands in MS-DOS and terminate after command or process completion. This technique is commonly seen in @@ -65,15 +65,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.parent_process_id risk_score: 30 security_domain: endpoint diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index d2e19bae02..3cc8204c11 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -5,7 +5,7 @@ date: '2021-05-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies a common behavior by Cobalt Strike and other frameworks where the adversary will escalate privileges, either via `jump` (Cobalt Strike PTH) or `getsystem`, using named-pipe impersonation. A suspicious event will @@ -70,18 +70,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 64 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml index ca1384fc22..0428335f2f 100644 --- a/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml +++ b/detections/endpoint/cmdline_tool_not_executed_in_cmd_shell.yml @@ -5,7 +5,7 @@ date: '2021-09-14' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies a non-standard parent process (not matching CMD, PowerShell, or Explorer) spawning `ipconfig.exe` or `systeminfo.exe`. This particular behavior was seen in FIN7's JSSLoader .NET payload. This is also @@ -73,18 +73,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index c14995c3de..49b2d5f521 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-05-13' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic detects a potential process using COM Object like CMLUA or CMSTPLUA to bypass UAC. This technique has been used by ransomware adversaries to gain administrative privileges to its running process. diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 8c69dd4cfa..a9f5edb481 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -5,7 +5,7 @@ date: '2020-11-09' author: David Dorsey, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Filesystem description: The search looks for file modifications with extensions commonly used by Ransomware search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -81,10 +81,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.user - _time - - Filesystem.user - - Filesystem.dest - - Filesystem.file_path - - Filesystem.file_name risk_score: 90 security_domain: endpoint diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index c685c5bc5e..33c53658f0 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -5,7 +5,7 @@ date: '2020-11-09' author: David Dorsey, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Filesystem description: The search looks for files created with names matching those typically used in ransomware notes that tell the victim how to get their data back. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -66,10 +66,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.user - _time - - Filesystem.user - - Filesystem.dest - - Filesystem.file_path - - Filesystem.file_name risk_score: 90 security_domain: endpoint diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index 5512203ac6..a778a3ce11 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -5,7 +5,7 @@ date: '2021-06-02' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search detects the suspicious commandline argument of revil ransomware to encrypt specific or all local drive and network shares of the compromised machine or host. @@ -64,18 +64,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 64 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/control_loading_from_world_writable_directory.yml b/detections/endpoint/control_loading_from_world_writable_directory.yml index 13e215abb1..a3dce58f7e 100644 --- a/detections/endpoint/control_loading_from_world_writable_directory.yml +++ b/detections/endpoint/control_loading_from_world_writable_directory.yml @@ -5,7 +5,7 @@ date: '2021-09-08' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies control.exe loading either a .cpl or .inf from a writable directory. This is related to CVE-2021-40444. During triage, review parallel processes, parent and child, for further suspicious behaviors. In @@ -73,17 +73,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index ca3390c2f4..4d51b47fef 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -5,7 +5,7 @@ date: '2021-09-08' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for the creation of local administrator accounts using net.exe . search: '| tstats `security_content_summariesonly` count values(Processes.user) as @@ -72,18 +72,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 30 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index af27466036..bcf8b0653c 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -5,7 +5,7 @@ date: '2020-09-16' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for the creation or deletion of hidden shares using net.exe. search: '| tstats `security_content_summariesonly` count values(Processes.user) as @@ -69,18 +69,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/create_remote_thread_in_shell_application.yml b/detections/endpoint/create_remote_thread_in_shell_application.yml index b3d17dfb23..a6c4440b66 100644 --- a/detections/endpoint/create_remote_thread_in_shell_application.yml +++ b/detections/endpoint/create_remote_thread_in_shell_application.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-08-04' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect suspicious process injection in command shell. This technique was seen in IcedID where it execute cmd.exe process to inject its shellcode as part of its execution as banking trojan. It is really uncommon to have diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index bc3f53bc27..68f784e043 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -5,7 +5,7 @@ date: '2019-12-10' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Monitor for signs that Vssadmin or Wmic has been used to create a shadow copy. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -70,18 +70,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 81 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index 52b61c246c..2789eb7ed3 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search detects the use of wmic and Powershell to create a shadow copy. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -68,18 +68,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 81 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 982bb93c5f..c21294dbab 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search detects credential dumping using copy command from a shadow copy. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -70,18 +70,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 81 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index e7e11cc09c..ae901f61b8 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search detects the creation of a symlink to a shadow copy. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_cmd` Processes.process=*mklink* @@ -68,18 +68,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 81 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/csc_net_on_the_fly_compilation.yml b/detections/endpoint/csc_net_on_the_fly_compilation.yml index 416939c42f..bbda130b6e 100644 --- a/detections/endpoint/csc_net_on_the_fly_compilation.yml +++ b/detections/endpoint/csc_net_on_the_fly_compilation.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: this analytic is to detect a suspicious compile before delivery approach of .net compiler csc.exe. This technique was seen in several adversaries, malware and even in red teams to take advantage the csc.exe .net compiler tool to compile @@ -59,14 +59,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/curl_download_and_bash_execution.yml b/detections/endpoint/curl_download_and_bash_execution.yml index fc436a3232..d964910004 100644 --- a/detections/endpoint/curl_download_and_bash_execution.yml +++ b/detections/endpoint/curl_download_and_bash_execution.yml @@ -5,7 +5,7 @@ date: '2021-12-10' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of curl on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. @@ -64,16 +64,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 7349f7bf96..5236e44d89 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-05-12' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This following analytic detects PowerShell command to delete shadow copy using the WMIC PowerShell module. This technique was seen used by a recent adversary to deploy DarkSide Ransomware where it executed a child process of PowerShell to diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index 4e4527f998..ed381b1602 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will detect a suspicious net.exe/net1.exe command-line to delete a user on a system. This technique may be use by an administrator for legitimate purposes, however this behavior has been used in the wild to impair some @@ -67,18 +67,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 99741805d5..c1ff22be12 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -5,7 +5,7 @@ date: '2020-11-09' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The vssadmin.exe utility is used to interact with the Volume Shadow Copy Service. Wmic is an interface to the Windows Management Instrumentation. This search looks for either of these tools being used to delete shadow copies. @@ -74,18 +74,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 81 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index 2c4baed941..b637cbbc66 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2021-06-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the common command-line argument used by AzureHound `Invoke-AzureHound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. In most instances @@ -70,18 +70,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index 3b77169959..605ec25240 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -5,7 +5,7 @@ date: '2021-06-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: The following analytic is similar to SharpHound file modifications, but this instance covers the use of Invoke-AzureHound. AzureHound is the SharpHound equivilent but for Azure. It's possible this may never be seen in an environment @@ -69,11 +69,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_id - _time - - file_path - dest - - file_name - - process_id - file_create_time + - file_name + - file_path + - process_id risk_score: 63 security_domain: endpoint diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index 6f4faf640f..a25adfa1a9 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: David Dorsey, Splunk type: Anomaly datamodel: -- Change +- Change.All_Changes description: This search detects user accounts that have been locked out a relatively high number of times in a short period. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -56,9 +56,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.result + - Change.All_Changes.user - _time - - All_Changes.result - nodename - - All_Changes.user risk_score: 36 security_domain: access diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 5795b04f12..026154ae8e 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -5,7 +5,8 @@ date: '2021-10-05' author: Michael Haag, Shannon Davis, David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: 'The following query identifies suspicious .aspx created in 3 paths identified by Microsoft as known drop locations for Exchange exploitation related to HAFNIUM group and recently disclosed vulnerablity named ProxyShell. Paths include: `\HttpProxy\owa\auth\`, @@ -86,12 +87,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Processes.dest + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name - _time - - Filesystem.file_path - - Filesystem.process_id - - Filesystem.file_name - - Filesystem.file_hash - - Filesystem.user risk_score: 81 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 12d0f3ca29..cfdd7915e8 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies a renamed instance of hh.exe (HTML Help) executing a Compiled HTML Help (CHM). This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any @@ -79,17 +79,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index ec49b6d6db..658e64d866 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -5,7 +5,7 @@ date: '2021-02-11' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) that spawns a child process. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any @@ -80,18 +80,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index 4714a277ec..967a7c64c7 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file from a remote url. This particular technique will load Windows script code from a compiled help file. CHM files may contain nearly any file type @@ -84,18 +84,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 90 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 1b6c30f710..0b76b8aa16 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies hh.exe (HTML Help) execution of a Compiled HTML Help (CHM) file using InfoTech Storage Handlers. This particular technique will load Windows script code from a compiled help file, using InfoTech Storage @@ -81,18 +81,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index 6617f7be17..1576507d42 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -74,11 +74,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Computer - EventCode + - Image - ImageLoaded - ProcessId - - Computer - - Image risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index 499ad568b5..24ef9dab70 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Bhavin Patel, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies "mshta.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. The search will return the first @@ -76,18 +76,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 90 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index a67750f930..784187aedd 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies renamed instances of mshta.exe executing. Mshta.exe is natively found in C:\Windows\system32 and C:\Windows\syswow64. This analytic utilizes the internal name of the PE to identify if is the legitimate mshta @@ -73,17 +73,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 180b73585e..8f4a408656 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies when Microsoft HTML Application Host (mshta.exe) utility is used to make remote http connections. Adversaries may use mshta.exe to proxy the download and execution of remote .hta files. The analytic identifies command @@ -77,18 +77,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index cd4be52fb9..cbaa669688 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -5,7 +5,7 @@ date: '2020-07-03' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The detection Detect Path Interception By Creation Of program exe is detecting the abuse of unquoted service paths, which is a popular technique for privilege escalation. ' @@ -71,18 +71,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index fc25eaa2bc..7694145c6b 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -5,7 +5,7 @@ date: '2020-11-10' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for fast execution of processes used for system network configuration discovery on the endpoint. search: '| tstats `security_content_summariesonly` count values(Processes.process) @@ -74,18 +74,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 32 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index 0118aefed2..4354104a07 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -5,7 +5,7 @@ date: '2020-11-10' author: Bhavin Patel, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for executions of cmd.exe spawned by a process that is often abused by attackers and that does not typically launch cmd.exe. search: '| tstats `security_content_summariesonly` count values(Processes.process) @@ -75,17 +75,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 226b47f814..0b7bfc88ad 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for events where `PsExec.exe` is run with the `accepteula` flag in the command line. PsExec is a built-in Windows utility that enables you to execute processes on other systems. It is fully interactive for console applications. @@ -80,18 +80,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index 5e172ae5d8..99b8526181 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -5,7 +5,7 @@ date: '2021-11-29' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies commonly used command-line arguments used by `rclone.exe` to initiate a file transfer. Some arguments were negated as they are specific to the configuration used by adversaries. In particular, an adversary may @@ -73,15 +73,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.original_file_name risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index d7c71727dc..cc17d164b8 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -5,7 +5,7 @@ date: '2021-02-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies regasm.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process @@ -77,14 +77,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index ad5797a361..1f5e663751 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -72,14 +72,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Computer - EventID + - _time - dest_ip - process_name - - Computer - - user - src_ip - - dest_host - - dest_ip + - user risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 258427a5e9..499be5ef39 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2021-09-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies regasm.exe with no command line arguments. This particular behavior occurs when another process injects into regasm.exe, no command line arguments will be present. During investigation, identify any network @@ -75,18 +75,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index cc9286fe4a..05436ab079 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -5,7 +5,7 @@ date: '2021-02-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies regsvcs.exe spawning a process. This particular technique has been used in the wild to bypass application control products. Regasm.exe and Regsvcs.exe are signed by Microsoft. Spawning of a child process @@ -75,15 +75,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index c92572151b..85645a703d 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -72,13 +72,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Computer - EventID + - _time - dest_ip - process_name - - Computer - - user - src_ip - - dest_host + - user risk_score: 80 security_domain: Endpoint diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 12558d8096..62e8fed65f 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2021-09-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies regsvcs.exe with no command line arguments. This particular behavior occurs when another process injects into regsvcs.exe, no command line arguments will be present. During investigation, identify any network @@ -75,18 +75,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index a346085832..4acecf3722 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -5,7 +5,7 @@ date: '2021-01-28' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. @@ -82,18 +82,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 686669851d..b8d583ea77 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies renamed 7-Zip usage using Sysmon. At this stage of an attack, review parallel processes and file modifications for data that is staged or potentially have been exfiltrated. This analytic utilizes the @@ -65,17 +65,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 27 security_domain: endpoint diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index aae0bea823..3edb84f872 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies renamed instances of `PsExec.exe` being utilized on an endpoint. Most instances, it is highly probable to capture `Psexec.exe` or other SysInternal utility usage with the command-line argument of `-accepteula`. @@ -73,17 +73,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 27 security_domain: endpoint diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index c26cf9478a..20172280d5 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -4,7 +4,8 @@ version: 2 date: '2021-09-16' author: Michael Haag, Splunk type: Hunting -datamodel: [] +datamodel: +- Endpoint.Processes description: The following analytic identifies the usage of `rclone.exe`, renamed, being used to exfiltrate data to a remote destination. RClone has been used by multiple ransomware groups to exfiltrate data. In many instances, it will be downloaded from @@ -69,17 +70,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 27 security_domain: endpoint diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index 6cdad6b951..615f50ff59 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analtyic identifies renamed instances of `WinRAR.exe`. In most cases, it is not common for WinRAR to be used renamed, however it is common to be installed by a third party application and executed from a non-standard path. @@ -68,17 +68,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 27 security_domain: endpoint diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index ea505ebdbf..a84893ec75 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -5,7 +5,7 @@ date: '2021-02-04' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, @@ -81,18 +81,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index 1bd63ea426..3eae993c71 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -5,7 +5,7 @@ date: '2021-02-04' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, @@ -79,18 +79,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 5be793a4fb..bd4e4c4043 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -5,7 +5,7 @@ date: '2021-02-04' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe loading syssetup.dll by calling the LaunchINFSection function on the command line. This particular technique will load script code from a file. Upon a successful execution, the following module @@ -81,18 +81,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index 0ce3298538..b71b9f1963 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -5,7 +5,7 @@ date: '2021-01-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies "rundll32.exe" execution with inline protocol handlers. "JavaScript", "VBScript", and "About" are the only supported options when invoking HTA content directly on the command-line. This type of behavior @@ -67,18 +67,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index c884eb7f88..18fe14b925 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2021-06-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies common command-line arguments used by SharpHound `-collectionMethod` and `invoke-bloodhound`. Being the script is FOSS, function names may be modified, but these changes are dependent upon the operator. @@ -61,14 +61,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 24 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index f8b790df6d..5e3df344d3 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -5,7 +5,7 @@ date: '2021-05-27' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: SharpHound is used as a reconnaissance collector, ingestor, for BloodHound. SharpHound will query the domain controller and begin gathering all the data related to the domain and trusts. For output, it will drop a .zip file upon completion following @@ -75,11 +75,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_id - _time - - file_path - dest - - file_name - - process_id - file_create_time + - file_name + - file_path + - process_id risk_score: 24 security_domain: endpoint diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index 02400d37b8..fe1462e5a9 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -5,7 +5,7 @@ date: '2021-05-27' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies SharpHound binary usage by using the original filena,e. In addition to renaming the PE, other coverage is available to detect command-line arguments. This particular analytic looks for the original_file_name @@ -66,18 +66,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 24 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index b56f9aa201..c1022cd652 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Bhavin Patel, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for the execution of the cscript.exe or wscript.exe processes, with a parent of cmd.exe. The search will return the count, the first and last time this execution was seen on a machine, the user, and the destination @@ -58,13 +58,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.parent_process_name - - Processes.process_name - - Processes.parent_process - - Processes.user - - Processes.dest risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_amsi_through_registry.yml b/detections/endpoint/disable_amsi_through_registry.yml index 9387e05324..3b0c18f7de 100644 --- a/detections/endpoint/disable_amsi_through_registry.yml +++ b/detections/endpoint/disable_amsi_through_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: this search is to identify modification in registry to disable AMSI windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute @@ -48,12 +49,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_defender_antivirus_registry.yml b/detections/endpoint/disable_defender_antivirus_registry.yml index 1561147480..8d03173a87 100644 --- a/detections/endpoint/disable_defender_antivirus_registry.yml +++ b/detections/endpoint/disable_defender_antivirus_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled @@ -62,13 +63,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml index dbfea7ede7..d1d7181beb 100644 --- a/detections/endpoint/disable_defender_blockatfirstseen_feature.yml +++ b/detections/endpoint/disable_defender_blockatfirstseen_feature.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the BlockAtFirstSeen feature where it block @@ -61,13 +62,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_defender_enhanced_notification.yml b/detections/endpoint/disable_defender_enhanced_notification.yml index 970291b826..e6d67a67ca 100644 --- a/detections/endpoint/disable_defender_enhanced_notification.yml +++ b/detections/endpoint/disable_defender_enhanced_notification.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the Enhanced Notification feature wher user @@ -61,13 +62,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_defender_mpengine_registry.yml b/detections/endpoint/disable_defender_mpengine_registry.yml index 370a57cfc1..c478a53084 100644 --- a/detections/endpoint/disable_defender_mpengine_registry.yml +++ b/detections/endpoint/disable_defender_mpengine_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled @@ -62,13 +63,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_defender_spynet_reporting.yml b/detections/endpoint/disable_defender_spynet_reporting.yml index 99325b43e3..95a5e8bbe0 100644 --- a/detections/endpoint/disable_defender_spynet_reporting.yml +++ b/detections/endpoint/disable_defender_spynet_reporting.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the spynet reporting for its telemetry. @@ -60,13 +61,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml index 725608f220..70c6cbbf75 100644 --- a/detections/endpoint/disable_defender_submit_samples_consent_feature.yml +++ b/detections/endpoint/disable_defender_submit_samples_consent_feature.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: his analytic is to detect a suspicious modification of registry to disable windows defender feature. This technique is to bypassed or evade detection from Windows Defender AV product specially the submit samples feature for further analysis.. @@ -60,13 +61,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_etw_through_registry.yml b/detections/endpoint/disable_etw_through_registry.yml index b29449cebb..868806d19a 100644 --- a/detections/endpoint/disable_etw_through_registry.yml +++ b/detections/endpoint/disable_etw_through_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: this search is to identify modification in registry to disable ETW windows feature to evade detections. This technique was seen in several ransomware, RAT and even APT to impaire defenses of the compromise machine and to be able to execute @@ -47,12 +48,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/disable_logs_using_wevtutil.yml b/detections/endpoint/disable_logs_using_wevtutil.yml index 42a6106f04..7fe9cd03bc 100644 --- a/detections/endpoint/disable_logs_using_wevtutil.yml +++ b/detections/endpoint/disable_logs_using_wevtutil.yml @@ -5,7 +5,7 @@ date: '2021-06-10' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect execution of wevtutil.exe to disable logs. This technique was seen in several ransomware to disable the event logs to evade alerts and detections. @@ -50,15 +50,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process_guid risk_score: 24 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_registry_tool.yml b/detections/endpoint/disable_registry_tool.yml index 39f23f330c..bd1e31e428 100644 --- a/detections/endpoint/disable_registry_tool.yml +++ b/detections/endpoint/disable_registry_tool.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search identifies modification of registry to disable the regedit or registry tools of the windows operating system. Since registry tool is a swiss knife in analyzing registry, malware such as RAT or trojan Spy disable this application @@ -60,12 +61,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name risk_score: 40 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_schedule_task.yml b/detections/endpoint/disable_schedule_task.yml index 9a5bce2c78..b3a0e0ce62 100644 --- a/detections/endpoint/disable_schedule_task.yml +++ b/detections/endpoint/disable_schedule_task.yml @@ -5,7 +5,7 @@ date: '2021-10-18' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious commandline to disable existing schedule task. This technique is used by adversaries or commodity malware like IceID to disable security application (AV products) in the targetted host to evade detections. @@ -53,11 +53,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.user - - Processes.process_name - - Processes.parent_process_name - - Processes.dest risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_security_logs_using_minint_registry.yml b/detections/endpoint/disable_security_logs_using_minint_registry.yml index 8ff1bc575c..25c7cee522 100644 --- a/detections/endpoint/disable_security_logs_using_minint_registry.yml +++ b/detections/endpoint/disable_security_logs_using_minint_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious registry modification to disable security audit logs. This technique was shared by a researcher to disable Security logs of windows by adding this registry. The Windows will think it is WinPE and @@ -61,13 +62,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_show_hidden_files.yml b/detections/endpoint/disable_show_hidden_files.yml index ced2b6bebf..f0925a38ab 100644 --- a/detections/endpoint/disable_show_hidden_files.yml +++ b/detections/endpoint/disable_show_hidden_files.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following analytic is to identify a modification in the Windows registry to prevent users from seeing all the files with hidden attributes. This event or techniques are known on some worm and trojan spy malware that will drop hidden files @@ -63,11 +64,19 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_nam risk_score: 40 security_domain: endpoint diff --git a/detections/endpoint/disable_uac_remote_restriction.yml b/detections/endpoint/disable_uac_remote_restriction.yml index a8f72f0663..70a14acc92 100644 --- a/detections/endpoint/disable_uac_remote_restriction.yml +++ b/detections/endpoint/disable_uac_remote_restriction.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of registry to disable UAC remote restriction. This technique was well documented in Microsoft page where attacker may modify this registry value to bypassed UAC feature of windows host. @@ -65,13 +66,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.registry_value_data risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_windows_app_hotkeys.yml b/detections/endpoint/disable_windows_app_hotkeys.yml index e65a348ce7..8536f1aae6 100644 --- a/detections/endpoint/disable_windows_app_hotkeys.yml +++ b/detections/endpoint/disable_windows_app_hotkeys.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic detects a suspicious registry modification to disable Windows hotkey (shortcut keys) for native Windows applications. This technique is commonly used to disable certain or several Windows applications like `taskmgr.exe` and `cmd.exe`. @@ -62,11 +63,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user risk_score: 40 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_windows_behavior_monitoring.yml b/detections/endpoint/disable_windows_behavior_monitoring.yml index 2117620028..c03c79cb4b 100644 --- a/detections/endpoint/disable_windows_behavior_monitoring.yml +++ b/detections/endpoint/disable_windows_behavior_monitoring.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. @@ -67,12 +68,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name risk_score: 40 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disable_windows_smartscreen_protection.yml b/detections/endpoint/disable_windows_smartscreen_protection.yml index 6f5fa6cbd7..1f0e1740f2 100644 --- a/detections/endpoint/disable_windows_smartscreen_protection.yml +++ b/detections/endpoint/disable_windows_smartscreen_protection.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following search identifies a modification of registry to disable the smartscreen protection of windows machine. This is windows feature provide an early warning system against website that might engage in phishing attack or malware @@ -63,11 +64,19 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_nam risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/disabling_cmd_application.yml b/detections/endpoint/disabling_cmd_application.yml index 6352615096..d127d0c550 100644 --- a/detections/endpoint/disabling_cmd_application.yml +++ b/detections/endpoint/disabling_cmd_application.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: this search is to identify modification in registry to disable cmd prompt application. This technique is commonly seen in RAT, Trojan or WORM to prevent triaging or deleting there samples through cmd application which is one of the tool of analyst @@ -64,12 +65,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disabling_controlpanel.yml b/detections/endpoint/disabling_controlpanel.yml index 1e511acb0e..c9b3a4f375 100644 --- a/detections/endpoint/disabling_controlpanel.yml +++ b/detections/endpoint/disabling_controlpanel.yml @@ -5,7 +5,8 @@ date: '2022-01-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: this search is to identify registry modification to disable control panel window. This technique is commonly seen in malware to prevent their artifacts , persistence removed on the infected machine. @@ -63,12 +64,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disabling_defender_services.yml b/detections/endpoint/disabling_defender_services.yml index 954a4147b9..690a89fb5a 100644 --- a/detections/endpoint/disabling_defender_services.yml +++ b/detections/endpoint/disabling_defender_services.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This particular behavior is typically executed when an adversaries or malware gains access to an endpoint and beings to perform execution and to evade detections. Usually, a batch (.bat) will be executed and multiple registry and scheduled @@ -63,13 +64,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disabling_firewall_with_netsh.yml b/detections/endpoint/disabling_firewall_with_netsh.yml index dd4de0a3cd..c2a46c9cdd 100644 --- a/detections/endpoint/disabling_firewall_with_netsh.yml +++ b/detections/endpoint/disabling_firewall_with_netsh.yml @@ -5,7 +5,7 @@ date: '2021-03-31' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to identifies suspicious firewall disabling using netsh application. this technique is commonly seen in malware that tries to communicate or download its component or other payload to its C2 server. @@ -57,18 +57,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disabling_folderoptions_windows_feature.yml b/detections/endpoint/disabling_folderoptions_windows_feature.yml index b55293c3ce..38e1fb45af 100644 --- a/detections/endpoint/disabling_folderoptions_windows_feature.yml +++ b/detections/endpoint/disabling_folderoptions_windows_feature.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to identify registry modification to disable folder options feature of windows to show hidden files, file extension and etc. This technique used by malware in combination if disabling show hidden files feature to hide their @@ -65,11 +66,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/disabling_net_user_account.yml b/detections/endpoint/disabling_net_user_account.yml index c048edf698..2d5e0e4a74 100644 --- a/detections/endpoint/disabling_net_user_account.yml +++ b/detections/endpoint/disabling_net_user_account.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify a suspicious command-line that disables a user account using the `net.exe` utility native to Windows. This technique may used by the adversaries to interrupt availability of such users to do their malicious @@ -64,18 +64,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disabling_norun_windows_app.yml b/detections/endpoint/disabling_norun_windows_app.yml index cf96acc806..2397299a56 100644 --- a/detections/endpoint/disabling_norun_windows_app.yml +++ b/detections/endpoint/disabling_norun_windows_app.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to identify modification of registry to disable run application in window start menu. this application is known to be a helpful shortcut to windows OS user to run known application and also to execute some reg or batch script. This @@ -67,12 +68,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disabling_remote_user_account_control.yml b/detections/endpoint/disabling_remote_user_account_control.yml index d0ea85b197..fcd653f612 100644 --- a/detections/endpoint/disabling_remote_user_account_control.yml +++ b/detections/endpoint/disabling_remote_user_account_control.yml @@ -4,7 +4,8 @@ version: 4 date: '2020-11-18' author: David Dorsey, Patrick Bareiss, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint.Registry description: The search looks for modifications to registry keys that control the enforcement of Windows User Account Control (UAC). search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -61,12 +62,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Registry.action + - Endpoint.Registry.dest + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_value_name - - Registry.dest - - Registry.registry_key_name - - Registry.user - - Registry.action risk_score: 42 security_domain: endpoint diff --git a/detections/endpoint/disabling_systemrestore_in_registry.yml b/detections/endpoint/disabling_systemrestore_in_registry.yml index 02bf9ee4e6..0ad46ada60 100644 --- a/detections/endpoint/disabling_systemrestore_in_registry.yml +++ b/detections/endpoint/disabling_systemrestore_in_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following search identifies the modification of registry related in disabling the system restore of a machine. This event or behavior are seen in some RAT malware to make the restore of the infected machine difficult and keep @@ -66,12 +67,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/disabling_task_manager.yml b/detections/endpoint/disabling_task_manager.yml index dea2692223..c113937187 100644 --- a/detections/endpoint/disabling_task_manager.yml +++ b/detections/endpoint/disabling_task_manager.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to identifies modification of registry to disable the task manager of windows operating system. this event or technique are commonly seen in malware such as RAT, Trojan, TrojanSpy or worm to prevent the user to terminate @@ -65,12 +66,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml index 31e8145593..892fda08e0 100644 --- a/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/dllhost_with_no_command_line_arguments_with_network.yml @@ -5,7 +5,8 @@ date: '2021-10-13' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Ports +- Endpoint.Processes description: The following analytic identifies DLLHost.exe with no command line arguments with a network connection. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, @@ -68,12 +69,19 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Ports.dest + - Endpoint.Ports.dest_port + - Endpoint.Ports.process_guid + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - EventID - - process_name - - process_id - - parent_process_name - dest_port + - parent_process_name + - process_name - process_path risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml index 739eb1ad54..5cfa3a33ac 100644 --- a/detections/endpoint/dns_exfiltration_using_nslookup_app.yml +++ b/detections/endpoint/dns_exfiltration_using_nslookup_app.yml @@ -5,7 +5,7 @@ date: '2021-04-15' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique @@ -71,18 +71,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/domain_account_discovery_with_dsquery.yml b/detections/endpoint/domain_account_discovery_with_dsquery.yml index a529264fd2..85117f4030 100644 --- a/detections/endpoint/domain_account_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_account_discovery_with_dsquery.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover domain users. The `user` argument returns a list of all users registered in the domain. Red Teams and adversaries alike engage in @@ -59,14 +59,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/domain_account_discovery_with_net_app.yml b/detections/endpoint/domain_account_discovery_with_net_app.yml index d08b791f3f..05b0d85ce0 100644 --- a/detections/endpoint/domain_account_discovery_with_net_app.yml +++ b/detections/endpoint/domain_account_discovery_with_net_app.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike may use net.exe to enumerate domain users for situational awareness and Active @@ -59,15 +59,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/domain_account_discovery_with_wmic.yml b/detections/endpoint/domain_account_discovery_with_wmic.yml index 5069bf4f2a..82c19f5442 100644 --- a/detections/endpoint/domain_account_discovery_with_wmic.yml +++ b/detections/endpoint/domain_account_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain users. Red Teams and adversaries alike use wmic.exe to enumerate domain users for situational awareness and Active Directory @@ -60,15 +60,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/domain_controller_discovery_with_nltest.yml b/detections/endpoint/domain_controller_discovery_with_nltest.yml index f44aa2ab73..be944edb76 100644 --- a/detections/endpoint/domain_controller_discovery_with_nltest.yml +++ b/detections/endpoint/domain_controller_discovery_with_nltest.yml @@ -5,7 +5,7 @@ date: '2021-08-30' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `nltest.exe` with command-line arguments utilized to discover remote systems. The arguments `/dclist:` and '/dsgetdc:', can be used to return a list of all domain controllers. Red Teams and adversaries @@ -50,17 +50,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 21 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/domain_controller_discovery_with_wmic.yml b/detections/endpoint/domain_controller_discovery_with_wmic.yml index 9a3933b67c..d67c52ec2b 100644 --- a/detections/endpoint/domain_controller_discovery_with_wmic.yml +++ b/detections/endpoint/domain_controller_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command line return a list of all domain controllers in a Windows domain. Red Teams and @@ -50,16 +50,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 21 security_domain: endpoint diff --git a/detections/endpoint/domain_group_discovery_with_dsquery.yml b/detections/endpoint/domain_group_discovery_with_dsquery.yml index d0a5bb3640..d3ddc7fd73 100644 --- a/detections/endpoint/domain_group_discovery_with_dsquery.yml +++ b/detections/endpoint/domain_group_discovery_with_dsquery.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to query for domain groups. The argument `group`, returns a list of all domain groups. Red Teams and adversaries alike use may leverage dsquery.exe @@ -50,16 +50,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/domain_group_discovery_with_net.yml b/detections/endpoint/domain_group_discovery_with_net.yml index f591073b41..93bc0b157a 100644 --- a/detections/endpoint/domain_group_discovery_with_net.yml +++ b/detections/endpoint/domain_group_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` with command-line arguments utilized to query for domain groups. The argument `group /domain`, returns a list of all domain groups. Red Teams and adversaries alike use net.exe to enumerate @@ -50,16 +50,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/domain_group_discovery_with_wmic.yml b/detections/endpoint/domain_group_discovery_with_wmic.yml index 80069157d4..54e1732006 100644 --- a/detections/endpoint/domain_group_discovery_with_wmic.yml +++ b/detections/endpoint/domain_group_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for domain groups. The arguments utilized in this command return a list of all domain groups. Red Teams and adversaries alike use wmic.exe @@ -51,16 +51,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/download_files_using_telegram.yml b/detections/endpoint/download_files_using_telegram.yml index a5b1c7c64f..b3b8bcdb63 100644 --- a/detections/endpoint/download_files_using_telegram.yml +++ b/detections/endpoint/download_files_using_telegram.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-05-06' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic will identify a suspicious download by the Telegram application on a Windows system. This behavior was identified on a honeypot where the adversary gained access, installed Telegram and followed through with downloading diff --git a/detections/endpoint/drop_icedid_license_dat.yml b/detections/endpoint/drop_icedid_license_dat.yml index 0906ac0fba..f3a7ad6e44 100644 --- a/detections/endpoint/drop_icedid_license_dat.yml +++ b/detections/endpoint/drop_icedid_license_dat.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-30' author: Teoderick Contreras, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: This search is to detect dropping a suspicious file named as "license.dat" in %appdata%. This behavior seen in latest IcedID malware that contain the actual core bot that will be injected in other process to do banking stealing. diff --git a/detections/endpoint/dsquery_domain_discovery.yml b/detections/endpoint/dsquery_domain_discovery.yml index ae07891213..5e24bf4623 100644 --- a/detections/endpoint/dsquery_domain_discovery.yml +++ b/detections/endpoint/dsquery_domain_discovery.yml @@ -5,7 +5,7 @@ date: '2021-03-31' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies "dsquery.exe" execution with arguments looking for `TrustedDomain` query directly on the command-line. This is typically indicative of an Administrator or adversary perform domain trust discovery. Note @@ -83,14 +83,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml index f0806cf1a4..ea09588f1a 100644 --- a/detections/endpoint/dump_lsass_via_comsvcs_dll.yml +++ b/detections/endpoint/dump_lsass_via_comsvcs_dll.yml @@ -5,7 +5,7 @@ date: '2020-02-21' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Detect the usage of comsvcs.dll for dumping the lsass process. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where `process_rundll32` Processes.process=*comsvcs.dll* @@ -70,18 +70,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/dump_lsass_via_procdump.yml b/detections/endpoint/dump_lsass_via_procdump.yml index ac76cbe814..19adb8a4a5 100644 --- a/detections/endpoint/dump_lsass_via_procdump.yml +++ b/detections/endpoint/dump_lsass_via_procdump.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'Detect procdump.exe dumping the lsass process. This query looks for both -mm and -ma usage. -mm will produce a mini dump file and -ma will write a dump file with all process memory. Both are highly suspect and should be reviewed. This @@ -79,14 +79,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/elevated_group_discovery_with_net.yml b/detections/endpoint/elevated_group_discovery_with_net.yml index 5f4c9e0fb8..a8c63b6231 100644 --- a/detections/endpoint/elevated_group_discovery_with_net.yml +++ b/detections/endpoint/elevated_group_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for specific elevated domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for @@ -57,17 +57,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 21 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/elevated_group_discovery_with_wmic.yml b/detections/endpoint/elevated_group_discovery_with_wmic.yml index bf92cb2add..3361100bda 100644 --- a/detections/endpoint/elevated_group_discovery_with_wmic.yml +++ b/detections/endpoint/elevated_group_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for specific domain groups. Red Teams and adversaries alike use net.exe to enumerate elevated domain groups for situational awareness @@ -55,17 +55,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 21 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/enable_rdp_in_other_port_number.yml b/detections/endpoint/enable_rdp_in_other_port_number.yml index 3ad2ad5db9..f9974a40f5 100644 --- a/detections/endpoint/enable_rdp_in_other_port_number.yml +++ b/detections/endpoint/enable_rdp_in_other_port_number.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to detect a modification to registry to enable rdp to a machine with different port number. This technique was seen in some atttacker tries to do lateral movement and remote access to a compromised machine to gain @@ -61,11 +62,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.dest - - Registry.user - - Registry.registry_value_name risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml index cc55d2f898..57588d47e5 100644 --- a/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml +++ b/detections/endpoint/enable_wdigest_uselogoncredential_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious registry modification to enable plain text credential feature of windows. This technique was used by several malware and also by mimikatz to be able to dumpe the a plain text credential to the compromised @@ -66,13 +67,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_data risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/enumerate_users_local_group_using_telegram.yml b/detections/endpoint/enumerate_users_local_group_using_telegram.yml index c560e7562a..d51d756d15 100644 --- a/detections/endpoint/enumerate_users_local_group_using_telegram.yml +++ b/detections/endpoint/enumerate_users_local_group_using_telegram.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-05-06' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will detect a suspicious Telegram process enumerating all network users in a local group. This technique was seen in a Monero infected honeypot to mapped all the users on the compromised system. EventCode 4798 is generated when diff --git a/detections/endpoint/esentutl_sam_copy.yml b/detections/endpoint/esentutl_sam_copy.yml index 3daea35709..418685a025 100644 --- a/detections/endpoint/esentutl_sam_copy.yml +++ b/detections/endpoint/esentutl_sam_copy.yml @@ -5,7 +5,7 @@ date: '2021-08-18' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the process - `esentutl.exe` - being used to capture credentials stored in ntds.dit or the SAM file on disk. During triage, review parallel processes and determine if legitimate activity. Upon determination @@ -66,17 +66,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/etw_registry_disabled.yml b/detections/endpoint/etw_registry_disabled.yml index 041d54c3a3..6ca2a31359 100644 --- a/detections/endpoint/etw_registry_disabled.yml +++ b/detections/endpoint/etw_registry_disabled.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a registry modification to disable ETW feature of windows. This technique is to evade EDR appliance to evade detections and hide its execution from audit logs. @@ -66,13 +67,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.registry_value_data risk_score: 90 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/eventvwr_uac_bypass.yml b/detections/endpoint/eventvwr_uac_bypass.yml index 9669c84655..5e37b82160 100644 --- a/detections/endpoint/eventvwr_uac_bypass.yml +++ b/detections/endpoint/eventvwr_uac_bypass.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following search identifies Eventvwr bypass by identifying the registry modification into a specific path that eventvwr.msc looks to (but is not valid) upon execution. A successful attack will include a suspicious command to be executed @@ -71,12 +72,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/excel_spawning_powershell.yml b/detections/endpoint/excel_spawning_powershell.yml index b838d060fa..c3e68dc910 100644 --- a/detections/endpoint/excel_spawning_powershell.yml +++ b/detections/endpoint/excel_spawning_powershell.yml @@ -5,7 +5,7 @@ date: '2021-04-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Microsoft Excel spawning PowerShell. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` @@ -69,17 +69,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/excel_spawning_windows_script_host.yml b/detections/endpoint/excel_spawning_windows_script_host.yml index e808a71e12..41b78bdd98 100644 --- a/detections/endpoint/excel_spawning_windows_script_host.yml +++ b/detections/endpoint/excel_spawning_windows_script_host.yml @@ -5,7 +5,7 @@ date: '2021-04-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Microsoft Excel spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Excel.exe. Excel.exe will generally be found in the following path @@ -71,12 +71,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - process_name - - process_id - - parent_process_name - dest + - parent_process_name + - process_name - user - - parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/excessive_attempt_to_disable_services.yml b/detections/endpoint/excessive_attempt_to_disable_services.yml index 7726131774..16b84359c9 100644 --- a/detections/endpoint/excessive_attempt_to_disable_services.yml +++ b/detections/endpoint/excessive_attempt_to_disable_services.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify suspicious series of command-line to disable several services. This technique is seen where the adversary attempts to disable security app services or other malware services to complete the objective on the @@ -55,13 +55,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.process_id - - Processes.process_name - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml index 6802ab9d27..0fd77975fc 100644 --- a/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml +++ b/detections/endpoint/excessive_file_deletion_in_windefender_folder.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-01-20' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will identify excessive file deletion events in the Windows Defender folder. This technique was seen in the WhisperGate malware campaign in which adversaries abused Nirsofts advancedrun.exe to gain administrative privilege diff --git a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml index 986e23feaf..f9bb2cfd79 100644 --- a/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml +++ b/detections/endpoint/excessive_number_of_distinct_processes_created_in_windows_temp_folder.yml @@ -5,7 +5,7 @@ date: '2022-02-28' author: Michael Hart, Mauricio Velazco, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify suspicious series of process executions. We have observed that post exploit framework tools like Koadic and Meterpreter will launch an excessive number of processes with distinct file paths from Windows\Temp @@ -52,10 +52,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.process + - Endpoint.Processes.process_path + - Endpoint.Processes.user - _time - - Processes.process - - Processes.dest - - Processes.user risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml index bac83efcff..cb8f1a47ec 100644 --- a/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml +++ b/detections/endpoint/excessive_number_of_service_control_start_as_disabled.yml @@ -5,7 +5,7 @@ date: '2021-06-25' author: Michael Hart, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This detection targets behaviors observed when threat actors have used sc.exe to modify services. We observed malware in a honey pot spawning numerous sc.exe processes in a short period of time, presumably to impair defenses, possibly @@ -63,14 +63,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/excessive_number_of_taskhost_processes.yml b/detections/endpoint/excessive_number_of_taskhost_processes.yml index 4ddb7bef7a..0aaf40439c 100644 --- a/detections/endpoint/excessive_number_of_taskhost_processes.yml +++ b/detections/endpoint/excessive_number_of_taskhost_processes.yml @@ -5,7 +5,7 @@ date: '2021-06-07' author: Michael Hart type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This detection targets behaviors observed in post exploit kits like Meterpreter and Koadic that are run in memory. We have observed that these tools must invoke an excessive number of taskhost.exe and taskhostex.exe processes to complete various @@ -60,11 +60,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name - _time - - Processes.process_id - - Processes.process_name - - Processes.dest - - Processes.user risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/excessive_service_stop_attempt.yml b/detections/endpoint/excessive_service_stop_attempt.yml index 6c46da14ca..175c668f4a 100644 --- a/detections/endpoint/excessive_service_stop_attempt.yml +++ b/detections/endpoint/excessive_service_stop_attempt.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies suspicious series of attempt to kill multiple services on a system using either `net.exe` or `sc.exe`. This technique is use by adversaries to terminate security services or other related services to continue @@ -58,18 +58,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/excessive_usage_of_cacls_app.yml b/detections/endpoint/excessive_usage_of_cacls_app.yml index 4bac489fdd..1f21d55b13 100644 --- a/detections/endpoint/excessive_usage_of_cacls_app.yml +++ b/detections/endpoint/excessive_usage_of_cacls_app.yml @@ -5,7 +5,7 @@ date: '2021-05-07' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe` or `icacls.exe` application to change file or folder permission. This behavior is commonly seen where the adversary attempts to impair some users from deleting or @@ -55,13 +55,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.process_id - - Processes.process_name - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/excessive_usage_of_net_app.yml b/detections/endpoint/excessive_usage_of_net_app.yml index 107c0ce90d..505c1b26bc 100644 --- a/detections/endpoint/excessive_usage_of_net_app.yml +++ b/detections/endpoint/excessive_usage_of_net_app.yml @@ -5,7 +5,7 @@ date: '2021-05-06' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies excessive usage of `net.exe` or `net1.exe` within a bucket of time (1 minute). This behavior was seen in a Monero incident where the adversary attempts to create many users, delete and disable users as part of its @@ -62,18 +62,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 28 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/excessive_usage_of_nslookup_app.yml b/detections/endpoint/excessive_usage_of_nslookup_app.yml index 48b38da855..02700408af 100644 --- a/detections/endpoint/excessive_usage_of_nslookup_app.yml +++ b/detections/endpoint/excessive_usage_of_nslookup_app.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-21' author: Teoderick Contreras, Stanislav Miskovic, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect potential DNS exfiltration using nslookup application. This technique are seen in couple of malware and APT group to exfiltrated collected data in a infected machine or infected network. This detection is looking for unique diff --git a/detections/endpoint/excessive_usage_of_sc_service_utility.yml b/detections/endpoint/excessive_usage_of_sc_service_utility.yml index 62ea23123b..41d68e22ce 100644 --- a/detections/endpoint/excessive_usage_of_sc_service_utility.yml +++ b/detections/endpoint/excessive_usage_of_sc_service_utility.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-06-24' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious excessive usage of sc.exe in a host machine. This technique was seen in several ransomware , xmrig and other malware to create, modify, delete or disable a service may related to security application diff --git a/detections/endpoint/excessive_usage_of_taskkill.yml b/detections/endpoint/excessive_usage_of_taskkill.yml index 8f76b5ab68..0a0db340f9 100644 --- a/detections/endpoint/excessive_usage_of_taskkill.yml +++ b/detections/endpoint/excessive_usage_of_taskkill.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies excessive usage of `taskkill.exe` application. This application is commonly used by adversaries to evade detections by killing security product processes or even other processes to evade detection. @@ -59,13 +59,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.process_name - - Processes.dest - - Processes.user - - Processes.process - - Processes.process_id risk_score: 28 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml index f3b5cf9ca5..75e6d5b0ed 100644 --- a/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml +++ b/detections/endpoint/executables_or_script_creation_in_suspicious_path.yml @@ -5,7 +5,7 @@ date: '2021-05-06' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic will identify suspicious executable or scripts (known file extensions) in list of suspicious file path in Windows. This technique is used by adversaries to evade detection. The suspicious file path are known paths used in @@ -72,12 +72,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_id + - Endpoint.Filesystem.user - _time - - Filesystem.file_path - - Filesystem.file_create_time - - Filesystem.process_id - - Filesystem.file_name - - Filesystem.user risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml index 9a8c8241a2..421bf86ce2 100644 --- a/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml +++ b/detections/endpoint/execute_javascript_with_jscript_com_clsid.yml @@ -5,7 +5,7 @@ date: '2021-06-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify suspicious process of cscript.exe where it tries to execute javascript using jscript.encode CLSID (COM OBJ). This technique was seen in ransomware (reddot ransomware) where it execute javascript with this @@ -64,14 +64,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.parent_process - - Processes.process_id - - Processes.dest - - Processes.user risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/execution_of_file_with_multiple_extensions.yml b/detections/endpoint/execution_of_file_with_multiple_extensions.yml index 42dcd578c5..d031132a18 100644 --- a/detections/endpoint/execution_of_file_with_multiple_extensions.yml +++ b/detections/endpoint/execution_of_file_with_multiple_extensions.yml @@ -5,7 +5,7 @@ date: '2020-11-18' author: Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for processes launched from files that have double extensions in the file name. This is typically done to obscure the "real" file extension and make it appear as though the file being accessed is a data file, as opposed @@ -67,11 +67,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.process + - Endpoint.Processes.user - _time - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/extraction_of_registry_hives.yml b/detections/endpoint/extraction_of_registry_hives.yml index cb08f69826..d9045512f0 100644 --- a/detections/endpoint/extraction_of_registry_hives.yml +++ b/detections/endpoint/extraction_of_registry_hives.yml @@ -5,7 +5,7 @@ date: '2021-09-09' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of `reg.exe` exporting Windows Registry hives containing credentials. Adversaries may use this technique to export registry hives for offline credential access attacks. Typically found executed from @@ -64,18 +64,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/file_with_samsam_extension.yml b/detections/endpoint/file_with_samsam_extension.yml index bd44cb5cf9..907dd66247 100644 --- a/detections/endpoint/file_with_samsam_extension.yml +++ b/detections/endpoint/file_with_samsam_extension.yml @@ -5,7 +5,7 @@ date: '2018-12-14' author: Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: The search looks for file writes with extensions consistent with a SamSam ransomware attack. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -62,11 +62,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.user - _time - - Filesystem.user - - Filesystem.dest - - Filesystem.file_path - - Filesystem.file_name risk_score: 90 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/firewall_allowed_program_enable.yml b/detections/endpoint/firewall_allowed_program_enable.yml index d76c1302c7..a016d6c9bc 100644 --- a/detections/endpoint/firewall_allowed_program_enable.yml +++ b/detections/endpoint/firewall_allowed_program_enable.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic detects a potential suspicious modification of firewall rule allowing to execute specific application. This technique was identified when an adversary and red teams to bypassed firewall file execution restriction in a @@ -56,15 +56,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/fodhelper_uac_bypass.yml b/detections/endpoint/fodhelper_uac_bypass.yml index a92768317f..48f66394ab 100644 --- a/detections/endpoint/fodhelper_uac_bypass.yml +++ b/detections/endpoint/fodhelper_uac_bypass.yml @@ -5,7 +5,7 @@ date: '2021-03-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'Fodhelper.exe has a known UAC bypass as it attempts to look for specific registry keys upon execution, that do not exist. Therefore, an attacker can write its malicious commands in these registry keys to be executed by fodhelper.exe with @@ -75,15 +75,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 81 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/fsutil_zeroing_file.yml b/detections/endpoint/fsutil_zeroing_file.yml index 53787bc8c5..6202f47d5c 100644 --- a/detections/endpoint/fsutil_zeroing_file.yml +++ b/detections/endpoint/fsutil_zeroing_file.yml @@ -5,7 +5,7 @@ date: '2021-08-11' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious fsutil process to zeroing a target file. This technique was seen in lockbit ransomware where it tries to zero out its malware path as part of its defense evasion after encrypting the compromised host. @@ -48,13 +48,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.user - - Processes.process_name - - Processes.parent_process_name - - Processes.dest - - Processes.process - - Processes.parent_process risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml index b41274ac38..e8732a2ed6 100644 --- a/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_addefaultdomainpasswordpolicy_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-26' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` executing the Get-ADDefaultDomainPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate @@ -60,14 +60,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/get_aduser_with_powershell.yml b/detections/endpoint/get_aduser_with_powershell.yml index d7d92a915a..5416fc9123 100644 --- a/detections/endpoint/get_aduser_with_powershell.yml +++ b/detections/endpoint/get_aduser_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. The `Get-AdUser' commandlet returns a list of all domain users. Red Teams and adversaries alike may use this commandlet @@ -61,14 +61,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml index ff29d907d3..8f37c2314d 100644 --- a/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml +++ b/detections/endpoint/get_aduserresultantpasswordpolicy_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` executing the Get ADUserResultantPasswordPolicy commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate @@ -60,15 +60,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/get_domainpolicy_with_powershell.yml b/detections/endpoint/get_domainpolicy_with_powershell.yml index a47bfa8f2e..1fc25c0b39 100644 --- a/detections/endpoint/get_domainpolicy_with_powershell.yml +++ b/detections/endpoint/get_domainpolicy_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` executing the `Get-DomainPolicy` commandlet used to obtain the password policy in a Windows domain. Red Teams and adversaries alike may use PowerShell to enumerate domain policies @@ -60,15 +60,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 30 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/get_domaintrust_with_powershell.yml b/detections/endpoint/get_domaintrust_with_powershell.yml index 549a7639fb..ca5d242e66 100644 --- a/detections/endpoint/get_domaintrust_with_powershell.yml +++ b/detections/endpoint/get_domaintrust_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies Get-DomainTrust from PowerView in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary an @@ -57,18 +57,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 12 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml index 8ad1cbdf75..21055c409d 100644 --- a/detections/endpoint/get_domaintrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_domaintrust_with_powershell_script_block.yml @@ -66,12 +66,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - ComputerName - EventCode - Message - - Path - - OpCode - - ComputerName - User + - _time risk_score: 12 security_domain: endpoint diff --git a/detections/endpoint/get_domainuser_with_powershell.yml b/detections/endpoint/get_domainuser_with_powershell.yml index 2977e9943a..df19ebf2b4 100644 --- a/detections/endpoint/get_domainuser_with_powershell.yml +++ b/detections/endpoint/get_domainuser_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to enumerate domain users. `Get-DomainUser` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and @@ -60,15 +60,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/get_foresttrust_with_powershell.yml b/detections/endpoint/get_foresttrust_with_powershell.yml index 3a7aed21ae..fd31b5cda1 100644 --- a/detections/endpoint/get_foresttrust_with_powershell.yml +++ b/detections/endpoint/get_foresttrust_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-02' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies Get-ForestTrust from PowerSploit in order to gather domain trust information. Typically, this is utilized within a script being executed and used to enumerate the domain trust information. This grants the adversary @@ -58,18 +58,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 12 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml index d04a74656a..96b44ab9d1 100644 --- a/detections/endpoint/get_foresttrust_with_powershell_script_block.yml +++ b/detections/endpoint/get_foresttrust_with_powershell_script_block.yml @@ -57,12 +57,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - ComputerName - EventCode - Message - - Path - OpCode - - ComputerName - User + - _time risk_score: 12 security_domain: endpoint diff --git a/detections/endpoint/get_wmiobject_group_discovery.yml b/detections/endpoint/get_wmiobject_group_discovery.yml index b162b59416..f23926266a 100644 --- a/detections/endpoint/get_wmiobject_group_discovery.yml +++ b/detections/endpoint/get_wmiobject_group_discovery.yml @@ -5,7 +5,7 @@ date: '2021-09-14' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting analytic identifies the use of `Get-WMIObject Win32_Group` being used with PowerShell to identify local groups on the endpoint. \ Typically, by itself, is not malicious but may raise suspicion based on time of day, endpoint @@ -13,7 +13,7 @@ description: The following hunting analytic identifies the use of `Get-WMIObject suspicious behavior. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name=powershell.exe - OR processes.process_name=cmd.exe) (Processes.process="*Get-WMIObject*" AND Processes.process="*Win32_Group*") + OR Processes.process_name=cmd.exe) (Processes.process="*Get-WMIObject*" AND Processes.process="*Win32_Group*") by Processes.dest Processes.user Processes.parent_process_name Processes.process_name Processes.process Processes.original_file_name Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | @@ -59,17 +59,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/getadcomputer_with_powershell.yml b/detections/endpoint/getadcomputer_with_powershell.yml index 76b9ac8495..000caf937a 100644 --- a/detections/endpoint/getadcomputer_with_powershell.yml +++ b/detections/endpoint/getadcomputer_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-07' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-AdComputer' commandlet returns a list of all domain computers. Red Teams and adversaries alike may use this commandlet @@ -49,16 +49,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/getadgroup_with_powershell.yml b/detections/endpoint/getadgroup_with_powershell.yml index db1c10b8d6..9000830d40 100644 --- a/detections/endpoint/getadgroup_with_powershell.yml +++ b/detections/endpoint/getadgroup_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-AdGroup` commandlnet is used to return a list of all groups available in a Windows Domain. Red Teams and @@ -52,16 +52,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/getcurrent_user_with_powershell.yml b/detections/endpoint/getcurrent_user_with_powershell.yml index 01e7598eea..eb04466494 100644 --- a/detections/endpoint/getcurrent_user_with_powershell.yml +++ b/detections/endpoint/getcurrent_user_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-13' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powerhsell.exe` with command-line arguments that execute the `GetCurrent` method of the WindowsIdentity .NET class. This method returns an object that represents the current Windows user. Red Teams @@ -50,17 +50,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml index d1892d1e2a..2f0db17e67 100644 --- a/detections/endpoint/getcurrent_user_with_powershell_script_block.yml +++ b/detections/endpoint/getcurrent_user_with_powershell_script_block.yml @@ -49,12 +49,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Path - - Message - - OpCode - ComputerName - - User - EventCode + - Message + - User + - _time risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/getdomaincomputer_with_powershell.yml b/detections/endpoint/getdomaincomputer_with_powershell.yml index 4da1c3199e..7734ae695e 100644 --- a/detections/endpoint/getdomaincomputer_with_powershell.yml +++ b/detections/endpoint/getdomaincomputer_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-07' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainComputer` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and @@ -50,17 +50,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 24 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/getdomaincontroller_with_powershell.yml b/detections/endpoint/getdomaincontroller_with_powershell.yml index fedfa7eaf9..e07c64cd22 100644 --- a/detections/endpoint/getdomaincontroller_with_powershell.yml +++ b/detections/endpoint/getdomaincontroller_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-07' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. `Get-DomainController` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red @@ -51,16 +51,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 24 security_domain: endpoint diff --git a/detections/endpoint/getdomaingroup_with_powershell.yml b/detections/endpoint/getdomaingroup_with_powershell.yml index e3797d79ed..c53d4acb5d 100644 --- a/detections/endpoint/getdomaingroup_with_powershell.yml +++ b/detections/endpoint/getdomaingroup_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. `Get-DomainGroup` is part of PowerView, a PowerShell tool used to perform enumeration on Windows domains. Red Teams and @@ -52,17 +52,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/getlocaluser_with_powershell.yml b/detections/endpoint/getlocaluser_with_powershell.yml index 020615cadd..b7eb24b83c 100644 --- a/detections/endpoint/getlocaluser_with_powershell.yml +++ b/detections/endpoint/getlocaluser_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-23' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for local users. The `Get-LocalUser` commandlet is used to return a list of all local users. Red Teams and adversaries may leverage this @@ -50,6 +50,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/getnettcpconnection_with_powershell.yml b/detections/endpoint/getnettcpconnection_with_powershell.yml index 4dc7f09e60..7ace29c4fc 100644 --- a/detections/endpoint/getnettcpconnection_with_powershell.yml +++ b/detections/endpoint/getnettcpconnection_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line utilized to get a listing of network connections on a compromised system. The `Get-NetTcpConnection` commandlet lists the current TCP connections. Red Teams and adversaries alike may @@ -50,16 +50,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml index 71659ca87e..38db3ff0e0 100644 --- a/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_computer_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-07' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to discover remote systems. The `Get-WmiObject` commandlet combined with the `DS_Computer` parameter can be used to return a list of all domain computers. @@ -51,17 +51,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 21 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml index 37f46c9956..764ecf7b8e 100644 --- a/detections/endpoint/getwmiobject_ds_group_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_group_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-25' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain groups. The `Get-WmiObject` commandlet combined with the `-class ds_group` parameter can be used to return the full list of groups @@ -54,17 +54,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml index 9b10a7f427..23d5330b36 100644 --- a/detections/endpoint/getwmiobject_ds_user_with_powershell.yml +++ b/detections/endpoint/getwmiobject_ds_user_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-24' author: Teoderick Contreras, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query for domain users. The `Get-WmiObject` commandlet combined with the `-class ds_user` parameter can be used to return the full list of users @@ -62,15 +62,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 25 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/getwmiobject_user_account_with_powershell.yml b/detections/endpoint/getwmiobject_user_account_with_powershell.yml index f8d752fb4a..9f853264d2 100644 --- a/detections/endpoint/getwmiobject_user_account_with_powershell.yml +++ b/detections/endpoint/getwmiobject_user_account_with_powershell.yml @@ -5,7 +5,7 @@ date: '2021-08-23' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments utilized to query local users. The `Get-WmiObject` commandlet combined with the `Win32_UserAccount` parameter is used to return a list of all local users. @@ -51,6 +51,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml index f009546893..ef7c9cdfda 100644 --- a/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/gpupdate_with_no_command_line_arguments_with_network.yml @@ -5,7 +5,8 @@ date: '2021-04-19' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Ports +- Endpoint.Processes description: The following analytic identifies gpupdate.exe with no command line arguments and with a network connection. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious @@ -72,12 +73,19 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Ports.dest + - Endpoint.Ports.dest_port + - Endpoint.Ports.process_guid + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - EventID - - process_name - - process_id - - parent_process_name - dest_port + - parent_process_name + - process_name - process_path risk_score: 81 security_domain: endpoint diff --git a/detections/endpoint/hide_user_account_from_sign_in_screen.yml b/detections/endpoint/hide_user_account_from_sign_in_screen.yml index eac5da28f8..726d2986c8 100644 --- a/detections/endpoint/hide_user_account_from_sign_in_screen.yml +++ b/detections/endpoint/hide_user_account_from_sign_in_screen.yml @@ -5,7 +5,8 @@ date: '2022-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic identifies a suspicious registry modification to hide a user account on the Windows Login screen. This technique was seen in some tradecraft where the adversary will create a hidden user account with Admin privileges in login @@ -72,11 +73,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml index 8d475b0572..9cc12e21aa 100644 --- a/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml +++ b/detections/endpoint/hiding_files_and_directories_with_attrib_exe.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Attackers leverage an existing Windows binary, attrib.exe, to mark specific as hidden by using specific flags so that the victim does not see the file. The search looks for specific command-line arguments to detect the use of attrib.exe @@ -66,12 +66,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.process_name - - Processes.parent_process - - Processes.user - - Processes.dest risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml index 6b7b613d2b..b5133a6bdf 100644 --- a/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml +++ b/detections/endpoint/high_frequency_copy_of_files_in_network_share.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-16' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This analytic is to detect a suspicious high frequency copying/moving of files in network share as part of information sabotage. This anomaly event can be a good indicator of insider trying to sabotage data by transfering classified diff --git a/detections/endpoint/high_process_termination_frequency.yml b/detections/endpoint/high_process_termination_frequency.yml index 7c46bf863c..fff2824a7f 100644 --- a/detections/endpoint/high_process_termination_frequency.yml +++ b/detections/endpoint/high_process_termination_frequency.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-03-16' author: Teoderick Contreras type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This analytics are designed to indentify a high frequency of process termination on a machine which is a common behavior of ransomware malware before encrypting files. This technique is designed to avoid an exception error while accessing diff --git a/detections/endpoint/hunting_for_log4shell.yml b/detections/endpoint/hunting_for_log4shell.yml index 21de6d3f2e..02593ba1b0 100644 --- a/detections/endpoint/hunting_for_log4shell.yml +++ b/detections/endpoint/hunting_for_log4shell.yml @@ -5,7 +5,7 @@ date: '2021-12-14' author: Michael Haag, Splunk type: Hunting datamodel: -- Web +- Web.Web description: 'The following hunting query assists with quickly assessing CVE-2021-44228, or Log4Shell, activity mapped to the Web Datamodel. This is a combination query attempting to identify, score and dashboard. Because the Log4Shell vulnerability @@ -106,13 +106,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Web.http_method - - Web.url - - Web.url_length - - Web.src - - Web.dest - - Web.http_user_agent - _raw risk_score: 40 security_domain: network diff --git a/detections/endpoint/icacls_deny_command.yml b/detections/endpoint/icacls_deny_command.yml index b83fcbeec1..ddcab2a8b8 100644 --- a/detections/endpoint/icacls_deny_command.yml +++ b/detections/endpoint/icacls_deny_command.yml @@ -5,7 +5,7 @@ date: '2021-04-29' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies a potential adversary that changes the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft or coinminer scripts. This behavior is meant to evade detection and prevent @@ -56,13 +56,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.process_name - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/icacls_grant_command.yml b/detections/endpoint/icacls_grant_command.yml index c7d56e34d4..19e32a35b3 100644 --- a/detections/endpoint/icacls_grant_command.yml +++ b/detections/endpoint/icacls_grant_command.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies potential adversaries that modify the security permission of a specific file or directory. This technique is commonly seen in APT tradecraft and coinminer scripts to evade detections and restrict access to their @@ -56,13 +56,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.process_name - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml index 06a6670bcf..a033ac4ce4 100644 --- a/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml +++ b/detections/endpoint/icedid_exfiltrated_archived_file_creation.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-30' author: Teoderick Contreras, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious file creation namely passff.tar and cookie.tar. This files are possible archived of stolen browser information like history and cookies in a compromised machine with IcedID. diff --git a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml index 0668bed541..7ce34beaf6 100644 --- a/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml +++ b/detections/endpoint/impacket_lateral_movement_commandline_parameters.yml @@ -5,7 +5,7 @@ date: '2022-01-18' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the presence of suspicious commandline parameters typically present when using Impacket tools. Impacket is a collection of python classes meant to be used with Microsoft network protocols. There are multiple scripts @@ -67,18 +67,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/java_class_file_download_by_java_user_agent.yml b/detections/endpoint/java_class_file_download_by_java_user_agent.yml index 03c7bc0dbf..adfe406150 100644 --- a/detections/endpoint/java_class_file_download_by_java_user_agent.yml +++ b/detections/endpoint/java_class_file_download_by_java_user_agent.yml @@ -5,14 +5,14 @@ date: '2021-12-13' author: Michael Haag, Splunk type: TTP datamodel: -- Web +- Web.Web description: The following analytic identifies a Java user agent performing a GET request for a .class file from the remote site. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). -search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*" Web.http_method="GET" - Web.url="*.class*" by Web.http_user_agent Web.http_method, Web.url,Web.url_length - Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` +search: '| tstats count from datamodel=Web.Web where Web.http_user_agent="*Java*" + Web.http_method="GET" Web.url="*.class*" by Web.http_user_agent Web.http_method, + Web.url,Web.url_length Web.src, Web.dest | `drop_dm_object_name("Web")` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `java_class_file_download_by_java_user_agent_filter`' how_to_implement: To successfully implement this search, you need to be ingesting web or proxy logs, or ensure it is being filled by a proxy like device, into the @@ -58,12 +58,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Web.http_method - - Web.url - - Web.url_length - - Web.src - - Web.dest - - Web.http_user_agent + - Web.Web.dest + - Web.Web.http_method + - Web.Web.http_user_agent + - Web.Web.src + - Web.Web.url + - Web.Web.url_length risk_score: 40 security_domain: network diff --git a/detections/endpoint/jscript_execution_using_cscript_app.yml b/detections/endpoint/jscript_execution_using_cscript_app.yml index ab7430fa8c..ecfce2dba8 100644 --- a/detections/endpoint/jscript_execution_using_cscript_app.yml +++ b/detections/endpoint/jscript_execution_using_cscript_app.yml @@ -5,7 +5,7 @@ date: '2021-09-13' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a execution of jscript using cscript process. Commonly when a user run jscript file it was executed by wscript.exe application. This technique was seen in FIN7 js implant to execute its malicious script using @@ -59,14 +59,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - - Processes.dest - - Processes.user risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml index 80d788cf75..51efd8845f 100644 --- a/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml +++ b/detections/endpoint/kerberos_pre_authentication_flag_disabled_in_useraccountcontrol.yml @@ -51,10 +51,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - EventCode - Account_Name - - Security_ID + - EventCode - MSADChangedAttributes + - Security_ID risk_score: 45 security_domain: endpoint diff --git a/detections/endpoint/known_services_killed_by_ransomware.yml b/detections/endpoint/known_services_killed_by_ransomware.yml index fa8b448f0f..f05aa60ba6 100644 --- a/detections/endpoint/known_services_killed_by_ransomware.yml +++ b/detections/endpoint/known_services_killed_by_ransomware.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-06-04' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search detects a suspicioous termination of known services killed by ransomware before encrypting files in a compromised machine. This technique is commonly seen in most of ransomware now a days to avoid exception error while accessing diff --git a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml index 37bbd7ea38..77154e92b3 100644 --- a/detections/endpoint/linux_add_files_in_known_crontab_directories.yml +++ b/detections/endpoint/linux_add_files_in_known_crontab_directories.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: The following analytic identifies a suspicious file creation in known cron table directories. This event is commonly abuse by malware, adversaries and red teamers to persist on the target or compromised host. crontab or cronjob is @@ -62,11 +62,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid - - Filesystem.file_path risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/linux_add_user_account.yml b/detections/endpoint/linux_add_user_account.yml index a0c781c9f9..c43fed07c5 100644 --- a/detections/endpoint/linux_add_user_account.yml +++ b/detections/endpoint/linux_add_user_account.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for commands to create user accounts on the linux platform. This technique is commonly abuse by adversaries, malware author and red teamers to persist on the targeted or compromised host by creating new user with @@ -60,13 +60,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/linux_at_allow_config_file_creation.yml b/detections/endpoint/linux_at_allow_config_file_creation.yml index 44c01c5905..1e8e124d85 100644 --- a/detections/endpoint/linux_at_allow_config_file_creation.yml +++ b/detections/endpoint/linux_at_allow_config_file_creation.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: The following analytic identifies a suspicious file creation of /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. These config files can restrict @@ -61,11 +61,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid - - Filesystem.file_path risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/linux_at_application_execution.yml b/detections/endpoint/linux_at_application_execution.yml index 6558da85bd..7cbb194cc2 100644 --- a/detections/endpoint/linux_at_application_execution.yml +++ b/detections/endpoint/linux_at_application_execution.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies a suspicious process creation of At application. This process can be used by malware, adversaries and red teamers to create persistence entry to the targeted or compromised host with their malicious @@ -62,13 +62,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/linux_change_file_owner_to_root.yml b/detections/endpoint/linux_change_file_owner_to_root.yml index bee64e143f..17bd1a1951 100644 --- a/detections/endpoint/linux_change_file_owner_to_root.yml +++ b/detections/endpoint/linux_change_file_owner_to_root.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for a commandline that change the file owner to root using chown utility tool. This technique is commonly abuse by adversaries, malware author and red teamers to escalate privilege to the targeted or compromised host @@ -62,13 +62,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/linux_common_process_for_elevation_control.yml b/detections/endpoint/linux_common_process_for_elevation_control.yml index bf83c6c1ee..3b1821fdbb 100644 --- a/detections/endpoint/linux_common_process_for_elevation_control.yml +++ b/detections/endpoint/linux_common_process_for_elevation_control.yml @@ -5,7 +5,7 @@ date: '2021-12-23' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for possible elevation control access using a common known process in linux platform to change the attribute and file ownership. This technique is commonly abused by adversaries, malware author and red teamers @@ -69,13 +69,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/linux_dd_file_overwrite.yml b/detections/endpoint/linux_dd_file_overwrite.yml index 77ed4d3d15..3cb46a20ef 100644 --- a/detections/endpoint/linux_dd_file_overwrite.yml +++ b/detections/endpoint/linux_dd_file_overwrite.yml @@ -5,7 +5,7 @@ date: '2022-02-14' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for dd command to overwrite file. This technique was abused by adversaries or threat actor to destroy files or data on specific system or in a large number of host within network to interrupt host avilability, services @@ -57,13 +57,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/linux_doas_conf_file_creation.yml b/detections/endpoint/linux_doas_conf_file_creation.yml index 1a0d7dce2b..01f93a2954 100644 --- a/detections/endpoint/linux_doas_conf_file_creation.yml +++ b/detections/endpoint/linux_doas_conf_file_creation.yml @@ -5,7 +5,7 @@ date: '2022-01-05' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic is to detect the creation of doas.conf file in linux host platform. This configuration file can be use by doas utility tool to allow or permit standard users to perform tasks as root, the same way sudo does. This tool is developed @@ -62,11 +62,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid - - Filesystem.file_path risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/linux_doas_tool_execution.yml b/detections/endpoint/linux_doas_tool_execution.yml index 0997182fa7..55d42a3055 100644 --- a/detections/endpoint/linux_doas_tool_execution.yml +++ b/detections/endpoint/linux_doas_tool_execution.yml @@ -5,7 +5,7 @@ date: '2022-01-05' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does. This tool is developed as a minimalistic alternative to sudo application. @@ -63,13 +63,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/linux_edit_cron_table_parameter.yml b/detections/endpoint/linux_edit_cron_table_parameter.yml index 17d993daf8..ac42a44383 100644 --- a/detections/endpoint/linux_edit_cron_table_parameter.yml +++ b/detections/endpoint/linux_edit_cron_table_parameter.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies a suspicious cronjobs modification using crontab edit parameter. This commandline parameter can be abuse by malware author, adversaries, and red red teamers to add cronjob entry to their malicious @@ -60,13 +60,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml index c8e48e229c..f5009747d7 100644 --- a/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml +++ b/detections/endpoint/linux_file_created_in_kernel_driver_directory.yml @@ -5,7 +5,7 @@ date: '2021-12-22' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic looks for suspicious file creation in kernel/driver directory in linux platform. This directory is known folder for all linux kernel module available within the system. so creation of file in this directory is a good indicator that @@ -63,11 +63,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid - - Filesystem.file_path risk_score: 72 security_domain: endpoint diff --git a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml index 28b9fee84d..2601045d97 100644 --- a/detections/endpoint/linux_file_creation_in_init_boot_directory.yml +++ b/detections/endpoint/linux_file_creation_in_init_boot_directory.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic looks for suspicious file creation on init system directories for automatic execution of script or file upon boot up. This technique is commonly abuse by adversaries, malware author and red teamer to persist on the targeted or @@ -59,11 +59,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid - - Filesystem.file_path risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/linux_file_creation_in_profile_directory.yml b/detections/endpoint/linux_file_creation_in_profile_directory.yml index 7ad259ac67..69ed4b7a53 100644 --- a/detections/endpoint/linux_file_creation_in_profile_directory.yml +++ b/detections/endpoint/linux_file_creation_in_profile_directory.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic looks for suspicious file creation in /etc/profile.d directory to automatically execute scripts by shell upon boot up of a linux machine. This technique is commonly abused by adversaries, malware and red teamers as a persistence @@ -61,11 +61,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid - - Filesystem.file_path risk_score: 56 security_domain: endpoint diff --git a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml index 9efacdd220..2491ec7d99 100644 --- a/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml +++ b/detections/endpoint/linux_insert_kernel_module_using_insmod_utility.yml @@ -5,7 +5,7 @@ date: '2021-12-22' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for inserting of linux kernel module using insmod utility function. This event can detect a installation of rootkit or malicious kernel module to gain elevated privileges to their malicious code and bypassed detections. @@ -61,13 +61,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml index 9825cd8934..01a2f360ed 100644 --- a/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml +++ b/detections/endpoint/linux_install_kernel_module_using_modprobe_utility.yml @@ -5,7 +5,7 @@ date: '2021-12-22' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for possible installing a linux kernel module using modprobe utility function. This event can detect a installation of rootkit or malicious kernel module to gain elevated privileges to their malicious code and bypassed detections. @@ -62,13 +62,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/linux_java_spawning_shell.yml b/detections/endpoint/linux_java_spawning_shell.yml index 8730e4e55f..aa3e804ff8 100644 --- a/detections/endpoint/linux_java_spawning_shell.yml +++ b/detections/endpoint/linux_java_spawning_shell.yml @@ -5,7 +5,7 @@ date: '2021-12-13' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the process name of Java, Apache, or Tomcat spawning a Linux shell. This is potentially indicative of exploitation of the Java application and may be related to current event CVE-2021-44228 (Log4Shell). @@ -64,17 +64,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 40 security_domain: endpoint diff --git a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml index f3c9be8b15..0ea8d38278 100644 --- a/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml +++ b/detections/endpoint/linux_nopasswd_entry_in_sudoers_file.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for suspicious command lines that may add entry to /etc/sudoers with NOPASSWD attribute in linux platform. This technique is commonly abuse by adversaries, malware author and red teamers to gain elevated privilege @@ -63,13 +63,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/linux_pkexec_privilege_escalation.yml b/detections/endpoint/linux_pkexec_privilege_escalation.yml index aa16b886ed..a3f31f24ef 100644 --- a/detections/endpoint/linux_pkexec_privilege_escalation.yml +++ b/detections/endpoint/linux_pkexec_privilege_escalation.yml @@ -5,7 +5,7 @@ date: '2022-01-28' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `pkexec` spawning with no command-line arguments. A vulnerability in Polkit's pkexec component identified as CVE-2021-4034 (PwnKit) which is present in the default configuration of all major Linux distributions @@ -70,17 +70,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint diff --git a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml index 22818a0ab6..3286dab16d 100644 --- a/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml +++ b/detections/endpoint/linux_possible_access_or_modification_of_sshd_config_file.yml @@ -5,7 +5,7 @@ date: '2022-01-11' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for suspicious process command-line that might be accessing or modifying sshd_config. This file is the ssh configuration file that might be modify by threat actors or adversaries to redirect port connection, allow @@ -62,13 +62,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/linux_possible_access_to_credential_files.yml b/detections/endpoint/linux_possible_access_to_credential_files.yml index 3b695cc0f6..ffe7fad69a 100644 --- a/detections/endpoint/linux_possible_access_to_credential_files.yml +++ b/detections/endpoint/linux_possible_access_to_credential_files.yml @@ -5,7 +5,7 @@ date: '2022-01-10' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a possible attempt to dump or access the content of /etc/passwd and /etc/shadow to enable offline credential cracking. "etc/passwd" store user information within linux OS while "etc/shadow" contain the user passwords @@ -63,13 +63,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/linux_possible_access_to_sudoers_file.yml b/detections/endpoint/linux_possible_access_to_sudoers_file.yml index 4d287e68ca..40c16b2b50 100644 --- a/detections/endpoint/linux_possible_access_to_sudoers_file.yml +++ b/detections/endpoint/linux_possible_access_to_sudoers_file.yml @@ -5,7 +5,7 @@ date: '2022-01-10' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a possible access or modification of /etc/sudoers file. "/etc/sudoers" file controls who can run what command as what users on what machine and can also control whether a specific user need a password for particular @@ -61,13 +61,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml index 4eb48d7d79..c6012d5485 100644 --- a/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_at_allow_config_file.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for suspicious commandline that may use to append user entry to /etc/at.allow or /etc/at.deny. These 2 files are commonly abused by malware, adversaries or red teamers to persist on the targeted or compromised host. @@ -63,13 +63,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml index e3ec58909f..ee80a8a3a0 100644 --- a/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml +++ b/detections/endpoint/linux_possible_append_command_to_profile_config_file.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for suspicious command-lines that can be possibly used to modify user profile files to automatically execute scripts/executables by shell upon reboot of the machine. This technique is commonly abused by adversaries, @@ -63,13 +63,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml index 4c56681b14..491c39d64a 100644 --- a/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml +++ b/detections/endpoint/linux_possible_append_cronjob_entry_on_existing_cronjob_file.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for possible suspicious commandline that may use to append a code to any existing cronjob files for persistence or privilege escalation. This technique is commonly abused by malware, adversaries and red teamers to automatically @@ -60,13 +60,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml index 4866c6a3a8..425072c495 100644 --- a/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml +++ b/detections/endpoint/linux_possible_cronjob_modification_with_editor.yml @@ -5,7 +5,7 @@ date: '2021-12-17' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for possible modification of cronjobs file using editor. This event is can be seen in normal user but can also be a good hunting indicator for unwanted user modifying cronjobs for possible persistence or privilege @@ -60,13 +60,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 6 security_domain: endpoint diff --git a/detections/endpoint/linux_possible_ssh_key_file_creation.yml b/detections/endpoint/linux_possible_ssh_key_file_creation.yml index 6945aed5fc..c446657f77 100644 --- a/detections/endpoint/linux_possible_ssh_key_file_creation.yml +++ b/detections/endpoint/linux_possible_ssh_key_file_creation.yml @@ -5,7 +5,7 @@ date: '2022-01-11' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic is to look for possible ssh key file creation on ~/.ssh/ folder. This technique is commonly abused by threat actors and adversaries to gain persistence and privilege escalation to the targeted host. by creating ssh private @@ -60,11 +60,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid - - Filesystem.file_path risk_score: 36 security_domain: endpoint diff --git a/detections/endpoint/linux_preload_hijack_library_calls.yml b/detections/endpoint/linux_preload_hijack_library_calls.yml index 97c79b0d14..de359cc437 100644 --- a/detections/endpoint/linux_preload_hijack_library_calls.yml +++ b/detections/endpoint/linux_preload_hijack_library_calls.yml @@ -5,7 +5,7 @@ date: '2021-12-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious command that may hijack a library function in linux platform. This technique is commonly abuse by adversaries, malware author and red teamers to gain privileges and persist on the machine. This detection @@ -60,13 +60,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml index 999fecc6a8..71aff9b889 100644 --- a/detections/endpoint/linux_service_file_created_in_systemd_directory.yml +++ b/detections/endpoint/linux_service_file_created_in_systemd_directory.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic looks for suspicious file creation in systemd timer directory in linux platform. systemd is a system and service manager for Linux distributions. From the Windows perspective, this process fulfills the duties of wininit.exe and @@ -67,11 +67,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid - - Filesystem.file_path risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/linux_service_restarted.yml b/detections/endpoint/linux_service_restarted.yml index f8791b39ec..17448a1f88 100644 --- a/detections/endpoint/linux_service_restarted.yml +++ b/detections/endpoint/linux_service_restarted.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for restarted or re-enable services in linux platform. This technique can be executed or performed using systemctl or service tool application. Adversaries may create or modify Windows services to repeatedly execute malicious @@ -65,13 +65,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/linux_service_started_or_enabled.yml b/detections/endpoint/linux_service_started_or_enabled.yml index f49665180d..03080181ea 100644 --- a/detections/endpoint/linux_service_started_or_enabled.yml +++ b/detections/endpoint/linux_service_started_or_enabled.yml @@ -5,7 +5,7 @@ date: '2021-12-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for created or enable services in linux platform. This technique can be executed or performed using systemctl or service tool application. Adversaries may create or modify Windows services to repeatedly execute malicious @@ -65,13 +65,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 42 security_domain: endpoint diff --git a/detections/endpoint/linux_setuid_using_chmod_utility.yml b/detections/endpoint/linux_setuid_using_chmod_utility.yml index 9c0993d9d1..be8916e434 100644 --- a/detections/endpoint/linux_setuid_using_chmod_utility.yml +++ b/detections/endpoint/linux_setuid_using_chmod_utility.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for suspicious chmod utility execution to enable SUID bit. This allows a user to temporarily gain root access, usually in order to run a program. For example, only the root account is allowed to change the password @@ -65,13 +65,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/linux_setuid_using_setcap_utility.yml b/detections/endpoint/linux_setuid_using_setcap_utility.yml index a9b84716e8..19cccdae0c 100644 --- a/detections/endpoint/linux_setuid_using_setcap_utility.yml +++ b/detections/endpoint/linux_setuid_using_setcap_utility.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for suspicious setcap utility execution to enable SUID bit. This allows a user to temporarily gain root access, usually in order to run a program. For example, only the root account is allowed to change the password @@ -66,13 +66,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/linux_sudo_or_su_execution.yml b/detections/endpoint/linux_sudo_or_su_execution.yml index fb739d3abf..f019493f8d 100644 --- a/detections/endpoint/linux_sudo_or_su_execution.yml +++ b/detections/endpoint/linux_sudo_or_su_execution.yml @@ -5,7 +5,7 @@ date: '2022-01-04' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect the execution of sudo or su command in linux operating system. The "sudo" command allows a system administrator to delegate authority to give certain users (or groups of users) the ability to run some (or all) commands @@ -63,13 +63,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/linux_sudoers_tmp_file_creation.yml b/detections/endpoint/linux_sudoers_tmp_file_creation.yml index 1df4b0d961..4e267fbd75 100644 --- a/detections/endpoint/linux_sudoers_tmp_file_creation.yml +++ b/detections/endpoint/linux_sudoers_tmp_file_creation.yml @@ -5,7 +5,7 @@ date: '2021-12-23' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Filesystem description: This analytic is to looks for file creation of sudoers.tmp file cause by editing /etc/sudoers using visudo or editor in linux platform. This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege @@ -61,11 +61,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.process_guid - - Filesystem.file_path risk_score: 72 security_domain: endpoint diff --git a/detections/endpoint/linux_system_network_discovery.yml b/detections/endpoint/linux_system_network_discovery.yml index 11f21bf5ff..3406ebdc68 100644 --- a/detections/endpoint/linux_system_network_discovery.yml +++ b/detections/endpoint/linux_system_network_discovery.yml @@ -5,7 +5,7 @@ date: '2022-02-11' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for possible enumeration of local network configuration. This technique is commonly used as part of recon of adversaries or threat actor to know some network information for its next or further attack. This anomaly detections @@ -58,13 +58,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/linux_visudo_utility_execution.yml b/detections/endpoint/linux_visudo_utility_execution.yml index 4acdf38f55..5efa44936b 100644 --- a/detections/endpoint/linux_visudo_utility_execution.yml +++ b/detections/endpoint/linux_visudo_utility_execution.yml @@ -5,7 +5,7 @@ date: '2021-12-21' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to looks for suspicious commandline that add entry to /etc/sudoers by using visudo utility tool in linux platform. This technique may abuse by adversaries, malware author and red teamers to gain elevated privilege @@ -62,13 +62,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 16 security_domain: endpoint diff --git a/detections/endpoint/loading_of_dynwrapx_module.yml b/detections/endpoint/loading_of_dynwrapx_module.yml index 8367b6300c..b08a45cb10 100644 --- a/detections/endpoint/loading_of_dynwrapx_module.yml +++ b/detections/endpoint/loading_of_dynwrapx_module.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-18' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, registering or loading dynwrapx.dll to a host is highly diff --git a/detections/endpoint/local_account_discovery_with_net.yml b/detections/endpoint/local_account_discovery_with_net.yml index d2220dfca8..916ee27658 100644 --- a/detections/endpoint/local_account_discovery_with_net.yml +++ b/detections/endpoint/local_account_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to query for local users. The two arguments `user` and 'users', return a list of all local users. Red Teams and adversaries alike use @@ -49,6 +49,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/local_account_discovery_with_wmic.yml b/detections/endpoint/local_account_discovery_with_wmic.yml index d2dd2876a8..05efc65bd9 100644 --- a/detections/endpoint/local_account_discovery_with_wmic.yml +++ b/detections/endpoint/local_account_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to query for local users. The argument `useraccount` is used to leverage WMI to return a list of all local users. Red Teams and adversaries alike @@ -48,6 +48,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/logon_script_event_trigger_execution.yml b/detections/endpoint/logon_script_event_trigger_execution.yml index cce4592702..764a375eb7 100644 --- a/detections/endpoint/logon_script_event_trigger_execution.yml +++ b/detections/endpoint/logon_script_event_trigger_execution.yml @@ -5,7 +5,7 @@ date: '2021-09-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: This search is to detect a suspicious modification of registry entry to persist and gain privilege escalation upon booting up of compromised host. This technique was seen in several APT and malware where it modify UserInitMprLogonScript @@ -56,12 +56,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Registry.dest + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/mailsniper_invoke_functions.yml b/detections/endpoint/mailsniper_invoke_functions.yml index 028bb99c8b..8bae9e0a77 100644 --- a/detections/endpoint/mailsniper_invoke_functions.yml +++ b/detections/endpoint/mailsniper_invoke_functions.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-05-19' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect known mailsniper.ps1 functions executed in a machine. This technique was seen in some attacker to harvest some sensitive e-mail in a compromised exchange server. diff --git a/detections/endpoint/malicious_inprocserver32_modification.yml b/detections/endpoint/malicious_inprocserver32_modification.yml index 21c9bc00db..0cc679b914 100644 --- a/detections/endpoint/malicious_inprocserver32_modification.yml +++ b/detections/endpoint/malicious_inprocserver32_modification.yml @@ -5,7 +5,8 @@ date: '2021-10-05' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following analytic identifies a process modifying the registry with a known malicious CLSID under InProcServer32. Most COM classes are registered with the operating system and are identified by a GUID that represents the Class Identifier @@ -75,11 +76,22 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - dest - process_name - - registry_path - registry_key_name + - registry_path - registry_value_name - user risk_score: 80 diff --git a/detections/endpoint/malicious_powershell_executed_as_a_service.yml b/detections/endpoint/malicious_powershell_executed_as_a_service.yml index 391afadbf2..e8fd993b05 100644 --- a/detections/endpoint/malicious_powershell_executed_as_a_service.yml +++ b/detections/endpoint/malicious_powershell_executed_as_a_service.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-07' author: Ryan Becwar type: TTP -datamodel: -- Endpoint +datamodel: [] description: This detection is to identify the abuse the Windows SC.exe to execute malicious commands or payloads via PowerShell. search: ' `wineventlog_system` EventCode=7045 | eval l_Service_File_Name=lower(Service_File_Name) diff --git a/detections/endpoint/malicious_powershell_process___encoded_command.yml b/detections/endpoint/malicious_powershell_process___encoded_command.yml index 0b1bb8f3ea..e032333af3 100644 --- a/detections/endpoint/malicious_powershell_process___encoded_command.yml +++ b/detections/endpoint/malicious_powershell_process___encoded_command.yml @@ -5,7 +5,7 @@ date: '2022-01-18' author: David Dorsey, Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies the use of the EncodedCommand PowerShell parameter. This is typically used by Administrators to run complex scripts, but commonly used by adversaries to hide their code. \ @@ -78,12 +78,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.user - - Processes.parent_process_name - - Processes.dest - - Processes.process_id risk_score: 35 security_domain: endpoint diff --git a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml index 23a31dc47e..c335580838 100644 --- a/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml +++ b/detections/endpoint/malicious_powershell_process___execution_policy_bypass.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Rico Valdez, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for PowerShell processes started with parameters used to bypass the local execution policy for scripts. These parameters are often observed in attacks leveraging PowerShell scripts as they override the default PowerShell @@ -65,18 +65,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml index 1fa77cee67..b2783d92db 100644 --- a/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml +++ b/detections/endpoint/malicious_powershell_process_with_obfuscation_techniques.yml @@ -5,7 +5,7 @@ date: '2021-01-19' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for PowerShell processes launched with arguments that have characters indicative of obfuscation on the command-line. search: '| tstats `security_content_summariesonly` count values(Processes.process) @@ -63,18 +63,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml index bda911cd5a..967dc32b26 100644 --- a/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml +++ b/detections/endpoint/mimikatz_passtheticket_commandline_parameters.yml @@ -5,7 +5,7 @@ date: '2022-02-01' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic looks for the use of Mimikatz command line parameters leveraged to execute pass the ticket attacks. Red teams and adversaries alike may use the pass the ticket technique using stolen Kerberos tickets to move laterally @@ -62,14 +62,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 36 security_domain: endpoint diff --git a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml index aab3e5935e..bc297d7b0b 100644 --- a/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/mmc_exe_lolbas_execution_process_spawn.yml @@ -5,7 +5,7 @@ date: '2021-11-23' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `mmc.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the DCOM protocol and the MMC20 COM object, the executed command is spawned as a child processs of @@ -65,18 +65,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/modification_of_wallpaper.yml b/detections/endpoint/modification_of_wallpaper.yml index abbc9ace22..9ab0e1be7e 100644 --- a/detections/endpoint/modification_of_wallpaper.yml +++ b/detections/endpoint/modification_of_wallpaper.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-06-02' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic identifies suspicious modification of registry to deface or change the wallpaper of a compromised machines as part of its payload. This technique was commonly seen in ransomware like REVIL where it create a bitmap file contain diff --git a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml index 5f41d4c5c9..86dc4f0fde 100644 --- a/detections/endpoint/modify_acl_permission_to_files_or_folder.yml +++ b/detections/endpoint/modify_acl_permission_to_files_or_folder.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies suspicious modification of ACL permission to a files or folder to make it available to everyone. This technique may be used by the adversary to evade ACLs or protected files access. This changes is commonly @@ -53,13 +53,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.process_name - - Processes.dest - - Processes.user - - Processes.process - - Processes.process_id risk_score: 32 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml index d445f2249f..f85c529ccf 100644 --- a/detections/endpoint/monitor_registry_keys_for_print_monitors.yml +++ b/detections/endpoint/monitor_registry_keys_for_print_monitors.yml @@ -4,7 +4,9 @@ version: 3 date: '2020-01-28' author: Bhavin Patel, Teoderick Contreras, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint.Processes +- Endpoint.Registry description: This search looks for registry activity associated with modifications to the registry key `HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors`. In this scenario, an attacker can load an arbitrary .dll into the print-monitor registry @@ -49,7 +51,6 @@ tags: - Stage:Persistence - Stage:Privilege Escalation dataset: - - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/windows-sysmon.log - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.010/atomic_red_team/sysmon.log impact: 80 kill_chain_phases: @@ -72,12 +73,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.action + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.action - - Registry.registry_path - - Registry.dest - - Registry.registry_key_name - - Registry.user - - Registry.registry_value_name risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml index 39ae4926de..5c94fa10e5 100644 --- a/detections/endpoint/ms_scripting_process_loading_ldap_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_ldap_module.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-09-13' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading ldap module to process ldap query. This behavior was seen in FIN7 implant where it uses javascript to execute ldap query to parse host diff --git a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml index 369b9ee11e..0aee20a152 100644 --- a/detections/endpoint/ms_scripting_process_loading_wmi_module.yml +++ b/detections/endpoint/ms_scripting_process_loading_wmi_module.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-09-13' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious MS scripting process such as wscript.exe or cscript.exe that loading wmi module to process wmi query. This behavior was seen in FIN7 implant where it uses javascript to execute wmi query to parse host information diff --git a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml index 4880410409..bf9235beca 100644 --- a/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml +++ b/detections/endpoint/msbuild_suspicious_spawned_by_script_process.yml @@ -5,7 +5,7 @@ date: '2021-10-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious child process of MSBuild spawned by Windows Script Host - cscript or wscript. This behavior or event are commonly seen and used by malware or adversaries to execute malicious msbuild process using @@ -60,13 +60,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.original_file_name - - Processes.user risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml index 04b24fdeed..0a784968a4 100644 --- a/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml +++ b/detections/endpoint/mshta_spawning_rundll32_or_regsvr32_process.yml @@ -5,7 +5,7 @@ date: '2021-07-19' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious mshta.exe process that spawn rundll32 or regsvr32 child process. This technique was seen in several malware nowadays like trickbot to load its initial .dll stage loader to execute and download the the actual @@ -58,18 +58,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/mshtml_module_load_in_office_product.yml b/detections/endpoint/mshtml_module_load_in_office_product.yml index bb9f98ed80..ba6f91049c 100644 --- a/detections/endpoint/mshtml_module_load_in_office_product.yml +++ b/detections/endpoint/mshtml_module_load_in_office_product.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-09-09' author: Michael Haag, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following detection identifies the module load of mshtml.dll into an Office product. This behavior has been related to CVE-2021-40444, whereas the malicious document will load ActiveX, which activates the MSHTML component. The diff --git a/detections/endpoint/msmpeng_application_dll_side_loading.yml b/detections/endpoint/msmpeng_application_dll_side_loading.yml index c4f72a52aa..38d9253ebe 100644 --- a/detections/endpoint/msmpeng_application_dll_side_loading.yml +++ b/detections/endpoint/msmpeng_application_dll_side_loading.yml @@ -5,7 +5,7 @@ date: '2021-07-05' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: This search is to detect a suspicious creation of msmpeng.exe or mpsvc.dll in non default windows defender folder. This technique was seen couple days ago with revil ransomware in Kaseya Supply chain. The approach is to drop an old version @@ -40,12 +40,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_id + - Endpoint.Filesystem.user - _time - - Filesystem.file_create_time - - Filesystem.process_id - - Filesystem.file_name - - Filesystem.user - - Filesystem.file_path security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml index 84430a2b77..afc5263528 100644 --- a/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml +++ b/detections/endpoint/multiple_users_attempting_to_authenticate_using_explicit_credentials.yml @@ -74,10 +74,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - EventCode - - Security_ID - Account_Name - ComputerName + - EventCode + - _time risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml index 5ebf02b7cc..473dea952c 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_host_using_kerberos.yml @@ -70,10 +70,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - EventCode - - Result_Code - Account_Name - Client_Address + - EventCode + - _time risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml index 1496df5d6c..6d6fd7f257 100644 --- a/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml +++ b/detections/endpoint/multiple_users_failing_to_authenticate_from_process.yml @@ -73,12 +73,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - Account_Name + - Caller_Process_Name + - ComputerName - EventCode - Logon_Type - - Caller_Process_Name - - Security_ID - - Account_Name - - ComputerName + - _time risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml index 5b9049e85a..0587aac7b4 100644 --- a/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml +++ b/detections/endpoint/multiple_users_remotely_failing_to_authenticate_from_host.yml @@ -72,12 +72,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - EventCode - - Logon_Type - - Security_ID - Account_Name - ComputerName + - EventCode + - Logon_Type - Source_Network_Address + - _time risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/net_localgroup_discovery.yml b/detections/endpoint/net_localgroup_discovery.yml index ea47f2e0e7..6b134520d4 100644 --- a/detections/endpoint/net_localgroup_discovery.yml +++ b/detections/endpoint/net_localgroup_discovery.yml @@ -5,7 +5,7 @@ date: '2021-09-14' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting analytic will identify the use of localgroup discovery using `net localgroup`. During triage, review parallel processes and identify any further suspicious behavior. @@ -58,17 +58,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/net_profiler_uac_bypass.yml b/detections/endpoint/net_profiler_uac_bypass.yml index cf677f99cd..f16e1ff411 100644 --- a/detections/endpoint/net_profiler_uac_bypass.yml +++ b/detections/endpoint/net_profiler_uac_bypass.yml @@ -5,7 +5,7 @@ date: '2022-02-18' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: This search is to detect modification of registry to bypass UAC windows feature. This technique is to add a payload dll path on .NET COR file path that will be loaded by mmc.exe as soon it was executed. This detection rely on monitoring @@ -55,11 +55,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Registry.dest + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/network_connection_discovery_arp.yml b/detections/endpoint/network_connection_discovery_arp.yml index 7561ba6375..4c53baaa9b 100644 --- a/detections/endpoint/network_connection_discovery_arp.yml +++ b/detections/endpoint/network_connection_discovery_arp.yml @@ -5,7 +5,7 @@ date: '2021-09-10' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `arp.exe` utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use arp.exe for situational awareness and Active Directory Discovery. @@ -48,16 +48,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/network_connection_discovery_net.yml b/detections/endpoint/network_connection_discovery_net.yml index 6427083184..442e9b4a11 100644 --- a/detections/endpoint/network_connection_discovery_net.yml +++ b/detections/endpoint/network_connection_discovery_net.yml @@ -5,7 +5,7 @@ date: '2021-09-10' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use net.exe for situational awareness and Active @@ -49,16 +49,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/network_connection_discovery_netstat.yml b/detections/endpoint/network_connection_discovery_netstat.yml index a699d24058..3b25f3066c 100644 --- a/detections/endpoint/network_connection_discovery_netstat.yml +++ b/detections/endpoint/network_connection_discovery_netstat.yml @@ -5,7 +5,7 @@ date: '2021-09-10' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `netstat.exe` with command-line arguments utilized to get a listing of network connections on a compromised system. Red Teams and adversaries alike may use netstat.exe for situational awareness and @@ -49,16 +49,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/network_discovery_using_route_windows_app.yml b/detections/endpoint/network_discovery_using_route_windows_app.yml index 444db4a4f3..4badc78a10 100644 --- a/detections/endpoint/network_discovery_using_route_windows_app.yml +++ b/detections/endpoint/network_discovery_using_route_windows_app.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic look for a spawned process of route.exe windows application. Adversaries and red teams alike abuse this application the recon or do a network discovery on a target host. but one possible false positive might be an automated @@ -53,14 +53,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/nishang_powershelltcponeline.yml b/detections/endpoint/nishang_powershelltcponeline.yml index e4858581cd..58737cf7a7 100644 --- a/detections/endpoint/nishang_powershelltcponeline.yml +++ b/detections/endpoint/nishang_powershelltcponeline.yml @@ -5,7 +5,7 @@ date: '2021-03-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This query detects the Nishang Invoke-PowerShellTCPOneLine utility that spawns a call back to a remote command and control server. This is a powershell oneliner. In addition, this will capture on the command-line additional utilities @@ -58,18 +58,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/nltest_domain_trust_discovery.yml b/detections/endpoint/nltest_domain_trust_discovery.yml index 0351a8b0cc..2e92978e72 100644 --- a/detections/endpoint/nltest_domain_trust_discovery.yml +++ b/detections/endpoint/nltest_domain_trust_discovery.yml @@ -5,7 +5,7 @@ date: '2021-01-25' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for the execution of `nltest.exe` with command-line arguments utilized to query for Domain Trust information. Two arguments `/domain trusts`, returns a list of trusted domains, and `/all_trusts`, returns all trusted @@ -65,14 +65,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_id - - Processes.parent_process_id risk_score: 15 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml index 3306d0a93d..f1357d0652 100644 --- a/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml +++ b/detections/endpoint/non_chrome_process_accessing_chrome_default_dir.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-09-15' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect an anomaly event of non-chrome process accessing the files in chrome user default folder. This folder contains all the sqlite database of the chrome browser related to users login, history, cookies and etc. Most of diff --git a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml index a0ab4f8f17..40e78f6e73 100644 --- a/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml +++ b/detections/endpoint/non_firefox_process_access_firefox_profile_dir.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-09-15' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search is to detect an anomaly event of non-firefox process accessing the files in profile folder. This folder contains all the sqlite database of the firefox browser related to users login, history, cookies and etc. Most of the RAT, diff --git a/detections/endpoint/ntdsutil_export_ntds.yml b/detections/endpoint/ntdsutil_export_ntds.yml index aa6664ba7e..6b97130433 100644 --- a/detections/endpoint/ntdsutil_export_ntds.yml +++ b/detections/endpoint/ntdsutil_export_ntds.yml @@ -5,7 +5,7 @@ date: '2021-01-28' author: Michael Haag, Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'Monitor for signs that Ntdsutil is being used to Extract Active Directory database - NTDS.dit, typically used for offline password cracking. It may be used in normal circumstances with no command line arguments or shorthand variations of @@ -68,14 +68,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_id - - Processes.parent_process_id risk_score: 50 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/office_application_drop_executable.yml b/detections/endpoint/office_application_drop_executable.yml index 25b2f1dfa7..9dd051dc3c 100644 --- a/detections/endpoint/office_application_drop_executable.yml +++ b/detections/endpoint/office_application_drop_executable.yml @@ -5,7 +5,8 @@ date: '2021-09-13' author: Teoderick Contreras, Michael Haag Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: This search is to detect a suspicious MS office application that drop or create executables or script in the host. This behavior is commonly seen in spear phishing office attachment where it drop malicious files or script to compromised @@ -64,11 +65,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid + - Endpoint.Processes.dest + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name - _time - - Image - - TargetFilename - - ProcessGuid - dest - - user_id risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/office_application_spawn_regsvr32_process.yml b/detections/endpoint/office_application_spawn_regsvr32_process.yml index 7cee8cbf6d..040f17b575 100644 --- a/detections/endpoint/office_application_spawn_regsvr32_process.yml +++ b/detections/endpoint/office_application_spawn_regsvr32_process.yml @@ -5,7 +5,7 @@ date: '2021-07-30' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like IcedID that used MS office as its weapon or attack @@ -53,18 +53,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/office_application_spawn_rundll32_process.yml b/detections/endpoint/office_application_spawn_rundll32_process.yml index 30f2fa1600..a2d79325d0 100644 --- a/detections/endpoint/office_application_spawn_rundll32_process.yml +++ b/detections/endpoint/office_application_spawn_rundll32_process.yml @@ -5,7 +5,7 @@ date: '2021-04-13' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this detection was designed to identifies suspicious spawned process of known MS office application due to macro or malicious code. this technique can be seen in so many malware like trickbot that used MS office as its weapon or attack @@ -55,17 +55,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/office_document_creating_schedule_task.yml b/detections/endpoint/office_document_creating_schedule_task.yml index e3455839fd..574a5fd61b 100644 --- a/detections/endpoint/office_document_creating_schedule_task.yml +++ b/detections/endpoint/office_document_creating_schedule_task.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-14' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search detects a potential malicious office document that create schedule task entry through macro VBA api or through loading taskschd.dll. This technique was seen in so many malicious macro malware that create persistence , diff --git a/detections/endpoint/office_document_executing_macro_code.yml b/detections/endpoint/office_document_executing_macro_code.yml index 5d78357f23..00ff733b24 100644 --- a/detections/endpoint/office_document_executing_macro_code.yml +++ b/detections/endpoint/office_document_executing_macro_code.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-14' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this detection was designed to identifies suspicious office documents that using macro code. Macro code is known to be one of the prevalent weaponization or attack vector of threat actor. This malicious macro code is embed to a office diff --git a/detections/endpoint/office_document_spawned_child_process_to_download.yml b/detections/endpoint/office_document_spawned_child_process_to_download.yml index f3d8d1fa01..8afb25668b 100644 --- a/detections/endpoint/office_document_spawned_child_process_to_download.yml +++ b/detections/endpoint/office_document_spawned_child_process_to_download.yml @@ -5,7 +5,7 @@ date: '2021-09-20' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect potential malicious office document executing lolbin child process to download payload or other malware. Since most of the attacker abused the capability of office document to execute living on land application to @@ -53,18 +53,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/office_product_spawn_cmd_process.yml b/detections/endpoint/office_product_spawn_cmd_process.yml index 69de3a2862..651fd914c3 100644 --- a/detections/endpoint/office_product_spawn_cmd_process.yml +++ b/detections/endpoint/office_product_spawn_cmd_process.yml @@ -5,7 +5,7 @@ date: '2021-07-19' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: this search is to detect a suspicious office product process that spawn cmd child process. This is commonly seen in a ms office product having macro to execute shell command to download or execute malicious lolbin relative to its malicious @@ -59,18 +59,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/office_product_spawning_bitsadmin.yml b/detections/endpoint/office_product_spawning_bitsadmin.yml index 094bebf61f..0b458ecd9b 100644 --- a/detections/endpoint/office_product_spawning_bitsadmin.yml +++ b/detections/endpoint/office_product_spawning_bitsadmin.yml @@ -5,7 +5,7 @@ date: '2021-04-26' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `bitsadmin.exe`. In malicious instances, the command-line @@ -64,18 +64,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/office_product_spawning_certutil.yml b/detections/endpoint/office_product_spawning_certutil.yml index 0326a05e7a..0196ffc1fc 100644 --- a/detections/endpoint/office_product_spawning_certutil.yml +++ b/detections/endpoint/office_product_spawning_certutil.yml @@ -5,7 +5,7 @@ date: '2021-04-26' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `certutil.exe`. In malicious instances, the command-line @@ -64,18 +64,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/office_product_spawning_mshta.yml b/detections/endpoint/office_product_spawning_mshta.yml index 5c136fd5a4..21dd01b129 100644 --- a/detections/endpoint/office_product_spawning_mshta.yml +++ b/detections/endpoint/office_product_spawning_mshta.yml @@ -5,7 +5,7 @@ date: '2021-04-26' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies the latest behavior utilized by different malware families (including TA551, IcedID). This detection identifies any Windows Office Product spawning `mshta.exe`. In malicious instances, the command-line of @@ -64,18 +64,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml index d2a2ea1b65..2c4904a8a7 100644 --- a/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml +++ b/detections/endpoint/office_product_spawning_rundll32_with_no_dll.yml @@ -5,7 +5,7 @@ date: '2021-04-22' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies the latest behavior utilized by IcedID malware family. This detection identifies any Windows Office Product spawning `rundll32.exe` without a `.dll` file extension. In malicious instances, the command-line of `rundll32.exe` @@ -67,18 +67,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/office_product_spawning_wmic.yml b/detections/endpoint/office_product_spawning_wmic.yml index cb49a67c41..7c2be2f632 100644 --- a/detections/endpoint/office_product_spawning_wmic.yml +++ b/detections/endpoint/office_product_spawning_wmic.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies the latest behavior utilized by Ursnif malware family. This detection identifies any Windows Office Product spawning `wmic.exe`. In malicious instances, the command-line of `wmic.exe` will contain `wmic process @@ -66,18 +66,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/office_product_writing_cab_or_inf.yml b/detections/endpoint/office_product_writing_cab_or_inf.yml index 6df24c4ce8..6d412ef122 100644 --- a/detections/endpoint/office_product_writing_cab_or_inf.yml +++ b/detections/endpoint/office_product_writing_cab_or_inf.yml @@ -5,7 +5,8 @@ date: '2021-09-10' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: The following analytic identifies behavior related to CVE-2021-40444. Whereas the malicious document will load ActiveX and download the remote payload (.inf, .cab). During triage, review parallel processes and further activity on endpoint @@ -67,12 +68,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Processes.dest + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name - _time - dest - - process_name - - process - file_create_time - file_name - file_path + - process + - process_name risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/office_spawning_control.yml b/detections/endpoint/office_spawning_control.yml index 9a776be427..dff6f0a204 100644 --- a/detections/endpoint/office_spawning_control.yml +++ b/detections/endpoint/office_spawning_control.yml @@ -5,7 +5,7 @@ date: '2021-09-08' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies control.exe spawning from an office product. This detection identifies any Windows Office Product spawning `control.exe`. In malicious instances, the command-line of `control.exe` will contain a file path @@ -72,17 +72,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml index b22c450fe7..d172a7489a 100644 --- a/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml +++ b/detections/endpoint/outbound_network_connection_from_java_using_default_ports.yml @@ -4,7 +4,9 @@ version: 1 date: '2021-12-13' author: Mauricio Velazco, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint.Ports +- Endpoint.Processes description: A required step while exploiting the CVE-2021-44228-Log4j vulnerability is that the victim server will perform outbound connections to attacker-controlled infrastructure. This is required as part of the JNDI lookup as well as for retrieving @@ -59,15 +61,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Ports.dest + - Endpoint.Ports.dest_port + - Endpoint.Ports.process_guid + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.process_guid - - Processes.process_name - - Processes.dest - - Processes.process_path - - Processes.process - - Processes.parent_process_name - - Ports.process_guid - - Ports.dest - - Ports.dest_port risk_score: 54 security_domain: endpoint diff --git a/detections/endpoint/overwriting_accessibility_binaries.yml b/detections/endpoint/overwriting_accessibility_binaries.yml index 4c2b15a2e0..36ee9d083b 100644 --- a/detections/endpoint/overwriting_accessibility_binaries.yml +++ b/detections/endpoint/overwriting_accessibility_binaries.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: Microsoft Windows contains accessibility features that can be launched with a key combination before a user has logged in. An adversary can modify or replace these programs so they can get a command prompt or backdoor without logging in to @@ -62,11 +62,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.user - _time - - Filesystem.dest - - Filesystem.file_path - - Filesystem.file_name - - Filesystem.dest risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/password_policy_discovery_with_net.yml b/detections/endpoint/password_policy_discovery_with_net.yml index b78172fb96..2284783c9b 100644 --- a/detections/endpoint/password_policy_discovery_with_net.yml +++ b/detections/endpoint/password_policy_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2021-08-26' author: Teoderick Contreras, Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` or `net1.exe` with command line arguments used to obtain the domain password policy. Red Teams and adversaries may leverage `net.exe` for situational awareness and Active Directory @@ -58,14 +58,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 9 security_domain: endpoint diff --git a/detections/endpoint/permission_modification_using_takeown_app.yml b/detections/endpoint/permission_modification_using_takeown_app.yml index 0a4ff79263..0f807b6e0f 100644 --- a/detections/endpoint/permission_modification_using_takeown_app.yml +++ b/detections/endpoint/permission_modification_using_takeown_app.yml @@ -5,7 +5,7 @@ date: '2021-06-10' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a modification of file or directory permission using takeown.exe windows app. This technique was seen in some ransomware that take the ownership of a folder or files to encrypt or delete it. @@ -54,15 +54,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process_guid risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/ping_sleep_batch_command.yml b/detections/endpoint/ping_sleep_batch_command.yml index f015fa1240..5a6273dfb2 100644 --- a/detections/endpoint/ping_sleep_batch_command.yml +++ b/detections/endpoint/ping_sleep_batch_command.yml @@ -5,7 +5,7 @@ date: '2022-01-20' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will identify the possible execution of ping sleep batch commands. This technique was seen in several malware samples and is used to trigger sleep times without explicitly calling sleep functions or commandlets. The goal @@ -65,18 +65,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 36 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/possible_browser_pass_view_parameter.yml b/detections/endpoint/possible_browser_pass_view_parameter.yml index 5b0b1d67e8..6cfcfac61c 100644 --- a/detections/endpoint/possible_browser_pass_view_parameter.yml +++ b/detections/endpoint/possible_browser_pass_view_parameter.yml @@ -5,7 +5,7 @@ date: '2021-11-22' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic will detect if a suspicious process contains a commandline parameter related to a web browser credential dumper. This technique is used by Remcos RAT malware which uses the Nirsoft webbrowserpassview.exe application to @@ -63,17 +63,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 16 security_domain: endpoint diff --git a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml index 6110ef0b52..bce9380640 100644 --- a/detections/endpoint/possible_lateral_movement_powershell_spawn.yml +++ b/detections/endpoint/possible_lateral_movement_powershell_spawn.yml @@ -5,7 +5,7 @@ date: '2021-11-29' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic assists with identifying a PowerShell process spawned as a child or grand child process of commonly abused processes during lateral movement techniques including `services.exe`, `wmiprsve.exe`, `svchost.exe`, `wsmprovhost.exe` @@ -70,18 +70,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 45 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/potentially_malicious_code_on_commandline.yml b/detections/endpoint/potentially_malicious_code_on_commandline.yml index 57c5634513..b370743f33 100644 --- a/detections/endpoint/potentially_malicious_code_on_commandline.yml +++ b/detections/endpoint/potentially_malicious_code_on_commandline.yml @@ -5,7 +5,7 @@ date: '2022-01-14' author: Michael Hart, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic uses a pretrained machine learning text classifier to detect potentially malicious commandlines. The model identifies unusual combinations of keywords found in samples of commandlines where adversaries executed powershell @@ -17,8 +17,8 @@ description: The following analytic uses a pretrained machine learning text clas found in normal usage of the commandline. The model will output a score where all values above zero are suspicious, anything greater than one particularly so. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) - as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name - Processes.process_name Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)` | + as lastTime from datamodel=Endpoint.Processes by Processes.parent_process_name Processes.process_name + Processes.process Processes.user Processes.dest | `drop_dm_object_name(Processes)` | where len(process) > 200 | `potentially_malicious_code_on_cmdline_tokenize_score` | apply unusual_commandline_detection | eval score=''predicted(unusual_cmdline_logits)'', process=orig_process | fields - unusual_cmdline* predicted(unusual_cmdline_logits) @@ -66,13 +66,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.parent_process_name - - Processes.process_name - - Processes.parent_process - - Processes.user - - Processes.dest risk_score: 12 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/powershell_4104_hunting.yml b/detections/endpoint/powershell_4104_hunting.yml index 4c975113aa..d2660ad331 100644 --- a/detections/endpoint/powershell_4104_hunting.yml +++ b/detections/endpoint/powershell_4104_hunting.yml @@ -54,7 +54,7 @@ tags: context: - Source:Endpoint - Stage:Defense Evasion - dataset: + dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.001/powershell_testing/windows-powershell.log impact: 80 kill_chain_phases: @@ -86,7 +86,6 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - Message risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml index c6cf21808e..f5c7616988 100644 --- a/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml +++ b/detections/endpoint/powershell___connect_to_internet_with_hidden_window.yml @@ -5,7 +5,7 @@ date: '2022-01-12' author: David Dorsey, Michael Haag Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting analytic identifies PowerShell commands utilizing the WindowStyle parameter to hide the window on the compromised endpoint. This combination of command-line options is suspicious because it is overriding the default PowerShell @@ -87,11 +87,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.process_name - - Processes.user - - Processes.parent_process_name - - Processes.dest risk_score: 81 security_domain: endpoint diff --git a/detections/endpoint/powershell_disable_security_monitoring.yml b/detections/endpoint/powershell_disable_security_monitoring.yml index 5f8fcb73e6..889a450fd5 100644 --- a/detections/endpoint/powershell_disable_security_monitoring.yml +++ b/detections/endpoint/powershell_disable_security_monitoring.yml @@ -5,7 +5,7 @@ date: '2021-07-05' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to identifies a modification in registry to disable the windows denfender real time behavior monitoring. This event or technique is commonly seen in RAT, bot, or Trojan to disable AV to evade detections. @@ -42,18 +42,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/powershell_enable_smb1protocol_feature.yml b/detections/endpoint/powershell_enable_smb1protocol_feature.yml index e75d2001d3..09f7287044 100644 --- a/detections/endpoint/powershell_enable_smb1protocol_feature.yml +++ b/detections/endpoint/powershell_enable_smb1protocol_feature.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-06-22' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious enabling of smb1protocol through "powershell.exe". This technique was seen in some ransomware (like reddot) where it enable smb share to do the lateral movement and encrypt other files within the diff --git a/detections/endpoint/powershell_execute_com_object.yml b/detections/endpoint/powershell_execute_com_object.yml index 30626cd311..7ae2f25432 100644 --- a/detections/endpoint/powershell_execute_com_object.yml +++ b/detections/endpoint/powershell_execute_com_object.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-08-10' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a COM CLSID execution through powershell. This technique was seen in several adversaries and malware like ransomware conti where it has a feature to execute command using COM Object. This technique may use by diff --git a/detections/endpoint/powershell_get_localgroup_discovery.yml b/detections/endpoint/powershell_get_localgroup_discovery.yml index 85979673ad..1518dd839c 100644 --- a/detections/endpoint/powershell_get_localgroup_discovery.yml +++ b/detections/endpoint/powershell_get_localgroup_discovery.yml @@ -5,7 +5,7 @@ date: '2021-09-14' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting analytic identifies the use of `get-localgroup` being used with PowerShell to identify local groups on the endpoint. During triage, review parallel processes and identify any further suspicious behavior. @@ -56,17 +56,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/powershell_processing_stream_of_data.yml b/detections/endpoint/powershell_processing_stream_of_data.yml index cb00089ad5..3f2f3b7642 100644 --- a/detections/endpoint/powershell_processing_stream_of_data.yml +++ b/detections/endpoint/powershell_processing_stream_of_data.yml @@ -58,11 +58,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time + - ComputerName - EventCode - Message - - ComputerName - User - - Score + - _time risk_score: 40 security_domain: endpoint diff --git a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml index bd27bcef1f..8593152863 100644 --- a/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml +++ b/detections/endpoint/powershell_remote_thread_to_known_windows_process.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search is designed to detect suspicious powershell process that tries to inject code and to known/critical windows process and execute it using CreateRemoteThread. This technique is seen in several malware like trickbot and diff --git a/detections/endpoint/powershell_remove_windows_defender_directory.yml b/detections/endpoint/powershell_remove_windows_defender_directory.yml index edf5f27b62..1a2053ed64 100644 --- a/detections/endpoint/powershell_remove_windows_defender_directory.yml +++ b/detections/endpoint/powershell_remove_windows_defender_directory.yml @@ -4,8 +4,7 @@ version: 2 date: '2022-01-18' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will identify a suspicious PowerShell command used to delete the Windows Defender folder. This technique was seen used by the WhisperGate malware campaign where it used Nirsofts advancedrun.exe to gain administrative privileges diff --git a/detections/endpoint/powershell_start_bitstransfer.yml b/detections/endpoint/powershell_start_bitstransfer.yml index 41be205342..e422c98ecc 100644 --- a/detections/endpoint/powershell_start_bitstransfer.yml +++ b/detections/endpoint/powershell_start_bitstransfer.yml @@ -5,7 +5,7 @@ date: '2021-03-29' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Start-BitsTransfer is the PowerShell "version" of BitsAdmin.exe. Similar functionality is present. This technique variation is not as commonly used by adversaries, but has been abused in the past. Lesser known uses include the ability to set the @@ -62,18 +62,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml index 73b3d2921e..9b8e8ec53e 100644 --- a/detections/endpoint/powershell_windows_defender_exclusion_commands.yml +++ b/detections/endpoint/powershell_windows_defender_exclusion_commands.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-25' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will detect a suspicious process commandline related to windows defender exclusion feature. This command is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product by excluding folder diff --git a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml index 54aa65d39c..0f7f738483 100644 --- a/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml +++ b/detections/endpoint/prevent_automatic_repair_mode_using_bcdedit.yml @@ -5,7 +5,7 @@ date: '2021-06-10' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious bcdedit.exe execution to ignore all failures. This technique was used by ransomware to prevent the compromise machine automatically boot in repair mode. @@ -55,15 +55,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process_guid risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/print_spooler_adding_a_printer_driver.yml b/detections/endpoint/print_spooler_adding_a_printer_driver.yml index 37337cc0ef..5d6179ad55 100644 --- a/detections/endpoint/print_spooler_adding_a_printer_driver.yml +++ b/detections/endpoint/print_spooler_adding_a_printer_driver.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: 'The following analytic identifies new printer drivers being load by utilizing the Windows PrintService operational logs, EventCode 316. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. diff --git a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml index 9f557889ad..e46594c5e0 100644 --- a/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml +++ b/detections/endpoint/print_spooler_failed_to_load_a_plug_in.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: 'The following analytic identifies driver load errors utilizing the Windows PrintService Admin logs. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. \ diff --git a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml index 25799511ff..ba6febdc56 100644 --- a/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml +++ b/detections/endpoint/process_creating_lnk_file_in_suspicious_location.yml @@ -5,7 +5,8 @@ date: '2021-08-26' author: Jose Hernandez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: This search looks for a process launching an `*.lnk` file under `C:\User*` or `*\Local\Temp\*`. This is common behavior used by various spear phishing tools. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -70,14 +71,18 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.file_hash + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid + - Endpoint.Filesystem.user + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_guid + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Filesystem.file_name - - Filesystem.file_path - - Filesystem.process_id - - Filesystem.file_name - - Filesystem.file_path - - Filesystem.file_hash - - Filesystem.user risk_score: 63 security_domain: network supported_tas: diff --git a/detections/endpoint/process_deleting_its_process_file_path.yml b/detections/endpoint/process_deleting_its_process_file_path.yml index f507305b83..033ac993ba 100644 --- a/detections/endpoint/process_deleting_its_process_file_path.yml +++ b/detections/endpoint/process_deleting_its_process_file_path.yml @@ -4,8 +4,7 @@ version: 2 date: '2022-02-18' author: Teoderick Contreras type: TTP -datamodel: -- Endpoint +datamodel: [] description: This detection is to identify a suspicious process that tries to delete the process file path related to its process. This technique is known to be defense evasion once a certain condition of malware is satisfied or not. Clop ransomware @@ -60,15 +59,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - EventCode - Computer - - user - - ParentImage - - ParentCommandLine + - EventCode - Image - - cmdline + - ParentCommandLine + - ParentImage - ProcessID - - result - _time + - result + - user risk_score: 60 security_domain: endpoint diff --git a/detections/endpoint/process_execution_via_wmi.yml b/detections/endpoint/process_execution_via_wmi.yml index faec4079dd..03864491fc 100644 --- a/detections/endpoint/process_execution_via_wmi.yml +++ b/detections/endpoint/process_execution_via_wmi.yml @@ -5,7 +5,7 @@ date: '2020-03-16' author: Rico Valdez, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `WmiPrvSE.exe` spawning a process. This typically occurs when a process is instantiated from a local or remote process using `wmic.exe`. During triage, review parallel processes for suspicious behavior @@ -63,12 +63,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.parent_process_name - - Processes.user - - Processes.dest - - Processes.process_name risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/process_kill_base_on_file_path.yml b/detections/endpoint/process_kill_base_on_file_path.yml index 335870e7f0..e986faf631 100644 --- a/detections/endpoint/process_kill_base_on_file_path.yml +++ b/detections/endpoint/process_kill_base_on_file_path.yml @@ -5,7 +5,7 @@ date: '2021-05-04' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of `wmic.exe` using `delete` to remove a executable path. This is typically ran via a batch file during beginning stages of an adversary setting up for mining on an endpoint. @@ -56,18 +56,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/process_writing_dynamicwrapperx.yml b/detections/endpoint/process_writing_dynamicwrapperx.yml index 569355761b..ab1ca7fa76 100644 --- a/detections/endpoint/process_writing_dynamicwrapperx.yml +++ b/detections/endpoint/process_writing_dynamicwrapperx.yml @@ -5,7 +5,8 @@ date: '2021-10-05' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: DynamicWrapperX is an ActiveX component that can be used in a script to call Windows API functions, but it requires the dynwrapx.dll to be installed and registered. With that, a binary writing dynwrapx.dll to disk and registering @@ -76,12 +77,23 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid + - Endpoint.Filesystem.user + - Endpoint.Processes.dest + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - dest - - process_name - - process_guid + - file_create_time user - file_name - file_path - - file_create_time user + - process_guid + - process_name risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/processes_launching_netsh.yml b/detections/endpoint/processes_launching_netsh.yml index f6ebe63ee3..fc6ec0b059 100644 --- a/detections/endpoint/processes_launching_netsh.yml +++ b/detections/endpoint/processes_launching_netsh.yml @@ -5,7 +5,7 @@ date: '2021-09-16' author: Michael Haag, Josef Kuepker, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be @@ -67,13 +67,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.user - - Processes.dest risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/ransomware_notes_bulk_creation.yml b/detections/endpoint/ransomware_notes_bulk_creation.yml index db1f7434ed..6804b707ce 100644 --- a/detections/endpoint/ransomware_notes_bulk_creation.yml +++ b/detections/endpoint/ransomware_notes_bulk_creation.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-03-12' author: Teoderick Contreras type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: The following analytics identifies a big number of instance of ransomware notes (filetype e.g .txt, .html, .hta) file creation to the infected machine. This behavior is a good sensor if the ransomware note filename is quite new for security @@ -57,12 +56,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - EventCode - - file_name - - _time - - TargetFilename - Computer + - EventCode - Image - - user + - TargetFilename + - _time + - file_name risk_score: 81 security_domain: endpoint diff --git a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml index f05c0a88d0..3f8f8d1f37 100644 --- a/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml +++ b/detections/endpoint/recursive_delete_of_directory_in_batch_cmd.yml @@ -5,7 +5,7 @@ date: '2021-06-22' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious commandline designed to delete files or directory recursive using batch command. This technique was seen in ransomware (reddot) where it it tries to delete the files in recycle bin to impaire user from @@ -41,18 +41,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml index dae747c94c..3261145fc9 100644 --- a/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml +++ b/detections/endpoint/reg_exe_manipulating_windows_services_registry_keys.yml @@ -5,7 +5,7 @@ date: '2020-11-26' author: Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The search looks for reg.exe modifying registry keys that define Windows services and their configurations. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -70,13 +70,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.parent_process_name - - Processes.user - - Processes.process - - Processes.process_id - - Processes.dest risk_score: 45 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/registry_keys_for_creating_shim_databases.yml b/detections/endpoint/registry_keys_for_creating_shim_databases.yml index 1c3534eb54..7e0c3cf4ac 100644 --- a/detections/endpoint/registry_keys_for_creating_shim_databases.yml +++ b/detections/endpoint/registry_keys_for_creating_shim_databases.yml @@ -4,7 +4,9 @@ version: 4 date: '2020-01-28' author: Bhavin Patel, Patrick Bareiss, Teoderick Contreras, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint.Processes +- Endpoint.Registry description: This search looks for registry activity associated with application compatibility shims, which can be leveraged by attackers for various nefarious purposes. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry @@ -67,10 +69,19 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.dest - - Registry.user risk_score: 56 security_domain: endpoint diff --git a/detections/endpoint/registry_keys_used_for_persistence.yml b/detections/endpoint/registry_keys_used_for_persistence.yml index 6958389f31..c8fca5c6df 100644 --- a/detections/endpoint/registry_keys_used_for_persistence.yml +++ b/detections/endpoint/registry_keys_used_for_persistence.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Jose Hernandez, David Dorsey, Teoderick Contreras, Rod Soto, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The search looks for modifications to registry keys that can be used to launch an application or service at system startup. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry @@ -66,7 +67,6 @@ tags: - Privilege Escalation dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/windows-sysmon.log - - https://raw.githubusercontent.com/splunk/attack_data/master/datasets/attack_techniques/T1547.001/atomic_red_team/t1547001-runonce.log impact: 80 kill_chain_phases: - Actions on Objectives @@ -92,11 +92,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.dest - - Registry.user risk_score: 76 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml index ef863cb47b..b2d8f637f8 100644 --- a/detections/endpoint/registry_keys_used_for_privilege_escalation.yml +++ b/detections/endpoint/registry_keys_used_for_privilege_escalation.yml @@ -4,7 +4,9 @@ version: 5 date: '2022-01-26' author: David Dorsey, Teoderick Contreras, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint.Processes +- Endpoint.Registry description: This search looks for modifications to registry keys that can be used to elevate privileges. The registry keys under "Image File Execution Options" are used to intercept calls to an executable and can be used to attach malicious binaries @@ -74,10 +76,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.dest - - Registry.user risk_score: 76 security_domain: endpoint diff --git a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml index 013a7e4816..47a5b325ff 100644 --- a/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml +++ b/detections/endpoint/regsvr32_silent_and_install_param_dll_loading.yml @@ -5,7 +5,7 @@ date: '2021-10-04' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a loading of dll using regsvr32 application with silent parameter and dllinstall execution. This technique was seen in several RAT malware similar to remcos, njrat and adversaries to load their malicious DLL @@ -71,18 +71,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 36 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml index 9a2eec50d2..41e3ab3abd 100644 --- a/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml +++ b/detections/endpoint/regsvr32_with_known_silent_switch_cmdline.yml @@ -5,7 +5,7 @@ date: '2021-07-27' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies Regsvr32.exe utilizing the silent switch to load DLLs. This technique has most recently been seen in IcedID campaigns to load its initial dll that will download the 2nd stage loader that will download @@ -72,18 +72,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/remcos_client_registry_install_entry.yml b/detections/endpoint/remcos_client_registry_install_entry.yml index 17c83f11a9..21bd34ab65 100644 --- a/detections/endpoint/remcos_client_registry_install_entry.yml +++ b/detections/endpoint/remcos_client_registry_install_entry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Bhavin Patel, Rod Soto, Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search detects registry key license at host where Remcos RAT agent is installed. search: '| tstats `security_content_summariesonly` count FROM datamodel=Endpoint.Registry @@ -53,12 +54,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.process_id - - Registry.dest - - Registry.user risk_score: 90 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml index 1184bd9ade..412bef8481 100644 --- a/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml +++ b/detections/endpoint/remcos_rat_file_creation_in_remcos_folder.yml @@ -5,7 +5,7 @@ date: '2021-09-21' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: This search is to detect file creation in remcos folder in appdata which is the keylog and clipboard logs that will be send to its c2 server. This is really a good TTP indicator that there is a remcos rat in the system that do keylogging, @@ -49,6 +49,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path - _time - dest - file_create_time diff --git a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml index 4a7362585c..4f6c7c8a4b 100644 --- a/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_dcom_and_powershell.yml @@ -5,7 +5,7 @@ date: '2021-11-15' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint by abusing the DCOM protocol. Specifically, this search looks for the abuse of ShellExecute and ExecuteShellCommand. Red Teams @@ -53,18 +53,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml index fff1f18412..53609f18c1 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_powershell.yml @@ -5,7 +5,7 @@ date: '2021-11-16' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with arguments utilized to start a process on a remote endpoint by abusing the WinRM protocol. Specifically, this search looks for the abuse of the `Invoke-Command` commandlet. @@ -54,18 +54,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 45 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml index 2abcf01122..9ec616dd42 100644 --- a/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml +++ b/detections/endpoint/remote_process_instantiation_via_winrm_and_winrs.yml @@ -5,7 +5,7 @@ date: '2021-11-11' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `winrs.exe` with command-line arguments utilized to start a process on a remote endpoint. Red Teams and adversaries alike may abuse the WinRM protocol and this binary for lateral movement and remote @@ -52,18 +52,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi.yml b/detections/endpoint/remote_process_instantiation_via_wmi.yml index 2f68f5492b..f4d0f99032 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Rico Valdez, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies wmic.exe being launched with parameters to spawn a process on a remote system. Red Teams and adversaries alike may abuse WMI and this binary for lateral movement and remote code execution. @@ -68,18 +68,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml index d9ff14079a..f2116f1a25 100644 --- a/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml +++ b/detections/endpoint/remote_process_instantiation_via_wmi_and_powershell.yml @@ -5,7 +5,7 @@ date: '2021-11-15' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` leveraging the `Invoke-WmiMethod` commandlet complemented with arguments utilized to start a process on a remote endpoint by abusing WMI. Red Teams and adversaries alike may @@ -52,18 +52,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/remote_system_discovery_with_dsquery.yml b/detections/endpoint/remote_system_discovery_with_dsquery.yml index 5d6a595a25..9f6619832b 100644 --- a/detections/endpoint/remote_system_discovery_with_dsquery.yml +++ b/detections/endpoint/remote_system_discovery_with_dsquery.yml @@ -5,7 +5,7 @@ date: '2021-08-31' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `dsquery.exe` with command-line arguments utilized to discover remote systems. The `computer` argument returns a list of all computers registered in the domain. Red Teams and adversaries alike @@ -51,16 +51,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/remote_system_discovery_with_net.yml b/detections/endpoint/remote_system_discovery_with_net.yml index 34d963c52f..f229c27b83 100644 --- a/detections/endpoint/remote_system_discovery_with_net.yml +++ b/detections/endpoint/remote_system_discovery_with_net.yml @@ -5,7 +5,7 @@ date: '2021-08-30' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `net.exe` or `net1.exe` with command-line arguments utilized to discover remote systems. The argument `domain computers /domain` returns a list of all domain computers. Red Teams and adversaries @@ -51,16 +51,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/remote_system_discovery_with_wmic.yml b/detections/endpoint/remote_system_discovery_with_wmic.yml index 092c163d81..17ca573b6d 100644 --- a/detections/endpoint/remote_system_discovery_with_wmic.yml +++ b/detections/endpoint/remote_system_discovery_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-09-01' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `wmic.exe` with command-line arguments utilized to discover remote systems. The arguments utilized in this command return a list of all the systems registered in the domain. Red Teams and adversaries @@ -52,17 +52,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/remote_wmi_command_attempt.yml b/detections/endpoint/remote_wmi_command_attempt.yml index b88e03dead..5134ac26fb 100644 --- a/detections/endpoint/remote_wmi_command_attempt.yml +++ b/detections/endpoint/remote_wmi_command_attempt.yml @@ -5,7 +5,7 @@ date: '2018-12-03' author: Rico Valdez, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies usage of `wmic.exe` spawning a local or remote process, identified by the `node` switch. During triage, review parallel processes for additional commands executed. Look for any file modifications before @@ -66,14 +66,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.user - - Processes.process_name - - Processes.parent_process_name - - Processes.dest - - Processes.parent_process - - Processes.parent_process_id - - Processes.process_id risk_score: 36 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/resize_shadowstorage_volume.yml b/detections/endpoint/resize_shadowstorage_volume.yml index ecbd7e4c63..98c573e05e 100644 --- a/detections/endpoint/resize_shadowstorage_volume.yml +++ b/detections/endpoint/resize_shadowstorage_volume.yml @@ -5,7 +5,7 @@ date: '2021-03-12' author: Teoderick Contreras type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytics identifies the resizing of shadowstorage by ransomware malware to avoid the shadow volumes being made again. this technique is an alternative by ransomware attacker than deleting the shadowstorage which is known alert in defensive @@ -64,13 +64,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.process - - Process.parent_process_name + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.parent_process - - Processes.dest - - Processes.user risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/revil_common_exec_parameter.yml b/detections/endpoint/revil_common_exec_parameter.yml index b48aa0033c..2bb4f09c93 100644 --- a/detections/endpoint/revil_common_exec_parameter.yml +++ b/detections/endpoint/revil_common_exec_parameter.yml @@ -5,7 +5,7 @@ date: '2021-06-02' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies suspicious commandline parameter that are commonly used by REVIL ransomware to encrypts the compromise machine. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -56,15 +56,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.parent_process - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process_guid risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/revil_registry_entry.yml b/detections/endpoint/revil_registry_entry.yml index d24975ae03..c51c42758a 100644 --- a/detections/endpoint/revil_registry_entry.yml +++ b/detections/endpoint/revil_registry_entry.yml @@ -5,7 +5,8 @@ date: '2021-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic identifies suspicious modification in registry entry to keep some malware data during its infection. This technique seen in several apt implant, malware and ransomware like REVIL where it keep some information like the @@ -63,12 +64,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_value_name - - Registry.registry_path - - Registry.registry_key_name risk_score: 60 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/rubeus_command_line_parameters.yml b/detections/endpoint/rubeus_command_line_parameters.yml index d73d45add5..0d33a9eb7f 100644 --- a/detections/endpoint/rubeus_command_line_parameters.yml +++ b/detections/endpoint/rubeus_command_line_parameters.yml @@ -5,7 +5,7 @@ date: '2022-02-01' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Rubeus is a C# toolset for raw Kerberos interaction and abuses. It is heavily adapted from Benjamin Delpys Kekeo project and Vincent LE TOUXs MakeMeEnterpriseAdmin project. This analytic looks for the use of Rubeus command line arguments utilized @@ -73,14 +73,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id - - Processes.parent_process_name risk_score: 36 security_domain: endpoint diff --git a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml index 3558058c97..71c80d6970 100644 --- a/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml +++ b/detections/endpoint/rubeus_kerberos_ticket_exports_through_winlogon_access.yml @@ -64,13 +64,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - EventCode - - TargetImage - - CallTrace - Computer - - TargetProcessId + - EventCode - SourceImage - SourceProcessId + - TargetImage + - TargetProcessId + - _time risk_score: 36 security_domain: endpoint diff --git a/detections/endpoint/runas_execution_in_commandline.yml b/detections/endpoint/runas_execution_in_commandline.yml index d7fefc7c3e..94d34e3ad9 100644 --- a/detections/endpoint/runas_execution_in_commandline.yml +++ b/detections/endpoint/runas_execution_in_commandline.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic look for a spawned runas.exe process with a administrator user option parameter. This parameter was abused by adversaries, malware author or even red teams to gain elevated privileges in target host. This is a good hunting @@ -55,14 +55,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/rundll32_control_rundll_hunt.yml b/detections/endpoint/rundll32_control_rundll_hunt.yml index 3e2e0dfb3b..611f3e9edc 100644 --- a/detections/endpoint/rundll32_control_rundll_hunt.yml +++ b/detections/endpoint/rundll32_control_rundll_hunt.yml @@ -5,7 +5,7 @@ date: '2021-09-08' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type. Developed in relation to CVE-2021-40444. Rundll32.exe can also be used to execute Control Panel Item files @@ -76,16 +76,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml index e22be31c8a..3d089e145f 100644 --- a/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml +++ b/detections/endpoint/rundll32_control_rundll_world_writable_directory.yml @@ -5,7 +5,7 @@ date: '2021-09-08' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies rundll32.exe with `control_rundll` within the command-line, loading a .cpl or another file type from windows\temp, programdata, or appdata. Developed in relation to CVE-2021-40444. Rundll32.exe can @@ -78,17 +78,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml index aef668eded..0f1c87ef17 100644 --- a/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml +++ b/detections/endpoint/rundll32_create_remote_thread_to_a_process.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-29' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to cmd.exe process. This technique was seen in IcedID malware to execute its malicious code in normal process for defense evasion and to steal sensitive diff --git a/detections/endpoint/rundll32_createremotethread_in_browser.yml b/detections/endpoint/rundll32_createremotethread_in_browser.yml index 5c16b5d6d6..64fd76cd9a 100644 --- a/detections/endpoint/rundll32_createremotethread_in_browser.yml +++ b/detections/endpoint/rundll32_createremotethread_in_browser.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-26' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic identifies the suspicious Remote Thread execution of rundll32.exe process to "firefox.exe" and "chrome.exe" browser. This technique was seen in IcedID malware where it hooks the browser to parse banking information as user used the diff --git a/detections/endpoint/rundll32_dnsquery.yml b/detections/endpoint/rundll32_dnsquery.yml index cfb2f9d846..4e1a7b94b7 100644 --- a/detections/endpoint/rundll32_dnsquery.yml +++ b/detections/endpoint/rundll32_dnsquery.yml @@ -4,8 +4,7 @@ version: 2 date: '2022-02-18' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious rundll32.exe process having a http connection and do a dns query in some web domain. This technique was seen in IcedID malware where the rundll32 that execute its payload will contact amazon.com to check diff --git a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml index b23c0499f3..777dbdc246 100644 --- a/detections/endpoint/rundll32_process_creating_exe_dll_files.yml +++ b/detections/endpoint/rundll32_process_creating_exe_dll_files.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-26' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious rundll32 process that drops executable (.exe or .dll) files. this behavior seen in rundll32 process of IcedID that tries to drop copy of itself in temp folder or download executable drop it either appdata diff --git a/detections/endpoint/rundll32_shimcache_flush.yml b/detections/endpoint/rundll32_shimcache_flush.yml index 845bd66115..de1f4618ed 100644 --- a/detections/endpoint/rundll32_shimcache_flush.yml +++ b/detections/endpoint/rundll32_shimcache_flush.yml @@ -5,7 +5,7 @@ date: '2021-10-05' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious rundll32 commandline to clear shim cache. This technique is a anti-forensic technique to clear the cache taht are one important artifacts in terms of digital forensic during attacks or incident. @@ -55,18 +55,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml index 632a790430..82b48ce8be 100644 --- a/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml +++ b/detections/endpoint/rundll32_with_no_command_line_arguments_with_network.yml @@ -5,7 +5,8 @@ date: '2021-10-13' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Ports +- Endpoint.Processes description: The following analytic identifies rundll32.exe with no command line arguments and performing a network connection. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious @@ -72,18 +73,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Ports.dest + - Endpoint.Ports.dest_port + - Endpoint.Ports.process_guid + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 70 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/rundll_loading_dll_by_ordinal.yml b/detections/endpoint/rundll_loading_dll_by_ordinal.yml index 39ea9b205b..6e331e09e1 100644 --- a/detections/endpoint/rundll_loading_dll_by_ordinal.yml +++ b/detections/endpoint/rundll_loading_dll_by_ordinal.yml @@ -5,7 +5,7 @@ date: '2022-02-08' author: Michael Haag, David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe loading an export function by ordinal value. Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly, may avoid triggering security @@ -68,17 +68,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/ryuk_test_files_detected.yml b/detections/endpoint/ryuk_test_files_detected.yml index caa87944dd..50fe687bf7 100644 --- a/detections/endpoint/ryuk_test_files_detected.yml +++ b/detections/endpoint/ryuk_test_files_detected.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint.Filesystem description: The search looks for files that contain the key word *Ryuk* under any folder in the C drive, which is consistent with Ryuk propagation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -54,9 +55,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.user - _time - - Filesystem.file_path - - Filesystem.dest - - Filesystem.user risk_score: 70 security_domain: endpoint diff --git a/detections/endpoint/ryuk_wake_on_lan_command.yml b/detections/endpoint/ryuk_wake_on_lan_command.yml index 684c485717..e78adcfb45 100644 --- a/detections/endpoint/ryuk_wake_on_lan_command.yml +++ b/detections/endpoint/ryuk_wake_on_lan_command.yml @@ -5,7 +5,7 @@ date: '2021-03-01' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This Splunk query identifies the use of Wake-on-LAN utilized by Ryuk ransomware. The Ryuk Ransomware uses the Wake-on-Lan feature to turn on powered off devices on a compromised network to have greater success encrypting them. This @@ -62,15 +62,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/sam_database_file_access_attempt.yml b/detections/endpoint/sam_database_file_access_attempt.yml index 4df51115be..53f65a1b48 100644 --- a/detections/endpoint/sam_database_file_access_attempt.yml +++ b/detections/endpoint/sam_database_file_access_attempt.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-23' author: Michael Haag, Mauricio Velazco, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: The following analytic identifies access to SAM, SYSTEM or SECURITY databases' within the file path of `windows\system32\config` using Windows Security EventCode 4663. This particular behavior is related to credential access, an attempt to either @@ -69,10 +68,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - process_name - Object_Name - dest + - process_name - user risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/samsam_test_file_write.yml b/detections/endpoint/samsam_test_file_write.yml index 17516b0b39..72d6290e38 100644 --- a/detections/endpoint/samsam_test_file_write.yml +++ b/detections/endpoint/samsam_test_file_write.yml @@ -5,7 +5,7 @@ date: '2018-12-14' author: Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem description: The search looks for a file named "test.txt" written to the windows system directory tree, which is consistent with Samsam propagation. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -55,11 +55,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.user - _time - - Filesystem.user - - Filesystem.dest - - Filesystem.file_name - - Filesystem.file_path risk_score: 12 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/sc_exe_manipulating_windows_services.yml b/detections/endpoint/sc_exe_manipulating_windows_services.yml index daec04b402..0d06f72f75 100644 --- a/detections/endpoint/sc_exe_manipulating_windows_services.yml +++ b/detections/endpoint/sc_exe_manipulating_windows_services.yml @@ -5,7 +5,7 @@ date: '2020-07-21' author: Rico Valdez, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for arguments to sc.exe indicating the creation or modification of a Windows service. search: '| tstats `security_content_summariesonly` values(Processes.process) as process @@ -70,12 +70,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml index d627f66d3c..bce5ac1dfa 100644 --- a/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml +++ b/detections/endpoint/schcache_change_by_app_connect_and_create_adsi_object.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-09-07' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This analytic is to detect an application try to connect and create ADSI Object to do LDAP query. Every time an application connects to the directory and attempts to create an ADSI object, the Active Directory Schema is checked for changes. diff --git a/detections/endpoint/schedule_task_with_http_command_arguments.yml b/detections/endpoint/schedule_task_with_http_command_arguments.yml index 955ca654b2..a796283cb4 100644 --- a/detections/endpoint/schedule_task_with_http_command_arguments.yml +++ b/detections/endpoint/schedule_task_with_http_command_arguments.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with an arguments "HTTP" string that are unique entry diff --git a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml index 9e00f1bc79..f7ed8b0f03 100644 --- a/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml +++ b/detections/endpoint/schedule_task_with_rundll32_command_trigger.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following query utilizes Windows Security EventCode 4698, `A scheduled task was created`, to identify suspicious tasks registered on Windows either via schtasks.exe OR TaskService with a command to be executed with a Rundll32. This diff --git a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml index 1a20a684f4..87a3d1231b 100644 --- a/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml +++ b/detections/endpoint/scheduled_task_creation_on_remote_endpoint_using_at.yml @@ -5,7 +5,7 @@ date: '2021-11-11' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `at.exe` with command-line arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code execution. @@ -54,18 +54,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml index 72b31f9060..657a0f540c 100644 --- a/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml +++ b/detections/endpoint/scheduled_task_deleted_or_created_via_cmd.yml @@ -5,7 +5,7 @@ date: '2022-02-22' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the creation or deletion of a scheduled task using schtasks.exe with flags - create or delete being passed on the command-line. This has been associated with the Dragonfly threat actor, and the SUNBURST attack @@ -66,13 +66,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - - Processes.parent_process_name - - Processes.dest risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml index 8860f35c80..d053085f2d 100644 --- a/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/scheduled_task_initiation_on_remote_endpoint.yml @@ -5,7 +5,7 @@ date: '2021-11-11' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `schtasks.exe` with command-line arguments utilized to start a Scheduled Task on a remote endpoint. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code @@ -51,18 +51,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/schtasks_run_task_on_demand.yml b/detections/endpoint/schtasks_run_task_on_demand.yml index 263758ac10..6de86e4725 100644 --- a/detections/endpoint/schtasks_run_task_on_demand.yml +++ b/detections/endpoint/schtasks_run_task_on_demand.yml @@ -5,7 +5,7 @@ date: '2021-05-07' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies an on demand run of a Windows Schedule Task through shell or command-line. This technique has been used by adversaries that force to run their created Schedule Task as their persistence mechanism or for lateral @@ -57,13 +57,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.process_id - - Processes.process_name - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 48 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml index a7d455035f..b061bc788a 100644 --- a/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml +++ b/detections/endpoint/schtasks_scheduling_job_on_remote_system.yml @@ -5,7 +5,7 @@ date: '2021-11-11' author: David Dorsey, Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `schtasks.exe` with command-line arguments utilized to create a Scheduled Task on a remote endpoint. Red Teams and adversaries alike may abuse the Task Scheduler for lateral movement and remote code @@ -65,12 +65,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml index 053b428c8e..9beee8f3f1 100644 --- a/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml +++ b/detections/endpoint/schtasks_used_for_forcing_a_reboot.yml @@ -5,7 +5,7 @@ date: '2020-12-07' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for flags passed to schtasks.exe on the command-line that indicate that a forced reboot of system is scheduled. search: '| tstats `security_content_summariesonly` values(Processes.process) as process @@ -62,12 +62,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.process_name - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/screensaver_event_trigger_execution.yml b/detections/endpoint/screensaver_event_trigger_execution.yml index 003016f8c8..7a289dbcbf 100644 --- a/detections/endpoint/screensaver_event_trigger_execution.yml +++ b/detections/endpoint/screensaver_event_trigger_execution.yml @@ -5,7 +5,7 @@ date: '2021-09-27' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: This analytic is developed to detect possible event trigger execution through screensaver registry entry modification for persistence or privilege escalation. This technique was seen in several APT and malware where they put the malicious @@ -59,12 +59,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Registry.dest + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/script_execution_via_wmi.yml b/detections/endpoint/script_execution_via_wmi.yml index ac87865b4c..572255ea8c 100644 --- a/detections/endpoint/script_execution_via_wmi.yml +++ b/detections/endpoint/script_execution_via_wmi.yml @@ -5,7 +5,7 @@ date: '2020-03-16' author: Rico Valdez, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for scripts launched via WMI. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=scrcons.exe @@ -59,10 +59,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.user - - Processes.dest risk_score: 36 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/sdclt_uac_bypass.yml b/detections/endpoint/sdclt_uac_bypass.yml index cf395a7332..af0139d910 100644 --- a/detections/endpoint/sdclt_uac_bypass.yml +++ b/detections/endpoint/sdclt_uac_bypass.yml @@ -5,7 +5,8 @@ date: '2020-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to detect a suspicious sdclt.exe registry modification. This technique is commonly seen when attacker try to bypassed UAC by using sdclt.exe application by modifying some registry that sdclt.exe tries to open or query with @@ -64,11 +65,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/sdelete_application_execution.yml b/detections/endpoint/sdelete_application_execution.yml index 8b57213736..1419f4c0ac 100644 --- a/detections/endpoint/sdelete_application_execution.yml +++ b/detections/endpoint/sdelete_application_execution.yml @@ -5,7 +5,7 @@ date: '2021-10-06' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect the execution of sdelete.exe application sysinternal tools. This tool is one of the most use tool of malware and adversaries to remove or clear their tracks and artifact in the targetted host. This tool is designed @@ -59,18 +59,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml index 54f3073620..517b5fc9b6 100644 --- a/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml +++ b/detections/endpoint/searchprotocolhost_with_no_command_line_with_network.yml @@ -5,7 +5,8 @@ date: '2021-10-13' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Ports +- Endpoint.Processes description: The following analytic identifies searchprotocolhost.exe with no command line arguments and with a network connection. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common @@ -61,11 +62,19 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Ports.dest + - Endpoint.Ports.dest_port + - Endpoint.Ports.process_guid + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - process_name - - process_id - - parent_process_name - dest_port + - parent_process_name + - process_name - process_path risk_score: 70 security_domain: endpoint diff --git a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml index 9a46d7b579..84fe6d52ad 100644 --- a/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml +++ b/detections/endpoint/secretdumps_offline_ntds_dumping_tool.yml @@ -5,7 +5,7 @@ date: '2021-05-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic detects a potential usage of secretsdump.py tool for dumping credentials (ntlm hash) from a copy of ntds.dit and SAM.Security,SYSTEM registrry hive. This technique was seen in some attacker that dump ntlm hashes offline after @@ -57,15 +57,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.parent_process - - Processes.dest - - Processes.user - - Processes.process_id - - Processes.process_guid risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml index 63098b3965..841e636ae1 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_powershell.yml @@ -86,16 +86,5 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml index 8e3be8fa03..c59bdef93b 100644 --- a/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml +++ b/detections/endpoint/serviceprincipalnames_discovery_with_setspn.yml @@ -5,7 +5,7 @@ date: '2021-10-14' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies `setspn.exe` usage related to querying the domain for Service Principle Names. typically, this is a precursor activity related to kerberoasting or the silver ticket attack. \ @@ -94,18 +94,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/services_escalate_exe.yml b/detections/endpoint/services_escalate_exe.yml index f1f7aa5fe7..3511dacf38 100644 --- a/detections/endpoint/services_escalate_exe.yml +++ b/detections/endpoint/services_escalate_exe.yml @@ -5,7 +5,7 @@ date: '2021-05-18' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of `svc-exe` with Cobalt Strike. The behavior typically follows after an adversary has already gained initial access and is escalating privileges. Using `svc-exe`, a randomly named binary will be downloaded @@ -65,14 +65,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 76 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml index 7e4b21420b..cc3ec5a1ac 100644 --- a/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/services_exe_lolbas_execution_process_spawn.yml @@ -5,7 +5,7 @@ date: '2021-11-22' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `services.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Service Control Manager and creating a remote malicious service, the executed command is spawned @@ -65,18 +65,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml index abb769c084..178aab01fd 100644 --- a/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml +++ b/detections/endpoint/set_default_powershell_execution_policy_to_unrestricted_or_bypass.yml @@ -5,7 +5,7 @@ date: '2022-02-18' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: Monitor for changes of the ExecutionPolicy in the registry to the values "unrestricted" or "bypass," which allows the execution of malicious scripts. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -64,11 +64,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Registry.dest + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest risk_score: 48 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/shim_database_file_creation.yml b/detections/endpoint/shim_database_file_creation.yml index a29923fe90..b5fe03b7b4 100644 --- a/detections/endpoint/shim_database_file_creation.yml +++ b/detections/endpoint/shim_database_file_creation.yml @@ -4,7 +4,8 @@ version: 3 date: '2020-12-08' author: David Dorsey, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint.Filesystem description: This search looks for shim database files being written to default directories. The sdbinst.exe application is used to install shim database files (.sdb). According to Microsoft, a shim is a small library that transparently intercepts an API, changes @@ -60,10 +61,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.action + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_hash + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path - _time - - Filesystem.file_hash - - Filesystem.file_path - - Filesystem.file_name - - Filesystem.dest risk_score: 56 security_domain: endpoint diff --git a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml index d8ac0829e0..9e605fbf35 100644 --- a/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml +++ b/detections/endpoint/shim_database_installation_with_suspicious_parameters.yml @@ -5,7 +5,7 @@ date: '2020-11-23' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search detects the process execution and arguments required to silently create a shim database. The sdbinst.exe application is used to install shim database files (.sdb). A shim is a small library which transparently intercepts an API, changes @@ -61,11 +61,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/short_lived_scheduled_task.yml b/detections/endpoint/short_lived_scheduled_task.yml index 260ed20cce..487bc4f58c 100644 --- a/detections/endpoint/short_lived_scheduled_task.yml +++ b/detections/endpoint/short_lived_scheduled_task.yml @@ -56,12 +56,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - dest - - ComputerName - Account_Name - - Task_Name - - Description - Command + - ComputerName + - Task_Name + - _time risk_score: 81 security_domain: endpoint diff --git a/detections/endpoint/short_lived_windows_accounts.yml b/detections/endpoint/short_lived_windows_accounts.yml index 839c7fb59b..7b2b98561c 100644 --- a/detections/endpoint/short_lived_windows_accounts.yml +++ b/detections/endpoint/short_lived_windows_accounts.yml @@ -5,7 +5,7 @@ date: '2020-07-06' author: David Dorsey, Splunk type: TTP datamodel: -- Change +- Change.All_Changes description: This search detects accounts that were created and deleted in a short time period. search: '| tstats `security_content_summariesonly` values(All_Changes.result_id) as @@ -57,9 +57,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Change.All_Changes.dest + - Change.All_Changes.result_id + - Change.All_Changes.user - _time - - All_Changes.result_id - - All_Changes.user - - All_Changes.dest risk_score: 63 security_domain: access diff --git a/detections/endpoint/silentcleanup_uac_bypass.yml b/detections/endpoint/silentcleanup_uac_bypass.yml index c1a9885737..946658479d 100644 --- a/detections/endpoint/silentcleanup_uac_bypass.yml +++ b/detections/endpoint/silentcleanup_uac_bypass.yml @@ -5,7 +5,8 @@ date: '2020-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to detect a suspicious modification of registry that may related to UAC bypassed. This registry will be trigger once the attacker abuse the silentcleanup task schedule to gain high privilege execution that will bypass User @@ -62,11 +63,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/single_letter_process_on_endpoint.yml b/detections/endpoint/single_letter_process_on_endpoint.yml index 2d4277a1f6..19b30727bd 100644 --- a/detections/endpoint/single_letter_process_on_endpoint.yml +++ b/detections/endpoint/single_letter_process_on_endpoint.yml @@ -5,7 +5,7 @@ date: '2020-12-08' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for process names that consist only of a single letter. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest, Processes.user, @@ -59,11 +59,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.process - - Processes.process_name risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/slui_runas_elevated.yml b/detections/endpoint/slui_runas_elevated.yml index fce44aa6e2..92608a086d 100644 --- a/detections/endpoint/slui_runas_elevated.yml +++ b/detections/endpoint/slui_runas_elevated.yml @@ -5,7 +5,7 @@ date: '2021-05-13' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, elevating access using the `-verb runas` function. This particular bypass utilizes a registry key/value. Identified by two sources, the @@ -62,14 +62,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/slui_spawning_a_process.yml b/detections/endpoint/slui_spawning_a_process.yml index 0fa2eac2c0..e75d82e0aa 100644 --- a/detections/endpoint/slui_spawning_a_process.yml +++ b/detections/endpoint/slui_spawning_a_process.yml @@ -5,7 +5,7 @@ date: '2021-05-13' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the Microsoft Software Licensing User Interface Tool, `slui.exe`, spawning a child process. This behavior is associated with publicly known UAC bypass. `slui.exe` is commonly associated with software @@ -60,14 +60,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/spoolsv_spawning_rundll32.yml b/detections/endpoint/spoolsv_spawning_rundll32.yml index 8f7e3d5acc..f0b762b0ac 100644 --- a/detections/endpoint/spoolsv_spawning_rundll32.yml +++ b/detections/endpoint/spoolsv_spawning_rundll32.yml @@ -5,7 +5,7 @@ date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies a suspicious child process, `rundll32.exe`, with no command-line arguments being spawned from `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. @@ -70,18 +70,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml index 216dd6aa45..a753245fe3 100644 --- a/detections/endpoint/spoolsv_suspicious_loaded_modules.yml +++ b/detections/endpoint/spoolsv_suspicious_loaded_modules.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect suspicious loading of dll in specific path relative to printnightmare exploitation. In this search we try to detect the loaded modules made by spoolsv.exe after the exploitation. diff --git a/detections/endpoint/spoolsv_suspicious_process_access.yml b/detections/endpoint/spoolsv_suspicious_process_access.yml index ba666c3153..5c36ef9248 100644 --- a/detections/endpoint/spoolsv_suspicious_process_access.yml +++ b/detections/endpoint/spoolsv_suspicious_process_access.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic identifies a suspicious behavior related to PrintNightmare, or CVE-2021-34527 previously (CVE-2021-1675), to gain privilege escalation on the vulnerable machine. This exploit attacks a critical Windows Print Spooler Vulnerability diff --git a/detections/endpoint/spoolsv_writing_a_dll.yml b/detections/endpoint/spoolsv_writing_a_dll.yml index f296a79eee..9be42bbd3a 100644 --- a/detections/endpoint/spoolsv_writing_a_dll.yml +++ b/detections/endpoint/spoolsv_writing_a_dll.yml @@ -5,7 +5,8 @@ date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously (CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write @@ -70,15 +71,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Processes.dest + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name - _time - - Filesystem.dest - - Filesystem.file_create_time - - Filesystem.file_name - - Filesystem.file_path - - Processes.process_name - - Processes.process_id - - Processes.process_name - - Processes.dest risk_score: 72 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml index 51bddc63a6..c8fe423696 100644 --- a/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml +++ b/detections/endpoint/spoolsv_writing_a_dll___sysmon.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-01' author: Mauricio Velazco, Michael Haag, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: The following analytic identifies a `.dll` being written by `spoolsv.exe`. This was identified during our testing of CVE-2021-34527 previously(CVE-2021-1675) or PrintNightmare. Typically, this is not normal behavior for `spoolsv.exe` to write diff --git a/detections/endpoint/sqlite_module_in_temp_folder.yml b/detections/endpoint/sqlite_module_in_temp_folder.yml index 4bb923bf27..8325373ec9 100644 --- a/detections/endpoint/sqlite_module_in_temp_folder.yml +++ b/detections/endpoint/sqlite_module_in_temp_folder.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-08-03' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious file creation of sqlite3.dll in %temp% folder. This behavior was seen in IcedID malware where it download sqlite module to parse browser database like for chrome or firefox to stole browser information diff --git a/detections/endpoint/start_up_during_safe_mode_boot.yml b/detections/endpoint/start_up_during_safe_mode_boot.yml index 7e2e1427db..0ecdbe7515 100644 --- a/detections/endpoint/start_up_during_safe_mode_boot.yml +++ b/detections/endpoint/start_up_during_safe_mode_boot.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to detect a modification or registry add to the safeboot registry as an autostart mechanism. This technique was seen in some ransomware to automatically execute its code upon a safe mode boot. @@ -59,11 +60,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_computer_account_name_change.yml b/detections/endpoint/suspicious_computer_account_name_change.yml index fd5671bb4e..a384c1a139 100644 --- a/detections/endpoint/suspicious_computer_account_name_change.yml +++ b/detections/endpoint/suspicious_computer_account_name_change.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-12-20' author: Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries need to create a new computer account name and rename it to match the name of a domain controller diff --git a/detections/endpoint/suspicious_copy_on_system32.yml b/detections/endpoint/suspicious_copy_on_system32.yml index 790e3c976f..73106c8f72 100644 --- a/detections/endpoint/suspicious_copy_on_system32.yml +++ b/detections/endpoint/suspicious_copy_on_system32.yml @@ -5,7 +5,7 @@ date: '2021-10-05' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious copy of file from systemroot folder of the windows OS. This technique is commonly used by APT or other malware as part of execution (LOLBIN) to run its malicious code using the available legitimate @@ -58,18 +58,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml index 3e39f5d928..190a52e933 100644 --- a/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_dllhost_no_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2021-09-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies DLLHost.exe with no command line arguments. It is unusual for DLLHost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. @@ -60,18 +60,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_driver_loaded_path.yml b/detections/endpoint/suspicious_driver_loaded_path.yml index 10a0bada0e..a19ab1c39f 100644 --- a/detections/endpoint/suspicious_driver_loaded_path.yml +++ b/detections/endpoint/suspicious_driver_loaded_path.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-29' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will detect suspicious driver loaded paths. This technique is commonly used by malicious software like coin miners (xmrig) to register its malicious driver from notable directories where executable or drivers do not commonly diff --git a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml index 36e0a60730..9745702022 100644 --- a/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_gpupdate_no_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2021-09-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies gpupdate.exe with no command line arguments. It is unusual for gpupdate.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. @@ -59,18 +59,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml index 8575a27f5d..6f6b7742e1 100644 --- a/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml +++ b/detections/endpoint/suspicious_icedid_rundll32_cmdline.yml @@ -5,7 +5,7 @@ date: '2021-07-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious rundll32.exe commandline to execute dll file. This technique was seen in IcedID malware to load its payload dll with the following parameter to load encrypted dll payload which is the license.dat. @@ -55,18 +55,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml index cc90d22e6e..732e8e63bb 100644 --- a/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_image_creation_in_appdata_folder.yml @@ -5,7 +5,8 @@ date: '2021-09-21' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: This search is to detect a suspicious creation of image in appdata folder made by process that also has a file reference in appdata folder. This technique was seen in remcos rat that capture screenshot of the compromised machine and place @@ -60,13 +61,22 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Processes.dest + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - dest - file_create_time - file_name - file_path + - process - process_name - process_path - - process risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml index eb1dccb291..62eced7a50 100644 --- a/detections/endpoint/suspicious_kerberos_service_ticket_request.yml +++ b/detections/endpoint/suspicious_kerberos_service_ticket_request.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-12-20' author: Mauricio Velazco, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will request and obtain a Kerberos Service Ticket (TGS) with a domain controller computer account diff --git a/detections/endpoint/suspicious_linux_discovery_commands.yml b/detections/endpoint/suspicious_linux_discovery_commands.yml index 1740cfb0b7..b79d364c53 100644 --- a/detections/endpoint/suspicious_linux_discovery_commands.yml +++ b/detections/endpoint/suspicious_linux_discovery_commands.yml @@ -5,7 +5,7 @@ date: '2021-12-06' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'This search, detects execution of suspicious bash commands from various commonly leveraged bash scripts like (AutoSUID, LinEnum, LinPeas) to perform discovery of possible paths of privilege execution, password files, vulnerable directories, @@ -58,10 +58,11 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.parent_process_name - - Processes.user - - Processes.process_name risk_score: 81 security_domain: endpoint diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml index 94eaa1d5b8..b7c10f6c56 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_rename.yml @@ -5,7 +5,7 @@ date: '2021-09-20' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies a renamed instance of microsoft.workflow.compiler.exe. Microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and @@ -71,17 +71,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint diff --git a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml index 3b400ef260..b1de590a99 100644 --- a/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml +++ b/detections/endpoint/suspicious_microsoft_workflow_compiler_usage.yml @@ -5,7 +5,7 @@ date: '2021-01-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies microsoft.workflow.compiler.exe usage. microsoft.workflow.compiler.exe is natively found in C:\Windows\Microsoft.NET\Framework64\v4.0.30319 and is rarely utilized. When investigating, identify the executed code on disk and @@ -61,18 +61,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_msbuild_path.yml b/detections/endpoint/suspicious_msbuild_path.yml index a5d11e2305..3e8cf55641 100644 --- a/detections/endpoint/suspicious_msbuild_path.yml +++ b/detections/endpoint/suspicious_msbuild_path.yml @@ -5,7 +5,7 @@ date: '2021-01-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies msbuild.exe executing from a non-standard path. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. Instances of Visual Studio @@ -72,18 +72,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_msbuild_rename.yml b/detections/endpoint/suspicious_msbuild_rename.yml index fdb7e16f85..4fbc4c90bc 100644 --- a/detections/endpoint/suspicious_msbuild_rename.yml +++ b/detections/endpoint/suspicious_msbuild_rename.yml @@ -5,7 +5,7 @@ date: '2021-01-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies renamed instances of msbuild.exe executing. Msbuild.exe is natively found in C:\Windows\Microsoft.NET\Framework\v4.0.30319 and C:\Windows\Microsoft.NET\Framework64\v4.0.30319. During investigation, identify @@ -70,18 +70,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_msbuild_spawn.yml b/detections/endpoint/suspicious_msbuild_spawn.yml index eb3153be52..eb4a09fdc7 100644 --- a/detections/endpoint/suspicious_msbuild_spawn.yml +++ b/detections/endpoint/suspicious_msbuild_spawn.yml @@ -5,7 +5,7 @@ date: '2021-01-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies wmiprvse.exe spawning msbuild.exe. This behavior is indicative of a COM object being utilized to spawn msbuild from wmiprvse.exe. It is common for MSBuild.exe to be spawned from devenv.exe while using @@ -67,18 +67,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_mshta_child_process.yml b/detections/endpoint/suspicious_mshta_child_process.yml index 95b4ff024d..6ad540e17b 100644 --- a/detections/endpoint/suspicious_mshta_child_process.yml +++ b/detections/endpoint/suspicious_mshta_child_process.yml @@ -5,7 +5,7 @@ date: '2021-01-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies child processes spawning from "mshta.exe". The search will return the first time and last time these command-line arguments were used for these executions, as well as the target system, the user, parent process @@ -70,13 +70,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.dest - - Processes.parent_process - - Processes.user risk_score: 40 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_mshta_spawn.yml b/detections/endpoint/suspicious_mshta_spawn.yml index fb276a88f8..232b041ac7 100644 --- a/detections/endpoint/suspicious_mshta_spawn.yml +++ b/detections/endpoint/suspicious_mshta_spawn.yml @@ -5,7 +5,7 @@ date: '2021-01-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies wmiprvse.exe spawning mshta.exe. This behavior is indicative of a DCOM object being utilized to spawn mshta from wmiprvse.exe or svchost.exe. In this instance, adversaries may use LethalHTA that will spawn @@ -61,18 +61,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml index 5edadd08ce..9c0bc559a5 100644 --- a/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml +++ b/detections/endpoint/suspicious_process_dns_query_known_abuse_web_services.yml @@ -4,8 +4,7 @@ version: 2 date: '2022-01-18' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic detects a suspicious process making a DNS query via known, abused text-paste web services, VoIP, instant messaging, and digital distribution platforms used to download external files. This technique is abused by adversaries, diff --git a/detections/endpoint/suspicious_process_file_path.yml b/detections/endpoint/suspicious_process_file_path.yml index ce259ece01..ea92e0eceb 100644 --- a/detections/endpoint/suspicious_process_file_path.yml +++ b/detections/endpoint/suspicious_process_file_path.yml @@ -5,7 +5,7 @@ date: '2021-05-05' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic will detect a suspicious process running in a file path where a process is not commonly seen and is most commonly used by malicious software. This behavior has been used by adversaries where they drop and run an @@ -65,14 +65,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_path - - Processes.dest - - Processes.user risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_process_with_discord_dns_query.yml b/detections/endpoint/suspicious_process_with_discord_dns_query.yml index 25b462deef..a47b1cf8f2 100644 --- a/detections/endpoint/suspicious_process_with_discord_dns_query.yml +++ b/detections/endpoint/suspicious_process_with_discord_dns_query.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-01-19' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This analytic identifies a process making a DNS query to Discord, a well known instant messaging and digital distribution platform. Discord can be abused by adversaries, as seen in the WhisperGate campaign, to host and download malicious. diff --git a/detections/endpoint/suspicious_reg_exe_process.yml b/detections/endpoint/suspicious_reg_exe_process.yml index fd7c536250..1b2ba1e920 100644 --- a/detections/endpoint/suspicious_reg_exe_process.yml +++ b/detections/endpoint/suspicious_reg_exe_process.yml @@ -5,7 +5,8 @@ date: '2020-07-22' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Processes description: This search looks for reg.exe being launched from a command prompt not started by the user. When a user launches cmd.exe, the parent process is usually explorer.exe. This search filters out those instances. @@ -68,14 +69,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.process_name - - Processes.user - - Processes.parent_process_name - - Processes.dest - - Processes.process_id - - Processes.parent_process_id risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml index 656aa2d5cb..c3405b7fe0 100644 --- a/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml +++ b/detections/endpoint/suspicious_regsvr32_register_suspicious_path.yml @@ -5,7 +5,7 @@ date: '2021-01-28' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Adversaries may abuse Regsvr32.exe to proxy execution of malicious code by using non-standard file extensions to load malciious DLLs. Upon investigating, look for network connections to remote destinations (internal or external). Review @@ -74,18 +74,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml index 19e3560a01..827b20cb7e 100644 --- a/detections/endpoint/suspicious_rundll32_dllregisterserver.yml +++ b/detections/endpoint/suspicious_rundll32_dllregisterserver.yml @@ -5,7 +5,7 @@ date: '2021-02-09' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe using dllregisterserver on the command line to load a DLL. When a DLL is registered, the DllRegisterServer method entry point in the DLL is invoked. This is typically seen when a DLL is being @@ -74,18 +74,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_rundll32_plugininit.yml b/detections/endpoint/suspicious_rundll32_plugininit.yml index b0ddab468c..ef44a1d3c0 100644 --- a/detections/endpoint/suspicious_rundll32_plugininit.yml +++ b/detections/endpoint/suspicious_rundll32_plugininit.yml @@ -5,7 +5,7 @@ date: '2021-07-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious rundll32.exe process with plugininit parameter. This technique is commonly seen in IceID malware to execute its initial dll stager to download another payload to the compromised machine. @@ -55,18 +55,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 42 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_rundll32_startw.yml b/detections/endpoint/suspicious_rundll32_startw.yml index c5e148e8c0..21df108fca 100644 --- a/detections/endpoint/suspicious_rundll32_startw.yml +++ b/detections/endpoint/suspicious_rundll32_startw.yml @@ -5,7 +5,7 @@ date: '2021-02-04' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe executing a DLL function name, Start and StartW, on the command line that is commonly observed with Cobalt Strike x86 and x64 DLL payloads. Rundll32.exe is natively found in C:\Windows\system32 @@ -75,18 +75,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml index ee2bce6a7c..cb593db328 100644 --- a/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_rundll32_with_no_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2021-09-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies rundll32.exe with no command line arguments. It is unusual for rundll32.exe to execute with no command line arguments present. This particular behavior is common with malicious software, including Cobalt Strike. @@ -73,18 +73,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml index c663f88758..561b59aa04 100644 --- a/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml +++ b/detections/endpoint/suspicious_scheduled_task_from_public_directory.yml @@ -5,7 +5,7 @@ date: '2021-03-01' author: Michael Haag, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Scheduled Tasks registering (creating a new task) a binary or script to run from a public directory which includes users\public, \programdata\ and \windows\temp. Upon triage, review the binary or script in the @@ -62,15 +62,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.parent_process_id risk_score: 35 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml index a804c6b96f..092b7ac379 100644 --- a/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml +++ b/detections/endpoint/suspicious_searchprotocolhost_no_command_line_arguments.yml @@ -5,7 +5,7 @@ date: '2021-09-20' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies searchprotocolhost.exe with no command line arguments. It is unusual for searchprotocolhost.exe to execute with no command line arguments present. This particular behavior is common with malicious software, @@ -60,18 +60,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml index 9bafa5a48c..4423f7d1f6 100644 --- a/detections/endpoint/suspicious_ticket_granting_ticket_request.yml +++ b/detections/endpoint/suspicious_ticket_granting_ticket_request.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-12-21' author: Mauricio Velazco, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: As part of the sAMAccountName Spoofing (CVE-2021-42278) and Domain Controller Impersonation (CVE-2021-42287) exploitation chain, adversaries will need to request a Kerberos Ticket Granting Ticket (TGT) on behalf of the newly created and renamed diff --git a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml index 977bc81441..f8b475d091 100644 --- a/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml +++ b/detections/endpoint/suspicious_wav_file_in_appdata_folder.yml @@ -5,7 +5,8 @@ date: '2021-09-21' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: This analytic is to detect a suspicious creation of .wav file in appdata folder. This behavior was seen in Remcos RAT malware where it put the audio recording in the appdata\audio folde as part of data collection. this recording can be send @@ -59,13 +60,22 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Processes.dest + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - dest - file_create_time - file_name - file_path + - process - process_name - process_path - - process risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/suspicious_wevtutil_usage.yml b/detections/endpoint/suspicious_wevtutil_usage.yml index ed1d109a7c..6d967dc390 100644 --- a/detections/endpoint/suspicious_wevtutil_usage.yml +++ b/detections/endpoint/suspicious_wevtutil_usage.yml @@ -5,7 +5,7 @@ date: '2021-10-11' author: David Dorsey, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The wevtutil.exe application is the windows event log utility. This searches for wevtutil.exe with parameters for clearing the application, security, setup, trace or system event logs. @@ -69,12 +69,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.process_name - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 28 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml index df4adae9be..60bab4d380 100644 --- a/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml +++ b/detections/endpoint/suspicious_writes_to_windows_recycle_bin.yml @@ -4,7 +4,9 @@ version: 4 date: '2020-07-22' author: Rico Valdez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint.Filesystem +- Endpoint.Processes description: This search detects writes to the recycle bin by a process other than explorer.exe. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -56,15 +58,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_id + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Filesystem.file_path - - Filesystem.file_name - - Filesystem.process_id - - Filesystem.dest - - Processes.user - - Processes.process_name - - Processes.parent_process_name - - Processes.process_id - - Processes.dest risk_score: 28 security_domain: endpoint diff --git a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml index e4ff7baa92..7541198ce2 100644 --- a/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/svchost_exe_lolbas_execution_process_spawn.yml @@ -5,7 +5,7 @@ date: '2021-11-22' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `svchost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Task Scheduler and creating a malicious remote scheduled task, the executed command is spawned @@ -64,17 +64,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 54 security_domain: endpoint diff --git a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml index 25f594ec14..37732ac215 100644 --- a/detections/endpoint/system_info_gathering_using_dxdiag_application.yml +++ b/detections/endpoint/system_info_gathering_using_dxdiag_application.yml @@ -5,7 +5,7 @@ date: '2021-11-19' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious dxdiag.exe process command-line execution. Dxdiag is used to collect the system info of the target host. This technique has been used by Remcos RATS, various actors, and other malware to collect information @@ -59,17 +59,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/system_information_discovery_detection.yml b/detections/endpoint/system_information_discovery_detection.yml index cba2897e4b..324d3b0e98 100644 --- a/detections/endpoint/system_information_discovery_detection.yml +++ b/detections/endpoint/system_information_discovery_detection.yml @@ -5,7 +5,7 @@ date: '2021-09-07' author: Patrick Bareiss, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Detect system information discovery techniques used by attackers to understand configurations of the system to further exploit it. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -59,11 +59,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.user - - Processes.process_name - - Processes.dest risk_score: 15 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/system_processes_run_from_unexpected_locations.yml b/detections/endpoint/system_processes_run_from_unexpected_locations.yml index 09b9bc2061..6e8ea9f806 100644 --- a/detections/endpoint/system_processes_run_from_unexpected_locations.yml +++ b/detections/endpoint/system_processes_run_from_unexpected_locations.yml @@ -5,7 +5,7 @@ date: '2020-12-08' author: David Dorsey, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'This search looks for system processes that typically execute from `C:\Windows\System32\` or `C:\Windows\SysWOW64`. This may indicate a malicious process that is trying to hide as a legitimate process.\ @@ -72,14 +72,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_hash + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path + - Endpoint.Processes.user - _time - - Processes.process_path - - Processes.user - - Processes.dest - - Processes.process_name - - Processes.process_id - - Processes.parent_process_name - - Processes.process_hash risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/system_user_discovery_with_query.yml b/detections/endpoint/system_user_discovery_with_query.yml index f5f1790f84..1b0d4e2656 100644 --- a/detections/endpoint/system_user_discovery_with_query.yml +++ b/detections/endpoint/system_user_discovery_with_query.yml @@ -5,7 +5,7 @@ date: '2021-09-13' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `query.exe` with command-line arguments utilized to discover the logged user. Red Teams and adversaries alike may leverage `query.exe` to identify system users on a compromised endpoint for @@ -49,17 +49,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/system_user_discovery_with_whoami.yml b/detections/endpoint/system_user_discovery_with_whoami.yml index 2091cb5a3d..5f8a7448a7 100644 --- a/detections/endpoint/system_user_discovery_with_whoami.yml +++ b/detections/endpoint/system_user_discovery_with_whoami.yml @@ -5,7 +5,7 @@ date: '2021-09-13' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `whoami.exe` without any arguments. This windows native binary prints out the current logged user. Red Teams and adversaries alike may leverage `whoami.exe` to identify system users on a compromised endpoint @@ -48,17 +48,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/time_provider_persistence_registry.yml b/detections/endpoint/time_provider_persistence_registry.yml index 42cbd1ab82..f1c4f3a888 100644 --- a/detections/endpoint/time_provider_persistence_registry.yml +++ b/detections/endpoint/time_provider_persistence_registry.yml @@ -5,7 +5,8 @@ date: '2022-01-26' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to detect a suspicious modification of time provider registry for persistence and autostart. This technique can allow the attacker to persist on the compromised host and autostart as soon as the machine boot up. This @@ -66,12 +67,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.dest - - Registry.user - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/trickbot_named_pipe.yml b/detections/endpoint/trickbot_named_pipe.yml index 29ba31c3c0..b50473a608 100644 --- a/detections/endpoint/trickbot_named_pipe.yml +++ b/detections/endpoint/trickbot_named_pipe.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-26' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search is to detect potential trickbot infection through the create/connected named pipe to the system. This technique is used by trickbot to communicate to its c2 to post or get command during infection. diff --git a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml index 6949009607..6a4fe5a9ea 100644 --- a/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml +++ b/detections/endpoint/uac_bypass_mmc_load_unsigned_dll.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-07-12' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a suspicious loaded unsigned dll by MMC.exe application. This technique is commonly seen in attacker that tries to bypassed UAC feature or gain privilege escalation. This is done by modifying some CLSID registry diff --git a/detections/endpoint/uac_bypass_with_colorui_com_object.yml b/detections/endpoint/uac_bypass_with_colorui_com_object.yml index 965e53bb2e..5513bf8cb2 100644 --- a/detections/endpoint/uac_bypass_with_colorui_com_object.yml +++ b/detections/endpoint/uac_bypass_with_colorui_com_object.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-08-13' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This search is to detect a possible uac bypass using the colorui.dll COM Object. this technique was seen in so many malware and ransomware like lockbit where it make use of the colorui.dll COM CLSID to bypass UAC. diff --git a/detections/endpoint/unified_messaging_service_spawning_a_process.yml b/detections/endpoint/unified_messaging_service_spawning_a_process.yml index 5cedb020fb..bb22fddbd3 100644 --- a/detections/endpoint/unified_messaging_service_spawning_a_process.yml +++ b/detections/endpoint/unified_messaging_service_spawning_a_process.yml @@ -5,7 +5,7 @@ date: '2021-03-02' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This detection identifies Microsoft Exchange Server's Unified Messaging services, umworkerprocess.exe and umservice.exe, spawning a child process, indicating possible exploitation of CVE-2021-26857 vulnerability. The query filters out werfault.exe @@ -61,14 +61,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.process_id - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/uninstall_app_using_msiexec.yml b/detections/endpoint/uninstall_app_using_msiexec.yml index 83fa05eb28..fe18bda78c 100644 --- a/detections/endpoint/uninstall_app_using_msiexec.yml +++ b/detections/endpoint/uninstall_app_using_msiexec.yml @@ -5,7 +5,7 @@ date: '2021-08-09' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious un-installation of application using msiexec. This technique was seen in conti leak tool and script where it tries to uninstall AV product using this commandline. This commandline to uninstall product @@ -54,15 +54,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process - - Processes.parent_process_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_id risk_score: 30 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/unload_sysmon_filter_driver.yml b/detections/endpoint/unload_sysmon_filter_driver.yml index 2327a5c01f..083319126a 100644 --- a/detections/endpoint/unload_sysmon_filter_driver.yml +++ b/detections/endpoint/unload_sysmon_filter_driver.yml @@ -5,7 +5,7 @@ date: '2020-07-22' author: Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: Attackers often disable security tools to avoid detection. This search looks for the usage of process `fltMC.exe` to unload a Sysmon Driver that will stop sysmon from collecting the data. @@ -56,13 +56,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 45 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml index a99d58f466..0bddcc846d 100644 --- a/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml +++ b/detections/endpoint/unusual_number_of_kerberos_service_tickets_requested.yml @@ -57,13 +57,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - EventCode - - Ticket_Options - - Ticket_Encryption_Type - - dest - - Service_Name - - service_id - Client_Address + - EventCode + - Service_Name + - Ticket_Encryption_Type + - _time risk_score: 36 security_domain: endpoint diff --git a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml index b7fef38a56..75b9d555cd 100644 --- a/detections/endpoint/user_discocvery_with_env_vars_powershell.yml +++ b/detections/endpoint/user_discocvery_with_env_vars_powershell.yml @@ -5,7 +5,7 @@ date: '2021-09-13' author: Mauricio Velazco, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `powershell.exe` with command-line arguments that leverage PowerShell environment variables to identify the current logged user. Red Teams and adversaries may leverage this method to identify the @@ -50,17 +50,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml index cfa68d3777..f387fb8767 100644 --- a/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml +++ b/detections/endpoint/user_discovery_with_env_vars_powershell_script_block.yml @@ -47,12 +47,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - Path - - Message - - OpCode - ComputerName - - User - EventCode + - Message + - User + - _time risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/usn_journal_deletion.yml b/detections/endpoint/usn_journal_deletion.yml index d02e6ba8a7..0a5e107d7d 100644 --- a/detections/endpoint/usn_journal_deletion.yml +++ b/detections/endpoint/usn_journal_deletion.yml @@ -5,7 +5,7 @@ date: '2018-12-03' author: David Dorsey, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The fsutil.exe application is a legitimate Windows utility used to perform tasks related to the file allocation table (FAT) and NTFS file systems. The update sequence number (USN) change journal provides a log of all changes made to the files @@ -61,13 +61,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - - Processes.parent_process_name - - Processes.dest risk_score: 45 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/vbscript_execution_using_wscript_app.yml b/detections/endpoint/vbscript_execution_using_wscript_app.yml index a80dd8e2b8..792518fb8b 100644 --- a/detections/endpoint/vbscript_execution_using_wscript_app.yml +++ b/detections/endpoint/vbscript_execution_using_wscript_app.yml @@ -5,7 +5,7 @@ date: '2021-10-01' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious wscript commandline to execute vbscript. This technique was seen in several malware to execute malicious vbs file using wscript application. commonly vbs script is associated to cscript process @@ -58,18 +58,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/verclsid_clsid_execution.yml b/detections/endpoint/verclsid_clsid_execution.yml index 103b742d69..5f85325225 100644 --- a/detections/endpoint/verclsid_clsid_execution.yml +++ b/detections/endpoint/verclsid_clsid_execution.yml @@ -5,7 +5,7 @@ date: '2021-09-29' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a possible abuse of verclsid to execute malicious file through generate CLSID. This process is a normal application of windows to verify the CLSID COM object before it is instantiated by Windows Explorer. This @@ -61,17 +61,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/w3wp_spawning_shell.yml b/detections/endpoint/w3wp_spawning_shell.yml index 850cdb5cb6..b16caaeb08 100644 --- a/detections/endpoint/w3wp_spawning_shell.yml +++ b/detections/endpoint/w3wp_spawning_shell.yml @@ -5,7 +5,7 @@ date: '2021-03-03' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This query identifies a shell, PowerShell.exe or Cmd.exe, spawning from W3WP.exe, or IIS. In addition to IIS logs, this behavior with an EDR product will capture potential webshell activity, similar to the HAFNIUM Group abusing CVEs, @@ -66,18 +66,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/wbadmin_delete_system_backups.yml b/detections/endpoint/wbadmin_delete_system_backups.yml index 6f5715c80a..b42d08fdaf 100644 --- a/detections/endpoint/wbadmin_delete_system_backups.yml +++ b/detections/endpoint/wbadmin_delete_system_backups.yml @@ -5,7 +5,7 @@ date: '2021-01-22' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search looks for flags passed to wbadmin.exe (Windows Backup Administrator Tool) that delete backup files. This is typically used by ransomware to prevent recovery. @@ -56,12 +56,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.parent_process_name - - Processes.dest - - Processes.user risk_score: 15 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/wbemprox_com_object_execution.yml b/detections/endpoint/wbemprox_com_object_execution.yml index 91f61b3952..13f5d02823 100644 --- a/detections/endpoint/wbemprox_com_object_execution.yml +++ b/detections/endpoint/wbemprox_com_object_execution.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-06-02' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search is designed to detect potential malicious process loading COM object to wbemprox.dll, search: '`sysmon` EventCode=7 ImageLoaded IN ("*\\fastprox.dll", "*\\wbemprox.dll", diff --git a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml index 4bd094af25..2495ddddd6 100644 --- a/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml +++ b/detections/endpoint/wermgr_process_connecting_to_ip_check_web_services.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search is designed to detect suspicious wermgr.exe process that tries to connect to known IP web services. This technique is know for trickbot and other trojan spy malware to recon the infected machine and look for its ip address diff --git a/detections/endpoint/wermgr_process_create_executable_file.yml b/detections/endpoint/wermgr_process_create_executable_file.yml index dbcd1ec45c..7a9fd59167 100644 --- a/detections/endpoint/wermgr_process_create_executable_file.yml +++ b/detections/endpoint/wermgr_process_create_executable_file.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-19' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: this search is designed to detect potential malicious wermgr.exe process that drops or create executable file. Since wermgr.exe is an application trigger when error encountered in a process, it is really un ussual to this process to drop diff --git a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml index 371cf2a000..7b5b9e10cd 100644 --- a/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml +++ b/detections/endpoint/wermgr_process_spawned_cmd_or_powershell_process.yml @@ -5,7 +5,7 @@ date: '2021-04-19' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is designed to detect suspicious cmd and powershell process spawned by wermgr.exe process. This suspicious behavior are commonly seen in code injection technique technique like trickbot to execute a shellcode, dll modules @@ -52,18 +52,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 56 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/wget_download_and_bash_execution.yml b/detections/endpoint/wget_download_and_bash_execution.yml index 4d1a88f5dc..8ab116d0da 100644 --- a/detections/endpoint/wget_download_and_bash_execution.yml +++ b/detections/endpoint/wget_download_and_bash_execution.yml @@ -5,7 +5,7 @@ date: '2021-12-11' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of wget on Linux or MacOS attempting to download a file from a remote source and pipe it to bash. This is typically found with coinminers and most recently with CVE-2021-44228, a vulnerability in Log4j. @@ -65,16 +65,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/windows_adfind_exe.yml b/detections/endpoint/windows_adfind_exe.yml index a4dd560dc1..4f77508f7b 100644 --- a/detections/endpoint/windows_adfind_exe.yml +++ b/detections/endpoint/windows_adfind_exe.yml @@ -5,7 +5,7 @@ date: '2021-11-03' author: Jose Hernandez, Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'This search looks for the execution of `adfind.exe` with command-line arguments that it uses by default. Specifically the filter or search functions. It also considers the arguments necessary like objectcategory, see readme for more @@ -49,14 +49,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Processes.dest - - Processes.user - - Processes.process_name - - Processes.parent_process - - Processes.process_id - - Processes.parent_process_id security_domain: endpoint supported_tas: - Splunk_TA_microsoft_sysmon diff --git a/detections/endpoint/windows_curl_download_to_suspicious_path.yml b/detections/endpoint/windows_curl_download_to_suspicious_path.yml index 5f9705d849..cdf3b0533c 100644 --- a/detections/endpoint/windows_curl_download_to_suspicious_path.yml +++ b/detections/endpoint/windows_curl_download_to_suspicious_path.yml @@ -5,7 +5,7 @@ date: '2021-10-19' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies the use of Windows Curl.exe downloading a file to a suspicious location. \ @@ -72,18 +72,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_curl_upload_to_remote_destination.yml b/detections/endpoint/windows_curl_upload_to_remote_destination.yml index 65afeffe87..e9b492b579 100644 --- a/detections/endpoint/windows_curl_upload_to_remote_destination.yml +++ b/detections/endpoint/windows_curl_upload_to_remote_destination.yml @@ -5,7 +5,7 @@ date: '2021-11-10' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies the use of Windows Curl.exe uploading a file to a remote destination. \ @@ -80,18 +80,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_defender_exclusion_registry_entry.yml b/detections/endpoint/windows_defender_exclusion_registry_entry.yml index f3a273dcc7..d592c7a17e 100644 --- a/detections/endpoint/windows_defender_exclusion_registry_entry.yml +++ b/detections/endpoint/windows_defender_exclusion_registry_entry.yml @@ -5,7 +5,8 @@ date: '2021-11-25' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic will detect a suspicious process that modify a registry related to windows defender exclusion feature. This registry is abused by adversaries, malware author and red teams to bypassed Windows Defender Anti-Virus product by @@ -66,13 +67,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name - - Registry.registry_value_data risk_score: 64 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_disable_memory_crash_dump.yml b/detections/endpoint/windows_disable_memory_crash_dump.yml index 8919734d8e..6e0fb74928 100644 --- a/detections/endpoint/windows_disable_memory_crash_dump.yml +++ b/detections/endpoint/windows_disable_memory_crash_dump.yml @@ -5,7 +5,8 @@ date: '2022-02-25' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: The following analytic identifies a process that is attempting to disable the ability on Windows to generate a memory crash dump. This was recently identified being utilized by HermeticWiper. To disable crash dumps, the value must be set to @@ -80,19 +81,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Filesystem.file_create_time - - Filesystem.process_id - - Filesystem.file_name - - Filesystem.user - - Filesystem.file_path - - Filesystem.dest - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid risk_score: 90 security_domain: endpoint diff --git a/detections/endpoint/windows_disableantispyware_reg.yml b/detections/endpoint/windows_disableantispyware_reg.yml index 62174a5077..f080e9860b 100644 --- a/detections/endpoint/windows_disableantispyware_reg.yml +++ b/detections/endpoint/windows_disableantispyware_reg.yml @@ -5,7 +5,7 @@ date: '2021-03-02' author: Rod Soto, Jose Hernandez, Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Registry description: The search looks for the Registry Key DisableAntiSpyware set to disable. This is consistent with Ryuk infections across a fleet of endpoints. This particular behavior is typically executed when an ransomware actor gains access to an endpoint @@ -60,12 +60,12 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Registry.dest + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest - - Registry.user - - Registry.registry_path risk_score: 24 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_diskcryptor_usage.yml b/detections/endpoint/windows_diskcryptor_usage.yml index 930e28b5db..0d2299b789 100644 --- a/detections/endpoint/windows_diskcryptor_usage.yml +++ b/detections/endpoint/windows_diskcryptor_usage.yml @@ -5,7 +5,7 @@ date: '2021-11-15' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies DiskCryptor process name of dcrypt.exe or internal name dcinst.exe. This utility has been utilized by adversaries to encrypt disks manually during an operation. In addition, during install, a dcrypt.sys driver @@ -67,17 +67,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 35 security_domain: endpoint diff --git a/detections/endpoint/windows_diskshadow_proxy_execution.yml b/detections/endpoint/windows_diskshadow_proxy_execution.yml index e14b14e20f..9b7a1f75c8 100644 --- a/detections/endpoint/windows_diskshadow_proxy_execution.yml +++ b/detections/endpoint/windows_diskshadow_proxy_execution.yml @@ -5,7 +5,7 @@ date: '2022-02-15' author: Lou Stella, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: DiskShadow.exe is a Microsoft Signed binary present on Windows Server. It has a scripting mode intended for complex scripted backup operations. This feature also allows for execution of arbitrary unsigned code. This analytic looks for the @@ -57,14 +57,13 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process - - Porcesses.dest - - Processes.user - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.parent_process_id - - Processes.original_file_name risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/windows_dism_remove_defender.yml b/detections/endpoint/windows_dism_remove_defender.yml index 9cc4c5bafe..ad638aa9ca 100644 --- a/detections/endpoint/windows_dism_remove_defender.yml +++ b/detections/endpoint/windows_dism_remove_defender.yml @@ -5,7 +5,7 @@ date: '2021-11-17' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of the Windows Disk Image Utility, `dism.exe`, to remove Windows Defender. Adversaries may use `dism.exe` to disable Defender before completing their objective. @@ -65,18 +65,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: access supported_tas: diff --git a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml index cb6ed79777..24211f4f78 100644 --- a/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml +++ b/detections/endpoint/windows_dotnet_binary_in_non_standard_path.yml @@ -5,7 +5,7 @@ date: '2022-01-19' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies native .net binaries within the Windows operating system that may be abused by adversaries by moving it to a new directory. The analytic identifies the .net binary by using a lookup and compares the process @@ -81,18 +81,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_event_for_service_disabled.yml b/detections/endpoint/windows_event_for_service_disabled.yml index 58405c141f..8795ebbe6f 100644 --- a/detections/endpoint/windows_event_for_service_disabled.yml +++ b/detections/endpoint/windows_event_for_service_disabled.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-02-23' author: Teoderick Contreras, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: This analytic will identify suspicious system event of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services to evade the defense diff --git a/detections/endpoint/windows_excessive_disabled_services_event.yml b/detections/endpoint/windows_excessive_disabled_services_event.yml index 35816e80a5..8105917a5c 100644 --- a/detections/endpoint/windows_excessive_disabled_services_event.yml +++ b/detections/endpoint/windows_excessive_disabled_services_event.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-02-23' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic will identify suspicious excessive number of system events of services that was modified from start to disabled. This technique is seen where the adversary attempts to disable security app services, other malware services diff --git a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml index 971856d53c..1a58b570bf 100644 --- a/detections/endpoint/windows_file_without_extension_in_critical_folder.yml +++ b/detections/endpoint/windows_file_without_extension_in_critical_folder.yml @@ -5,7 +5,8 @@ date: '2022-02-25' author: Teoderick Contreras, Bhavin Patel, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Filesystem +- Endpoint.Processes description: This analytic is to look for suspicious file creation in the critical folder like "System32\Drivers" folder without file extension. This artifacts was seen in latest hermeticwiper where it drops its driver component in Driver Directory @@ -62,16 +63,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Filesystem.dest + - Endpoint.Filesystem.file_create_time + - Endpoint.Filesystem.file_name + - Endpoint.Filesystem.file_path + - Endpoint.Filesystem.process_guid + - Endpoint.Filesystem.user + - Endpoint.Processes.dest + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Filesystem.file_create_time - - Filesystem.process_id - - Filesystem.file_name - - Filesystem.user - - Filesystem.file_path - - Filesystem.dest - - Processes.process_name - - Processes.dest - - Processes.process_guid - - Processes.user risk_score: 90 security_domain: endpoint diff --git a/detections/endpoint/windows_high_file_deletion_frequency.yml b/detections/endpoint/windows_high_file_deletion_frequency.yml index 046a58314f..ec2356d4a6 100644 --- a/detections/endpoint/windows_high_file_deletion_frequency.yml +++ b/detections/endpoint/windows_high_file_deletion_frequency.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-03-16' author: Teoderick Contreras type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This search looks for high frequency of file deletion relative to process name and process id. These events usually happen when the ransomware tries to encrypt the files with the ransomware file extensions and sysmon treat the original files diff --git a/detections/endpoint/windows_installutil_credential_theft.yml b/detections/endpoint/windows_installutil_credential_theft.yml index 3fb5c0f1e1..8cd2bba8c2 100644 --- a/detections/endpoint/windows_installutil_credential_theft.yml +++ b/detections/endpoint/windows_installutil_credential_theft.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-11-12' author: Michael Haag, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: 'The following analytic identifies the Windows InstallUtil.exe binary loading `vaultcli.dll` and Samlib.dll`. This technique may be used to execute code to bypassing application control and capture credentials by utilizing a tool like @@ -76,17 +75,6 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_installutil_in_non_standard_path.yml b/detections/endpoint/windows_installutil_in_non_standard_path.yml index 1179c42ae8..f86157ff3a 100644 --- a/detections/endpoint/windows_installutil_in_non_standard_path.yml +++ b/detections/endpoint/windows_installutil_in_non_standard_path.yml @@ -5,7 +5,7 @@ date: '2022-01-19' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the Windows binary InstallUtil.exe running from a non-standard location. The analytic utilizes a macro for InstallUtil and identifies both the process_name and original_file_name. @@ -76,18 +76,17 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_hash + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_installutil_remote_network_connection.yml b/detections/endpoint/windows_installutil_remote_network_connection.yml index 74868751a9..35296482d2 100644 --- a/detections/endpoint/windows_installutil_remote_network_connection.yml +++ b/detections/endpoint/windows_installutil_remote_network_connection.yml @@ -5,7 +5,8 @@ date: '2021-11-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Ports +- Endpoint.Processes description: 'The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control. \ @@ -80,20 +81,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Ports.dest + - Endpoint.Ports.dest_port + - Endpoint.Ports.process_guid + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - - Ports.process_guid - - Ports.dest - - Ports.dest_port risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/windows_installutil_uninstall_option.yml b/detections/endpoint/windows_installutil_uninstall_option.yml index 98a9002831..314ca9c18f 100644 --- a/detections/endpoint/windows_installutil_uninstall_option.yml +++ b/detections/endpoint/windows_installutil_uninstall_option.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies the Windows InstallUtil.exe binary. This will execute code while bypassing application control using the `/u` (uninstall) switch. \ @@ -82,18 +82,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml index 039a92f7d1..e18e036555 100644 --- a/detections/endpoint/windows_installutil_uninstall_option_with_network.yml +++ b/detections/endpoint/windows_installutil_uninstall_option_with_network.yml @@ -5,7 +5,8 @@ date: '2021-11-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Ports +- Endpoint.Processes description: 'The following analytic identifies the Windows InstallUtil.exe binary making a remote network connection. This technique may be used to download and execute code while bypassing application control using the `/u` (uninstall) switch. \ @@ -87,20 +88,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Ports.dest + - Endpoint.Ports.dest_port + - Endpoint.Ports.process_guid + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - - Ports.process_guid - - Ports.dest - - Ports.dest_port risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/windows_installutil_url_in_command_line.yml b/detections/endpoint/windows_installutil_url_in_command_line.yml index b6958ef7af..975ea9e040 100644 --- a/detections/endpoint/windows_installutil_url_in_command_line.yml +++ b/detections/endpoint/windows_installutil_url_in_command_line.yml @@ -5,7 +5,7 @@ date: '2021-11-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: 'The following analytic identifies the Windows InstallUtil.exe binary passing a HTTP request on the command-line. This technique may be used to download and execute code while bypassing application control. \ @@ -78,18 +78,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml index cfc476d77f..8cffa29a86 100644 --- a/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml +++ b/detections/endpoint/windows_modify_show_compress_color_and_info_tip_registry.yml @@ -5,7 +5,8 @@ date: '2022-03-02' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to look for suspicious registry modification related to file compression color and information tips. This IOC was seen in hermetic wiper where it has a thread that will create this registry entry to change the color of @@ -64,10 +65,19 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.registry_value_name - - Registry.dest Registry.user risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/windows_nirsoft_advancedrun.yml b/detections/endpoint/windows_nirsoft_advancedrun.yml index 15669cf7d5..fbf888c7a2 100644 --- a/detections/endpoint/windows_nirsoft_advancedrun.yml +++ b/detections/endpoint/windows_nirsoft_advancedrun.yml @@ -5,7 +5,7 @@ date: '2022-01-21' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of AdvancedRun.exe. AdvancedRun.exe has similar capabilities as other remote programs like psexec. AdvancedRun may also ingest a configuration file with all settings defined and perform its activity. @@ -69,18 +69,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 60 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_nirsoft_utilities.yml b/detections/endpoint/windows_nirsoft_utilities.yml index 1fd0c7eb76..4efe7f0565 100644 --- a/detections/endpoint/windows_nirsoft_utilities.yml +++ b/detections/endpoint/windows_nirsoft_utilities.yml @@ -5,7 +5,7 @@ date: '2022-01-24' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: The following hunting analytic assists with identifying the proces execution of commonly used utilities from NirSoft. Potentially not adversary behavior, but worth identifying to know if the software is present and being used. @@ -65,17 +65,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/windows_process_with_namedpipe_commandline.yml b/detections/endpoint/windows_process_with_namedpipe_commandline.yml index 5555c3942c..76b693166e 100644 --- a/detections/endpoint/windows_process_with_namedpipe_commandline.yml +++ b/detections/endpoint/windows_process_with_namedpipe_commandline.yml @@ -5,7 +5,7 @@ date: '2022-02-23' author: Teoderick Contreras, Splunk type: Anomaly datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for process commandline that contains named pipe. This technique was seen in some adversaries, threat actor and malware like olympic destroyer to communicate to its other child processes after process injection @@ -60,18 +60,18 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.parent_process_path + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - - Processes.process_guid risk_score: 49 security_domain: endpoint diff --git a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml index e442e6221c..f7d32f04b6 100644 --- a/detections/endpoint/windows_raccine_scheduled_task_deletion.yml +++ b/detections/endpoint/windows_raccine_scheduled_task_deletion.yml @@ -5,7 +5,7 @@ date: '2021-12-07' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the Raccine Rules Updater scheduled task being deleted. Adversaries may attempt to remove this task in order to prevent the update of Raccine. Raccine is a "ransomware vaccine" created by security researcher @@ -65,18 +65,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_rasautou_dll_execution.yml b/detections/endpoint/windows_rasautou_dll_execution.yml index 1478210a41..74a71931f8 100644 --- a/detections/endpoint/windows_rasautou_dll_execution.yml +++ b/detections/endpoint/windows_rasautou_dll_execution.yml @@ -5,7 +5,7 @@ date: '2022-02-15' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the Windows Windows Remote Auto Dialer, rasautou.exe executing an arbitrary DLL. This technique is used to execute arbitrary shellcode or DLLs via the rasautou.exe LOLBin capability. During triage, review @@ -64,17 +64,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml index 0ab9bf0c5b..34ec4e85fb 100644 --- a/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml +++ b/detections/endpoint/windows_raw_access_to_disk_volume_partition.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-02-25' author: Teoderick Contreras, Splunk type: Anomaly -datamodel: -- Endpoint +datamodel: [] description: This analytic is to look for suspicious raw access read to device disk partition of the host machine. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the boot sector of each partition diff --git a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml index 24a1beac4a..6db5511392 100644 --- a/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml +++ b/detections/endpoint/windows_raw_access_to_master_boot_record_drive.yml @@ -4,8 +4,7 @@ version: 1 date: '2022-02-17' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic is to look for suspicious raw access read to drive where the master boot record is placed. This technique was seen in several attacks by adversaries or threat actor to wipe, encrypt or overwrite the master boot record diff --git a/detections/endpoint/windows_remote_assistance_spawning_process.yml b/detections/endpoint/windows_remote_assistance_spawning_process.yml index 723eeca63c..aaaca39e14 100644 --- a/detections/endpoint/windows_remote_assistance_spawning_process.yml +++ b/detections/endpoint/windows_remote_assistance_spawning_process.yml @@ -5,7 +5,7 @@ date: '2022-02-07' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies the use of Microsoft Remote Assistance, msra.exe, spawning PowerShell.exe or cmd.exe as a child process. Msra.exe by default has no command-line arguments and typically spawns itself. It will generate a network @@ -61,17 +61,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/windows_schtasks_create_run_as_system.yml b/detections/endpoint/windows_schtasks_create_run_as_system.yml index aa37903127..96f26939a7 100644 --- a/detections/endpoint/windows_schtasks_create_run_as_system.yml +++ b/detections/endpoint/windows_schtasks_create_run_as_system.yml @@ -5,7 +5,7 @@ date: '2022-02-07' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies Schtasks.exe creating a new task to start and run as an elevated user - SYSTEM. This is commonly used by adversaries to spawn a process in an elevated state. @@ -58,17 +58,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 48 security_domain: endpoint diff --git a/detections/endpoint/windows_security_account_manager_stopped.yml b/detections/endpoint/windows_security_account_manager_stopped.yml index c1f89a9f2a..5ff1e20b4a 100644 --- a/detections/endpoint/windows_security_account_manager_stopped.yml +++ b/detections/endpoint/windows_security_account_manager_stopped.yml @@ -4,7 +4,8 @@ version: 1 date: '2020-11-06' author: Rod Soto, Jose Hernandez, Splunk type: TTP -datamodel: [] +datamodel: +- Endpoint.Processes description: The search looks for a Windows Security Account Manager (SAM) was stopped via command-line. This is consistent with Ryuk infections across a fleet of endpoints. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) @@ -61,10 +62,10 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.process + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.user risk_score: 70 security_domain: endpoint diff --git a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml index e7ee7f4898..cda0072b18 100644 --- a/detections/endpoint/windows_service_creation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_creation_on_remote_endpoint.yml @@ -5,7 +5,7 @@ date: '2021-11-10' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `sc.exe` with command-line arguments utilized to create a Windows Service on a remote endpoint. Red Teams and adversaries alike may abuse the Service Control Manager for lateral movement and remote code @@ -53,18 +53,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_service_creation_using_registry_entry.yml b/detections/endpoint/windows_service_creation_using_registry_entry.yml index d9f96b763b..fa6abaa8de 100644 --- a/detections/endpoint/windows_service_creation_using_registry_entry.yml +++ b/detections/endpoint/windows_service_creation_using_registry_entry.yml @@ -5,7 +5,8 @@ date: '2022-02-23' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This analytic is to look for suspicious modification or creation of registry to have service entry. This technique is abused by adversaries or threat actor to persist, gain privileges in the machine or even lateral movement. This technique @@ -68,18 +69,19 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_key_name - - Registry.registry_path - - Registry.user - - Registry.dest - - Registry.registry_value_name - - Processes.process_id - - Processes.process_name - - Processes.process - - Processes.dest - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_guid risk_score: 64 security_domain: endpoint diff --git a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml index fe79ffa24e..398fd2aa9a 100644 --- a/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml +++ b/detections/endpoint/windows_service_initiation_on_remote_endpoint.yml @@ -5,7 +5,7 @@ date: '2021-11-10' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic looks for the execution of `sc.exe` with command-line arguments utilized to start a Windows Service on a remote endpoint. Red Teams and adversaries alike may abuse the Service Control Manager for lateral movement and remote code @@ -51,18 +51,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/windows_wmi_process_call_create.yml b/detections/endpoint/windows_wmi_process_call_create.yml index c8d4f71a4d..730a2a3e4f 100644 --- a/detections/endpoint/windows_wmi_process_call_create.yml +++ b/detections/endpoint/windows_wmi_process_call_create.yml @@ -5,7 +5,7 @@ date: '2022-02-22' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to look for wmi commandlines to execute or create process. This technique was used by adversaries or threat actor to execute their malicious payload in local or remote host. This hunting query is a good pivot to start to @@ -62,18 +62,18 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.parent_process_path + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.process_path + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id - - Processes.process_guid risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml index 3f135b0e36..531cec81c3 100644 --- a/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml +++ b/detections/endpoint/winevent_scheduled_task_created_to_spawn_shell.yml @@ -77,10 +77,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Command + - Task_Name - _time - dest - - Task_Name - - Description - - Command risk_score: 70 security_domain: endpoint diff --git a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml index ff59f2304b..04477c3e63 100644 --- a/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml +++ b/detections/endpoint/winevent_scheduled_task_created_within_public_path.yml @@ -79,10 +79,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Command + - Task_Name - _time - dest - - Task_Name - - Description - - Command risk_score: 70 security_domain: endpoint diff --git a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml index 8b49efca42..e1f3dc6e0b 100644 --- a/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml +++ b/detections/endpoint/winevent_windows_task_scheduler_event_action_started.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-10-19' author: Michael Haag, Splunk type: Hunting -datamodel: -- Endpoint +datamodel: [] description: The following hunting analytic assists with identifying suspicious tasks that have been registered and ran in Windows using EventID 200 (action run) and 201 (action completed). It is recommended to filter based on ActionName by specifying @@ -55,10 +54,6 @@ tags: - Splunk Cloud required_fields: - _time - - TaskName - - ActionName - - EventID - dest - - ProcessID risk_score: 80 security_domain: endpoint diff --git a/detections/endpoint/winhlp32_spawning_a_process.yml b/detections/endpoint/winhlp32_spawning_a_process.yml index 94331c9531..42b217dc0e 100644 --- a/detections/endpoint/winhlp32_spawning_a_process.yml +++ b/detections/endpoint/winhlp32_spawning_a_process.yml @@ -5,7 +5,7 @@ date: '2021-10-05' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies winhlp32.exe, found natively in `c:\windows\`, spawning a child process that loads a file out of appdata, programdata, or temp. Winhlp32.exe has a rocky past in that multiple vulnerabilities were found and added @@ -72,18 +72,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/winword_spawning_cmd.yml b/detections/endpoint/winword_spawning_cmd.yml index 6edb916edb..292ef12ac2 100644 --- a/detections/endpoint/winword_spawning_cmd.yml +++ b/detections/endpoint/winword_spawning_cmd.yml @@ -5,7 +5,7 @@ date: '2021-04-22' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Microsoft Word spawning `cmd.exe`. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` @@ -65,18 +65,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 70 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/winword_spawning_powershell.yml b/detections/endpoint/winword_spawning_powershell.yml index 46c8cb7d5a..313637d549 100644 --- a/detections/endpoint/winword_spawning_powershell.yml +++ b/detections/endpoint/winword_spawning_powershell.yml @@ -5,7 +5,7 @@ date: '2021-04-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Microsoft Word spawning PowerShell. Typically, this is not common behavior and not default with winword.exe. Winword.exe will generally be found in the following path `C:\Program Files\Microsoft Office\root\Office16` @@ -67,18 +67,16 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 70 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/winword_spawning_windows_script_host.yml b/detections/endpoint/winword_spawning_windows_script_host.yml index 005936b001..dee31f18b1 100644 --- a/detections/endpoint/winword_spawning_windows_script_host.yml +++ b/detections/endpoint/winword_spawning_windows_script_host.yml @@ -5,7 +5,7 @@ date: '2021-04-12' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following detection identifies Microsoft Winword.exe spawning Windows Script Host - `cscript.exe` or `wscript.exe`. Typically, this is not common behavior and not default with Winword.exe. Winword.exe will generally be found in the following @@ -64,12 +64,20 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - process_name - - process_id - - parent_process_name - dest - - user - parent_process_id + - parent_process_name + - process_id + - process_name + - user risk_score: 70 security_domain: endpoint diff --git a/detections/endpoint/wmic_group_discovery.yml b/detections/endpoint/wmic_group_discovery.yml index 67ccbb4fcb..4c09439556 100644 --- a/detections/endpoint/wmic_group_discovery.yml +++ b/detections/endpoint/wmic_group_discovery.yml @@ -5,7 +5,7 @@ date: '2021-09-14' author: Michael Haag, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: 'The following hunting analytic identifies the use of `wmic.exe` enumerating local groups on the endpoint. \ @@ -60,17 +60,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 15 security_domain: endpoint diff --git a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml index 2f80fb1d75..c26a0f6bad 100644 --- a/detections/endpoint/wmic_noninteractive_app_uninstallation.yml +++ b/detections/endpoint/wmic_noninteractive_app_uninstallation.yml @@ -5,7 +5,7 @@ date: '2021-10-20' author: Teoderick Contreras, Splunk type: Hunting datamodel: -- Endpoint +- Endpoint.Processes description: This analytic is to detect a suspicious wmic commandlined that uninstall application non interactively. This technique was seen in IceID to uninstall av products to the compromised host to bypassed and evade detections. This Hunting @@ -63,17 +63,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 25 security_domain: endpoint diff --git a/detections/endpoint/wmic_xsl_execution_via_url.yml b/detections/endpoint/wmic_xsl_execution_via_url.yml index 06690c892a..c042ea3c73 100644 --- a/detections/endpoint/wmic_xsl_execution_via_url.yml +++ b/detections/endpoint/wmic_xsl_execution_via_url.yml @@ -5,7 +5,7 @@ date: '2021-11-11' author: Michael Haag, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `wmic.exe` loading a remote XSL (eXtensible Stylesheet Language) script. This originally was identified by Casey Smith, dubbed Squiblytwo, as an application control bypass. Many adversaries will utilize this @@ -70,18 +70,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.original_file_name + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 80 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml index 1460ebef98..1a048bede8 100644 --- a/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wmiprsve_exe_lolbas_execution_process_spawn.yml @@ -5,7 +5,7 @@ date: '2021-11-22' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `wmiprsve.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing Windows Management Instrumentation (WMI), the executed command is spawned as a child process of `wmiprvse.exe`. @@ -64,18 +64,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml index af04695147..6bb75086ab 100644 --- a/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml +++ b/detections/endpoint/wscript_or_cscript_suspicious_child_process.yml @@ -5,7 +5,7 @@ date: '2021-10-06' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This analytic identifies a suspicious spawned process by WScript or CScript process. This technique was a common technique used by adversaries and malware to execute different LOLBIN, other scripts like PowerShell or spawn a suspended process @@ -64,18 +64,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml index a459e91554..188c711ab3 100644 --- a/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml +++ b/detections/endpoint/wsmprovhost_exe_lolbas_execution_process_spawn.yml @@ -5,7 +5,7 @@ date: '2021-11-22' author: Mauricio Velazco, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: The following analytic identifies `Wsmprovhost.exe` spawning a LOLBAS execution process. When adversaries execute code on remote endpoints abusing the Windows Remote Management (WinRm) protocol, the executed command is spawned as a @@ -65,18 +65,15 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_id + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.dest - - Processes.user - - Processes.parent_process_name - - Processes.parent_process - - Processes.original_file_name - - Processes.process_name - - Processes.process - - Processes.process_id - - Processes.parent_process_path - - Processes.process_path - - Processes.parent_process_id risk_score: 54 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/wsreset_uac_bypass.yml b/detections/endpoint/wsreset_uac_bypass.yml index b436925676..c41fe22d36 100644 --- a/detections/endpoint/wsreset_uac_bypass.yml +++ b/detections/endpoint/wsreset_uac_bypass.yml @@ -5,7 +5,8 @@ date: '2020-01-28' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes +- Endpoint.Registry description: This search is to detect a suspicious modification of registry related to UAC bypass. This technique is to modify the registry in this detection, create a registry value with the path of the payload and run WSreset.exe to bypass User @@ -64,11 +65,21 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_guid + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Registry.dest + - Endpoint.Registry.process_guid + - Endpoint.Registry.registry_key_name + - Endpoint.Registry.registry_path + - Endpoint.Registry.registry_value_data + - Endpoint.Registry.registry_value_name + - Endpoint.Registry.user - _time - - Registry.registry_path - - Registry.registry_key_name - - Registry.registry_value_name - - Registry.dest risk_score: 63 security_domain: endpoint supported_tas: diff --git a/detections/endpoint/xmrig_driver_loaded.yml b/detections/endpoint/xmrig_driver_loaded.yml index acadcdf186..898fc4e5fb 100644 --- a/detections/endpoint/xmrig_driver_loaded.yml +++ b/detections/endpoint/xmrig_driver_loaded.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-29' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Endpoint +datamodel: [] description: This analytic identifies XMRIG coinminer driver installation on the system. The XMRIG driver name by default is `WinRing0x64.sys`. This cpu miner is an open source project that is commonly abused by adversaries to infect and mine bitcoin. diff --git a/detections/endpoint/xsl_script_execution_with_wmic.yml b/detections/endpoint/xsl_script_execution_with_wmic.yml index 0d1b86a632..4b642db4e2 100644 --- a/detections/endpoint/xsl_script_execution_with_wmic.yml +++ b/detections/endpoint/xsl_script_execution_with_wmic.yml @@ -5,7 +5,7 @@ date: '2021-09-13' author: Teoderick Contreras, Splunk type: TTP datamodel: -- Endpoint +- Endpoint.Processes description: This search is to detect a suspicious wmic.exe process or renamed wmic process to execute malicious xsl file. This technique was seen in FIN7 to execute its malicous jscript using the .xsl as the loader with the help of wmic.exe process. @@ -67,14 +67,14 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Endpoint.Processes.dest + - Endpoint.Processes.parent_process + - Endpoint.Processes.parent_process_name + - Endpoint.Processes.process + - Endpoint.Processes.process_id + - Endpoint.Processes.process_name + - Endpoint.Processes.user - _time - - Processes.parent_process_name - - Processes.parent_process - - Processes.process_name - - Processes.process_id - - Processes.process - - Processes.dest - - Processes.user risk_score: 49 security_domain: endpoint supported_tas: diff --git a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml index 7b385820f2..21b61395b5 100644 --- a/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml +++ b/detections/network/detect_hosts_connecting_to_dynamic_domain_providers.yml @@ -5,7 +5,7 @@ date: '2021-01-14' author: Bhavin Patel, Splunk type: TTP datamodel: -- Network_Resolution +- Network_Resolution.DNS description: Malicious actors often abuse legitimate Dynamic DNS services to host malicious payloads or interactive command and control nodes. Attackers will automate domain resolution changes by routing dynamic domains to countless IP addresses to @@ -13,8 +13,9 @@ description: Malicious actors often abuse legitimate Dynamic DNS services to hos analytic and investigative processes. This search will look for DNS queries made from within your infrastructure to suspicious dynamic domains. search: '| tstats `security_content_summariesonly` count values(DNS.answer) as answer - min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host | `drop_dm_object_name("DNS")` - | `security_content_ctime(firstTime)` | `dynamic_dns_providers` | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' + min(_time) as firstTime from datamodel=Network_Resolution.DNS by DNS.query host + | `drop_dm_object_name("DNS")` | `security_content_ctime(firstTime)` | `dynamic_dns_providers` + | `detect_hosts_connecting_to_dynamic_domain_providers_filter`' how_to_implement: 'First, you''ll need to ingest data from your DNS operations. This can be done by ingesting logs from your server or data, collected passively by Splunk Stream or a similar solution. Specifically, data that contains the domain that is @@ -91,9 +92,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Network_Resolution.DNS.answer + - Network_Resolution.DNS.query - _time - - DNS.answer - - DNS.query - host risk_score: 56 security_domain: network diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml index 97ca0cb956..57f0a8eb9c 100644 --- a/detections/network/detect_outbound_ldap_traffic.yml +++ b/detections/network/detect_outbound_ldap_traffic.yml @@ -5,7 +5,7 @@ date: '2021-12-13' author: Bhavin Patel, Johan Bjerke, Splunk type: Hunting datamodel: -- Network_Traffic +- Network_Traffic.All_Traffic description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall. This search will help determine @@ -70,9 +70,9 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Network_Traffic.All_Traffic.dest_ip + - Network_Traffic.All_Traffic.dest_port + - Network_Traffic.All_Traffic.src_ip - _time - - All_Traffic.dest_ip - - All_Traffic.dest_port - - All_Traffic.src_ip risk_score: 56 security_domain: network diff --git a/detections/network/dns_query_length_with_high_standard_deviation.yml b/detections/network/dns_query_length_with_high_standard_deviation.yml index 2474317aac..2ba090afaa 100644 --- a/detections/network/dns_query_length_with_high_standard_deviation.yml +++ b/detections/network/dns_query_length_with_high_standard_deviation.yml @@ -5,7 +5,7 @@ date: '2021-10-06' author: Bhavin Patel, Splunk type: Anomaly datamodel: -- Network_Resolution +- Network_Resolution.DNS description: This search allows you to identify DNS requests and compute the standard deviation on the length of the names being resolved, then filter on two times the standard deviation to show you those queries that are unusually large for your environment. @@ -62,8 +62,8 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - _time - - DNS.query + - Network_Resolution.DNS.message_type + - Network_Resolution.DNS.query risk_score: 56 security_domain: network supported_tas: diff --git a/detections/network/multiple_archive_files_http_post_traffic.yml b/detections/network/multiple_archive_files_http_post_traffic.yml index 5fb5ffc2ba..7d5495426e 100644 --- a/detections/network/multiple_archive_files_http_post_traffic.yml +++ b/detections/network/multiple_archive_files_http_post_traffic.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-21' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Network_Traffic +datamodel: [] description: This search is designed to detect high frequency of archive files data exfiltration through HTTP POST method protocol. This are one of the common techniques used by APT or trojan spy after doing the data collection like screenshot, recording, diff --git a/detections/network/plain_http_post_exfiltrated_data.yml b/detections/network/plain_http_post_exfiltrated_data.yml index 3716f34a17..60d044f7bc 100644 --- a/detections/network/plain_http_post_exfiltrated_data.yml +++ b/detections/network/plain_http_post_exfiltrated_data.yml @@ -4,8 +4,7 @@ version: 1 date: '2021-04-22' author: Teoderick Contreras, Splunk type: TTP -datamodel: -- Network_Traffic +datamodel: [] description: This search is to detect potential plain HTTP POST method data exfiltration. This network traffic is commonly used by trickbot, trojanspy, keylogger or APT adversary where arguments or commands are sent in plain text to the remote C2 server using diff --git a/detections/web/log4shell_jndi_payload_injection_attempt.yml b/detections/web/log4shell_jndi_payload_injection_attempt.yml index e7b549f675..49b356257e 100644 --- a/detections/web/log4shell_jndi_payload_injection_attempt.yml +++ b/detections/web/log4shell_jndi_payload_injection_attempt.yml @@ -5,7 +5,7 @@ date: '2021-12-13' author: Jose Hernandez type: Anomaly datamodel: -- Web +- Web.Web description: CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of the most common vectors injection is via Web calls. Many of the vulnerable java web applications that are using log4j have a web component to them are specially diff --git a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml index 0e781ffc20..935998659d 100644 --- a/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml +++ b/detections/web/log4shell_jndi_payload_injection_with_outbound_connection.yml @@ -5,8 +5,8 @@ date: '2021-12-13' author: Jose Hernandez type: Anomaly datamodel: -- Network_Traffic -- Web +- Network_Traffic.All_Traffic +- Web.Web description: CVE-2021-44228 Log4Shell payloads can be injected via various methods, but on of the most common vectors injection is via Web calls. Many of the vulnerable java web applications that are using log4j have a web component to them are specially @@ -69,6 +69,7 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: + - Network_Traffic.All_Traffic.dest - action - category - dest