From 71313ccfb42cb6d8fa34ded78385ab481db07253 Mon Sep 17 00:00:00 2001
From: patel-bhavin <bhavin.j.patel91@gmail.com>
Date: Mon, 13 Dec 2021 12:38:38 -0800
Subject: [PATCH] first version of ldap

---
 .../network/detect_outbound_ldap_traffic.yml  | 70 +++++++++++++++++++
 1 file changed, 70 insertions(+)
 create mode 100644 detections/network/detect_outbound_ldap_traffic.yml

diff --git a/detections/network/detect_outbound_ldap_traffic.yml b/detections/network/detect_outbound_ldap_traffic.yml
new file mode 100644
index 0000000000..cb286ebc26
--- /dev/null
+++ b/detections/network/detect_outbound_ldap_traffic.yml
@@ -0,0 +1,70 @@
+name: Detect Outbound LDAP Traffic
+id: c77162d3-f91c-45cc-80c8-22f6v546119f
+version: 3
+date: '2021-12-13'
+author: Bhavin Patel, Johan Bjerke, Splunk
+type: Hunting
+datamodel:
+- Network_Traffic
+description: Malicious actors often abuse misconfigured LDAP servers or applications that use the LDAP servers in organizations. Outbound LDAP traffic should not be allowed outbound through your perimeter firewall.  This search will help determine if you have any LDAP connections to IP addresses outside of private (RFC1918) address space.
+search: '| tstats earliest(_time) as earliest_time latest(_time) as latest_time values(All_Traffic.dest_ip) as dest_ip from datamodel=Network_Traffic.All_Traffic where All_Traffic.dest_port = 389 OR All_Traffic.dest_port = 636 AND NOT (All_Traffic.dest_ip = 10.0.0.0/8 OR All_Traffic.dest_ip=192.168.0.0/16 OR All_Traffic.dest_ip = 172.16.0.0/12) by All_Traffic.src_ip |`drop_dm_object_name("All_Traffic")` | where src_ip != dest_ip
+| `security_content_ctime(latest_time)`  | `security_content_ctime(earliest_time)`| `detect_outbound_ldap_traffic`'
+how_to_implement: 'You must be ingesting Zeek DNS and Zeek Conn data into Splunk. Zeek
+  data should also be getting ingested in JSON format and should be mapped to the The
+  Network Resolution and Network Traffic datamodels are in use for this search.'
+known_false_positives: 
+references: 
+  - https://www.govcert.ch/blog/zero-day-exploit-targeting-popular-java-library-log4j/
+tags:
+  analytic_story:
+  - Data Protection
+  - Prohibited Traffic Allowed or Protocol Mismatch
+  - DNS Hijacking
+  - Suspicious DNS Traffic
+  - Dynamic DNS
+  - Command and Control
+  asset_type: Endpoint
+  automated_detection_testing: passed
+  cis20:
+  - CIS 8
+  - CIS 12
+  - CIS 13
+  confidence: 80
+  context:
+  - source:endpoint
+  - stage: Initial Access
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1189/dyn_dns_site/windows-sysmon.log
+  impact: 70
+  kill_chain_phases:
+  - Command and Control
+  - Actions on Objectives
+  message: A dns query $query$ from your infra connecting to suspicious domain in
+    host  $host$
+  mitre_attack_id:
+  - T1189
+  nist:
+  - PR.DS
+  - PR.PT
+  - DE.AE
+  - DE.CM
+  observable:
+  - name: host
+    type: Hostname
+    role:
+    - Victim
+  - name: query
+    type: dnsquery
+    role:
+    - Attacker
+  product:
+  - Splunk Enterprise
+  - Splunk Enterprise Security
+  - Splunk Cloud
+  required_fields:
+  - _time
+  - DNS.answer
+  - DNS.query
+  - host
+  risk_score: 56
+  security_domain: network