diff --git a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml index 7ed08711ab..e1d432f72c 100644 --- a/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml +++ b/detections/endpoint/allow_inbound_traffic_by_firewall_rule_registry.yml @@ -8,8 +8,8 @@ datamodel: - Endpoint description: This analytic detects a potential suspicious modification of firewall rule registry allowing inbound traffic in specific port with public profile. This - technique was seen in some attacker want to have a remote access to a machine by - allowing the traffic in firewall rule. + technique was identified when an adversary wants to grant remote access to a machine by + allowing the traffic in a firewall rule. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Registry where Registry.registry_path= "*\\System\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\FirewallRules\\*" Registry.registry_value_name = "*|Action=Allow|*" Registry.registry_value_name = @@ -47,3 +47,20 @@ tags: - Registry.dest - Registry.user security_domain: endpoint + impact: 10 + confidence: 30 + # (impact * confidence)/100 + risk_score: 3 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: Suspicious firewall modifications were detected via the registry on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim diff --git a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml index 73acfefa3d..c79acb9f28 100644 --- a/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml +++ b/detections/endpoint/allow_inbound_traffic_in_firewall_rule.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: This search is to detect suspicious powershell command to allow inbound - traffic in specific local port with public profile. This technique was seen in some +description: The following analytic identifies suspicious PowerShell command to allow inbound + traffic inbound to a specific local port within the public profile. This technique was seen in some attacker want to have a remote access to a machine by allowing the traffic in firewall rule. search: '`powershell` EventCode=4104 Message = "*firewall*" Message = "*Public*" Message @@ -42,3 +42,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 10 + confidence: 30 + # (impact * confidence)/100 + risk_score: 3 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: Suspicious firewall modification detected on endpoint $ComputerName$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/allow_network_discovery_in_firewall.yml b/detections/endpoint/allow_network_discovery_in_firewall.yml index 50bfc8ebc3..c758e76a03 100644 --- a/detections/endpoint/allow_network_discovery_in_firewall.yml +++ b/detections/endpoint/allow_network_discovery_in_firewall.yml @@ -42,7 +42,6 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process - Processes.process_name - Processes.process - Processes.process_id diff --git a/detections/endpoint/allow_operation_with_consent_admin.yml b/detections/endpoint/allow_operation_with_consent_admin.yml index 0069987ef8..b1b4570d80 100644 --- a/detections/endpoint/allow_operation_with_consent_admin.yml +++ b/detections/endpoint/allow_operation_with_consent_admin.yml @@ -6,8 +6,8 @@ author: Teoderick Contreras, Splunk type: batch datamodel: - Endpoint -description: this search is to detect a potential privilege escalation attempt to - do malicious task. This registry modification is designed to allows the `Consent +description: This analytic identifies a potential privilege escalation attempt to + perform malicious task. This registry modification is designed to allow the `Consent Admin` to perform an operation that requires elevation without consent or credentials. We also found this in some attacker to gain privilege escalation to the compromise machine. @@ -48,3 +48,20 @@ tags: - Registry.registry_value_name - Registry.dest security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: Suspicious registry modification was performed on endpoint $dest$ by user $user$. This behavior is indicative of privilege escalation. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim diff --git a/detections/endpoint/anomalous_usage_of_7zip.yml b/detections/endpoint/anomalous_usage_of_7zip.yml index 4de347be93..49b07a5419 100644 --- a/detections/endpoint/anomalous_usage_of_7zip.yml +++ b/detections/endpoint/anomalous_usage_of_7zip.yml @@ -49,8 +49,33 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Collection + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior is indicative of suspicious loading of 7zip. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/any_powershell_downloadfile.yml b/detections/endpoint/any_powershell_downloadfile.yml index afe2f0cf0b..076aa6cec9 100644 --- a/detections/endpoint/any_powershell_downloadfile.yml +++ b/detections/endpoint/any_powershell_downloadfile.yml @@ -48,8 +48,33 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 70 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Exploitation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadFile within PowerShell. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/any_powershell_downloadstring.yml b/detections/endpoint/any_powershell_downloadstring.yml index 018246a866..9255afcad8 100644 --- a/detections/endpoint/any_powershell_downloadstring.yml +++ b/detections/endpoint/any_powershell_downloadstring.yml @@ -50,8 +50,26 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.process_id - Processes.parent_process_id security_domain: endpoint + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$. This behavior identifies the use of DownloadString within PowerShell. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml index cdcd32ec99..69876e3fcc 100644 --- a/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml +++ b/detections/endpoint/attempt_to_add_certificate_to_untrusted_store.yml @@ -9,8 +9,8 @@ datamodel: description: Attempt To Add Certificate To Untrusted Store search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=*certutil* - (Processes.process=*-addstore*) by Processes.parent_process Processes.process_name - Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + (Processes.process=*-addstore*) by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `attempt_to_add_certificate_to_untrusted_store_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be @@ -48,8 +48,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - - Processes.parent_process + - Processes.dest - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 50 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to add a certificate to the store on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/attempt_to_stop_security_service.yml b/detections/endpoint/attempt_to_stop_security_service.yml index 58eb55afba..0723ca36de 100644 --- a/detections/endpoint/attempt_to_stop_security_service.yml +++ b/detections/endpoint/attempt_to_stop_security_service.yml @@ -11,7 +11,8 @@ description: This search looks for attempts to stop security-related services on search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where (Processes.process_name = net.exe OR Processes.process_name = sc.exe) Processes.process="* - stop *" by Processes.process_name Processes.parent_process_name Processes.dest Processes.user + stop *" Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` |lookup security_services_lookup service as process OUTPUTNEW category, description | search category=security | `attempt_to_stop_security_service_filter`' @@ -56,8 +57,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - Processes.dest - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 40 + confidence: 50 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified attempting to disable security services on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml index 85d46564b4..e6ff7bc6da 100644 --- a/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml +++ b/detections/endpoint/attempted_credential_dump_from_registry_via_reg_exe.yml @@ -13,9 +13,10 @@ search: '| tstats `security_content_summariesonly` count min(_time) as firstTime OR Processes.process_name=cmd.exe) Processes.process=*save* (Processes.process=*HKEY_LOCAL_MACHINE\\Security* OR Processes.process=*HKEY_LOCAL_MACHINE\\SAM* OR Processes.process=*HKEY_LOCAL_MACHINE\\System* OR Processes.process=*HKLM\\Security* OR Processes.process=*HKLM\\System* OR Processes.process=*HKLM\\SAM*) - by Processes.user Processes.process_name Processes.process Processes.dest Processes.process_id + by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` - | `attempted_credential_dump_from_registry_via_reg_exe_filter`' + | `attempted_credential_dump_from_registry_via_reg_exe_filter`'` how_to_implement: You must be ingesting endpoint data that tracks process activity, including parent-child relationships from your endpoints, to populate the Endpoint data model in the Processes node. The command-line arguments are mapped to the "process" @@ -47,9 +48,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint - - \ No newline at end of file + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to export the registry keys. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/batch_file_write_to_system32.yml b/detections/endpoint/batch_file_write_to_system32.yml index c5ce575bf0..31e1684ef1 100644 --- a/detections/endpoint/batch_file_write_to_system32.yml +++ b/detections/endpoint/batch_file_write_to_system32.yml @@ -53,3 +53,24 @@ tags: - Filesystem.user - Filesystem.file_path security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Execution + message: A file - $file_name$ was written to system32 has occurred on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/bcdedit_failure_recovery_modification.yml b/detections/endpoint/bcdedit_failure_recovery_modification.yml index 0be4f6d694..957fc2aa21 100644 --- a/detections/endpoint/bcdedit_failure_recovery_modification.yml +++ b/detections/endpoint/bcdedit_failure_recovery_modification.yml @@ -49,3 +49,28 @@ tags: - Processes.dest - Processes.user security_domain: endpoint + impact: 100 + confidence: 80 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Impact + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting disable the ability to recover the endpoint. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/bits_job_persistence.yml b/detections/endpoint/bits_job_persistence.yml index e455aba1d1..a9841d6faf 100644 --- a/detections/endpoint/bits_job_persistence.yml +++ b/detections/endpoint/bits_job_persistence.yml @@ -48,8 +48,33 @@ tags: required_fields: - _time - Processes.process - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.user - Processes.dest security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to persist using BITS. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/bitsadmin_download_file.yml b/detections/endpoint/bitsadmin_download_file.yml index e63975b329..542c77c8cf 100644 --- a/detections/endpoint/bitsadmin_download_file.yml +++ b/detections/endpoint/bitsadmin_download_file.yml @@ -54,8 +54,33 @@ tags: required_fields: - _time - Processes.process - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.user - Processes.dest security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml index 2ec1788a60..35a698ab63 100644 --- a/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_urlcache_and_split_arguments.yml @@ -46,8 +46,33 @@ tags: required_fields: - _time - Processes.process - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.user - Processes.dest security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Command and Control + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml index 90045fc832..d524b6604f 100644 --- a/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml +++ b/detections/endpoint/certutil_download_with_verifyctl_and_split_arguments.yml @@ -47,8 +47,33 @@ tags: required_fields: - _time - Processes.process - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.user - Processes.dest security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Command and Control + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to download a file. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/certutil_exe_certificate_extraction.yml b/detections/endpoint/certutil_exe_certificate_extraction.yml index 22845c80ae..774a2dad24 100644 --- a/detections/endpoint/certutil_exe_certificate_extraction.yml +++ b/detections/endpoint/certutil_exe_certificate_extraction.yml @@ -11,8 +11,8 @@ description: This search looks for arguments to certutil.exe indicating the mani tokens specially inside Federated environments such as Windows ADFS. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime values(Processes.process) as process max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=certutil.exe - Processes.process = "* -exportPFX *" by Processes.parent_process Processes.process_name - Processes.process Processes.user | `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` + Processes.process = "* -exportPFX *" Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id| `drop_dm_object_name("Processes")` | `security_content_ctime(firstTime)` |`security_content_ctime(lastTime)` | `certutil_exe_certificate_extraction_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -37,8 +37,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - - Processes.parent_process + - Processes.dest - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 70 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting export a certificate. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/certutil_with_decode_argument.yml b/detections/endpoint/certutil_with_decode_argument.yml index 81bdeb67e5..7b5d59437d 100644 --- a/detections/endpoint/certutil_with_decode_argument.yml +++ b/detections/endpoint/certutil_with_decode_argument.yml @@ -47,10 +47,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint - + impact: 50 + confidence: 80 + # (impact * confidence)/100 + risk_score: 40 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to decode a file. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml index 6a30468691..9736412fb0 100644 --- a/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml +++ b/detections/endpoint/clear_unallocated_sector_using_cipher_app.yml @@ -39,7 +39,6 @@ tags: required_fields: - _time - Processes.parent_process_name - - Processes.parent_process - Processes.process_name - Processes.process - Processes.dest @@ -47,3 +46,28 @@ tags: - Processes.process_id - Processes.process_guid security_domain: endpoint + impact: 100 + confidence: 90 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Impact + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to clear the unallocated sectors of a specific disk. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process diff --git a/detections/endpoint/clop_common_exec_parameter.yml b/detections/endpoint/clop_common_exec_parameter.yml index d41a61113d..57118335c0 100644 --- a/detections/endpoint/clop_common_exec_parameter.yml +++ b/detections/endpoint/clop_common_exec_parameter.yml @@ -17,8 +17,8 @@ search: '| tstats `security_content_summariesonly` values(Processes.process) as values(Processes.parent_process_name) as parent_process values(Processes.process_name) count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name != "*temp.dat*" Processes.process = "*runrun*" OR Processes.process - = "*temp.dat*" by Processes.parent_process_name Processes.process_name Processes.process - Processes.dest Processes.user Processes.process_id Processes.process_guid | `drop_dm_object_name(Processes)` + = "*temp.dat*" by Processes.dest Processes.user Processes.parent_process Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `clop_common_exec_parameter_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -42,11 +42,37 @@ tags: - Splunk Enterprise Security - Splunk Cloud required_fields: - - Processes.process - - Processes.parent_process_name - _time - - Processes.process_name - Processes.dest - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 100 + confidence: 100 + # (impact * confidence)/100 + risk_score: 100 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting using arguments to execute its main code or feature of its code related to Clop ransomware. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/clop_ransomware_known_service_name.yml b/detections/endpoint/clop_ransomware_known_service_name.yml index 7dcf383e02..8924772b76 100644 --- a/detections/endpoint/clop_ransomware_known_service_name.yml +++ b/detections/endpoint/clop_ransomware_known_service_name.yml @@ -44,3 +44,28 @@ tags: - OriginalFileName - process_path security_domain: endpoint + impact: 100 + confidence: 100 + # (impact * confidence)/100 + risk_score: 100 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ executing known Clop Ransomware service names. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/cmd_echo_pipe___escalation.yml b/detections/endpoint/cmd_echo_pipe___escalation.yml index c1106006cd..ca34f22891 100644 --- a/detections/endpoint/cmd_echo_pipe___escalation.yml +++ b/detections/endpoint/cmd_echo_pipe___escalation.yml @@ -44,9 +44,34 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.process - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ potentially performing privilege escalation using named pipes related to Cobalt Strike and other frameworks. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml index e6c7b05114..69f9f39c6b 100644 --- a/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml +++ b/detections/endpoint/cmlua_or_cmstplua_uac_bypass.yml @@ -46,3 +46,24 @@ tags: - Signed - ProcessId security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following module $ImageLoaded$ was loaded by a non-standard application on endpoint $Computer$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Other + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/cobalt_strike_named_pipes.yml b/detections/endpoint/cobalt_strike_named_pipes.yml index 4ca9db964b..e474099af8 100644 --- a/detections/endpoint/cobalt_strike_named_pipes.yml +++ b/detections/endpoint/cobalt_strike_named_pipes.yml @@ -68,3 +68,24 @@ tags: - process_path - process_id security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $process_name$ was identified on endpoint $Computer$ by user $user$ accessing known suspicious named pipes related to Cobalt Strike. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Parent Process \ No newline at end of file diff --git a/detections/endpoint/common_ransomware_extensions.yml b/detections/endpoint/common_ransomware_extensions.yml index 2e0b65de31..2e47ea7e10 100644 --- a/detections/endpoint/common_ransomware_extensions.yml +++ b/detections/endpoint/common_ransomware_extensions.yml @@ -65,3 +65,25 @@ tags: - Filesystem.file_path - Filesystem.file_name security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Execution + Consequence: Data Destruction + message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware file extension and should be reviewed immediately. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/common_ransomware_notes.yml b/detections/endpoint/common_ransomware_notes.yml index f0fd2e002a..e7a3b33a00 100644 --- a/detections/endpoint/common_ransomware_notes.yml +++ b/detections/endpoint/common_ransomware_notes.yml @@ -51,3 +51,25 @@ tags: - Filesystem.file_path - Filesystem.file_name security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Execution + Consequence: Data Destruction + message: A file - $file_name$ was written to disk on endpoint $dest$ by user $user$, this is indicative of a known ransomware note file and should be reviewed immediately. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/conti_common_exec_parameter.yml b/detections/endpoint/conti_common_exec_parameter.yml index fcbca28a76..751e530bca 100644 --- a/detections/endpoint/conti_common_exec_parameter.yml +++ b/detections/endpoint/conti_common_exec_parameter.yml @@ -40,11 +40,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.parent_process_name - - Processes.parent_process - - Processes.dest Processes.user - Processes.process_id - - Processes.process_guid + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing specific Conti Ransomware related parameters. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml index 84f445454c..d5198c536e 100644 --- a/detections/endpoint/create_local_admin_accounts_using_net_exe.yml +++ b/detections/endpoint/create_local_admin_accounts_using_net_exe.yml @@ -46,9 +46,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 60 + # (impact * confidence)/100 + risk_score: 30 + context: + - Source:Endpoint + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to add a user to the local Administrators group. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml index e397763cf0..c9920c0bc2 100644 --- a/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml +++ b/detections/endpoint/create_or_delete_windows_shares_using_net_exe.yml @@ -45,9 +45,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.user - - Processes.parent_process - - Processs.process_name - - Processes.process - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Discovery + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ enumerating Windows file shares. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/create_remote_thread_into_lsass.yml b/detections/endpoint/create_remote_thread_into_lsass.yml index d2e325f42f..26829c725e 100644 --- a/detections/endpoint/create_remote_thread_into_lsass.yml +++ b/detections/endpoint/create_remote_thread_into_lsass.yml @@ -48,4 +48,22 @@ tags: - EventCode - TargetImage - TargetProcessId + - dest security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Credential Access + message: A process has created a remote thread into $TargetImage$ on $dest$. This behavior is indicative of credential dumping and should be investigated. + observable: + - name: TargetImage + type: Other + role: + - Other + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/create_service_in_suspicious_file_path.yml b/detections/endpoint/create_service_in_suspicious_file_path.yml index 8da97e16a6..38e78ee390 100644 --- a/detections/endpoint/create_service_in_suspicious_file_path.yml +++ b/detections/endpoint/create_service_in_suspicious_file_path.yml @@ -29,7 +29,6 @@ tags: kill_chain_phases: - Privilege Escalation mitre_attack_id: - - T1569.001 - T1569.002 product: - Splunk Enterprise @@ -43,3 +42,20 @@ tags: - Service_Name - Service_Start_Type security_domain: endpoint + impact: 70 + confidence: 80 + # (impact * confidence)/100 + risk_score: 56 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: A service $Service_File_Name$ was created from a non-standard path using $Service_Name$, potentially leading to a privilege escalation. + observable: + - name: Service_File_Name + type: Other + role: + - Other + - name: Service_Name + type: Other + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml index 97bc078628..5aafcb0286 100644 --- a/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml +++ b/detections/endpoint/creation_of_lsass_dump_with_taskmgr.yml @@ -6,7 +6,7 @@ author: Michael Haag, Splunk type: batch datamodel: [] description: Detect the hands on keyboard behavior of Windows Task Manager creating - a prcoess dump of lsass.exe. Upon this behavior occurring, a file write/modification + a process dump of lsass.exe. Upon this behavior occurring, a file write/modification will occur in the users profile under \AppData\Local\Temp. The dump file, lsass.dmp, cannot be renamed, however if the dump occurs more than once, it will be named lsass (2).dmp. @@ -54,3 +54,28 @@ tags: - Computer - object_category security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Credential Access + message: $process_name$ was identified on endpoint $Computer$ writing $TargetFilename$ to disk. This behavior is related to dumping credentials via Task Manager. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: TargetFilename + type: File Name + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/creation_of_shadow_copy.yml b/detections/endpoint/creation_of_shadow_copy.yml index 7b2fdfb622..58947aa0dd 100644 --- a/detections/endpoint/creation_of_shadow_copy.yml +++ b/detections/endpoint/creation_of_shadow_copy.yml @@ -45,11 +45,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name + - Processes.process_name + - Processes.process - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process diff --git a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml index a61e3fdb17..74a504a159 100644 --- a/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml +++ b/detections/endpoint/creation_of_shadow_copy_with_wmic_and_powershell.yml @@ -41,8 +41,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.user - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create a shadow copy to perform offline password cracking. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml index 7653ea932e..7ba2ca2f12 100644 --- a/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_copy_command_from_shadow_copy.yml @@ -48,7 +48,32 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to copy SAM and NTDS.dit for offline password cracking. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml index 3a7d2528de..1d855407e4 100644 --- a/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml +++ b/detections/endpoint/credential_dumping_via_symlink_to_shadow_copy.yml @@ -46,7 +46,32 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Credential Access + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to create symlink to a shadow copy to grab credentials. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/delete_shadowcopy_with_powershell.yml b/detections/endpoint/delete_shadowcopy_with_powershell.yml index 09d220b10c..3349a6a5ee 100644 --- a/detections/endpoint/delete_shadowcopy_with_powershell.yml +++ b/detections/endpoint/delete_shadowcopy_with_powershell.yml @@ -45,3 +45,20 @@ tags: - ComputerName - User security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Execution + message: An attempt to delete ShadowCopy was performed using PowerShell on $ComputerName$ by $User$. + observable: + - name: User + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/deleting_of_net_users.yml b/detections/endpoint/deleting_of_net_users.yml index 1518f92ff7..a34178f575 100644 --- a/detections/endpoint/deleting_of_net_users.yml +++ b/detections/endpoint/deleting_of_net_users.yml @@ -43,10 +43,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process_name - Processes.dest - Processes.user - Processes.parent_process_name + - Processes.process_name + - Processes.process - Processes.process_id - - Processes.parent_process + - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 50 + # (impact * confidence)/100 + risk_score: 25 + context: + - Source:Endpoint + - Stage:Persistence + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete accounts. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/deleting_shadow_copies.yml b/detections/endpoint/deleting_shadow_copies.yml index 4209216b6d..2a8fd61c13 100644 --- a/detections/endpoint/deleting_shadow_copies.yml +++ b/detections/endpoint/deleting_shadow_copies.yml @@ -51,10 +51,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.process_name + - Processes.dest - Processes.user - Processes.parent_process_name - - Processes.dest + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to delete shadow copies. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml index 27c04e1afd..7b2aedb501 100644 --- a/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml +++ b/detections/endpoint/detect_activity_related_to_pass_the_hash_attacks.yml @@ -50,3 +50,24 @@ tags: - user - dest security_domain: access + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the pass the hash technique. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: EventCode + type: Other + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/detect_azurehound_command_line_arguments.yml b/detections/endpoint/detect_azurehound_command_line_arguments.yml index f3112ae042..3bd539c907 100644 --- a/detections/endpoint/detect_azurehound_command_line_arguments.yml +++ b/detections/endpoint/detect_azurehound_command_line_arguments.yml @@ -47,9 +47,34 @@ tags: - _time - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_name - Processes.process - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Discovery + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ using AzureHound to enumerate AzureAD. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_azurehound_file_modifications.yml b/detections/endpoint/detect_azurehound_file_modifications.yml index 053214f054..1d18d9179e 100644 --- a/detections/endpoint/detect_azurehound_file_modifications.yml +++ b/detections/endpoint/detect_azurehound_file_modifications.yml @@ -54,3 +54,24 @@ tags: - process_id - file_create_time security_domain: endpoint + impact: 70 + confidence: 90 + # (impact * confidence)/100 + risk_score: 63 + context: + - Source:Endpoint + - Stage:Discovery + message: A file - $file_name$ was written to disk that is related to AzureHound, a AzureAD enumeration utility, has occurred on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml index 2cd5d2de88..982ccf9602 100644 --- a/detections/endpoint/detect_computer_changed_with_anonymous_account.yml +++ b/detections/endpoint/detect_computer_changed_with_anonymous_account.yml @@ -45,3 +45,24 @@ tags: - TargetDomainName - user security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Lateral Movement + message: The following $EventCode$ occurred on $dest$ by $user$ with Logon Type 3, which may be indicative of the an account or group being changed by an anonymous account. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: EventCode + type: Other + role: + - Other \ No newline at end of file diff --git a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml index 2c29b0c714..edc811df0d 100644 --- a/detections/endpoint/detect_credential_dumping_through_lsass_access.yml +++ b/detections/endpoint/detect_credential_dumping_through_lsass_access.yml @@ -58,3 +58,24 @@ tags: - TargetImage - TargetProcessId security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Credential Access + message: The $source_image$ has attempted access to read $TargetImage$ was identified on endpoint $Computer$, this is indicative of credential dumping and should be investigated. + observable: + - name: source_image + type: Other + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: TargetImage + type: Other + role: + - Victim diff --git a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml index 555c2368f6..9179dd63bb 100644 --- a/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_empire_with_powershell_script_block_logging.yml @@ -57,3 +57,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Execution + message: The following behavior was identified and typically related to PowerShell-Empire on $ComputerName$ by $User$. + observable: + - name: User + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml index 1c1581db8c..9e3b33b230 100644 --- a/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml +++ b/detections/endpoint/detect_excessive_account_lockouts_from_endpoint.yml @@ -56,3 +56,20 @@ tags: - All_Changes.result - All_Changes.dest security_domain: access + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Credential Access + message: Multiple accounts have been locked out. Review $dest$ and results related to $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim diff --git a/detections/endpoint/detect_excessive_user_account_lockouts.yml b/detections/endpoint/detect_excessive_user_account_lockouts.yml index 087893be3e..da873d1531 100644 --- a/detections/endpoint/detect_excessive_user_account_lockouts.yml +++ b/detections/endpoint/detect_excessive_user_account_lockouts.yml @@ -44,3 +44,20 @@ tags: - nodename - All_Changes.user security_domain: access + impact: 60 + confidence: 60 + # (impact * confidence)/100 + risk_score: 36 + context: + - Source:Endpoint + - Stage:Credential Access + message: Multiple accounts have been locked out. Review $nodename$ and $result$ related to $user$. + observable: + - name: user + type: User + role: + - Victim + - name: result + type: Other + role: + - Victim diff --git a/detections/endpoint/detect_exchange_web_shell.yml b/detections/endpoint/detect_exchange_web_shell.yml index 65c47b13d3..a782ceca40 100644 --- a/detections/endpoint/detect_exchange_web_shell.yml +++ b/detections/endpoint/detect_exchange_web_shell.yml @@ -53,3 +53,24 @@ tags: - Filesystem.file_hash - Filesystem.user security_domain: endpoint + impact: 90 + confidence: 90 + # (impact * confidence)/100 + risk_score: 81 + context: + - Source:Endpoint + - Stage:Exploitation + message: A file - $file_name$ was written to disk that is related to IIS exploitation previously performed by HAFNIUM. Review further file modifications on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: file_name + type: File Name + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_html_help_renamed.yml b/detections/endpoint/detect_html_help_renamed.yml index 80bb170475..23b0f2cf87 100644 --- a/detections/endpoint/detect_html_help_renamed.yml +++ b/detections/endpoint/detect_html_help_renamed.yml @@ -61,3 +61,28 @@ tags: - process_path - CommandLine security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_html_help_spawn_child_process.yml b/detections/endpoint/detect_html_help_spawn_child_process.yml index 979134d257..6bd84e594c 100644 --- a/detections/endpoint/detect_html_help_spawn_child_process.yml +++ b/detections/endpoint/detect_html_help_spawn_child_process.yml @@ -58,9 +58,33 @@ tags: - Processes.parent_process_name - Processes.dest - Processes.user - - Processes.parent_process - Processes.process_name - Processes.process - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_html_help_url_in_command_line.yml b/detections/endpoint/detect_html_help_url_in_command_line.yml index bf9083232f..509ac1f7a6 100644 --- a/detections/endpoint/detect_html_help_url_in_command_line.yml +++ b/detections/endpoint/detect_html_help_url_in_command_line.yml @@ -61,8 +61,32 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_id - Processes.parent_process_id security_domain: endpoint - + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_proces_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ contacting a remote destination to potentally download a malicious payload. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml index 484268fc4a..120de19ffa 100644 --- a/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml +++ b/detections/endpoint/detect_html_help_using_infotech_storage_handlers.yml @@ -63,6 +63,27 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_id security_domain: endpoint + impact: 80 + confidence: 90 + # (impact * confidence)/100 + risk_score: 72 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: $process_name$ has been identified using Infotech Storage Handlers to load a specific file within a CHM on $dest$ under user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_mimikatz_using_loaded_images.yml b/detections/endpoint/detect_mimikatz_using_loaded_images.yml index 567c7f6913..9535fda6e1 100644 --- a/detections/endpoint/detect_mimikatz_using_loaded_images.yml +++ b/detections/endpoint/detect_mimikatz_using_loaded_images.yml @@ -56,3 +56,28 @@ tags: - Computer - Image security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Credential Access + message: A process, $Image$, has loaded $ImageLoaded$ that are typically related to credential dumping on $Computer$. Review for further details. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: ImageLoaded + type: Parent Process + role: + - Other + - name: Image + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml index 029c7e1def..7e8214f39c 100644 --- a/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml +++ b/detections/endpoint/detect_mimikatz_with_powershell_script_block_logging.yml @@ -54,3 +54,20 @@ tags: - User - EventCode security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Credential Access + message: The following behavior was identified and typically related to MimiKatz being loaded within the context of PowerShell on $ComputerName$ by $User$. + observable: + - name: User + type: User + role: + - Victim + - name: ComputerName + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_mshta_inline_hta_execution.yml b/detections/endpoint/detect_mshta_inline_hta_execution.yml index cf0143c90f..041e009563 100644 --- a/detections/endpoint/detect_mshta_inline_hta_execution.yml +++ b/detections/endpoint/detect_mshta_inline_hta_execution.yml @@ -49,10 +49,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.user - - Processes.process_name - - Processes.parent_process_name - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 90 + confidence: 100 + # (impact * confidence)/100 + risk_score: 90 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ executing with inline HTA, indicative of defense evasion. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_mshta_renamed.yml b/detections/endpoint/detect_mshta_renamed.yml index 34972cca41..2a5cb2efb5 100644 --- a/detections/endpoint/detect_mshta_renamed.yml +++ b/detections/endpoint/detect_mshta_renamed.yml @@ -55,3 +55,28 @@ tags: - process_path - CommandLine security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_mshta_url_in_command_line.yml b/detections/endpoint/detect_mshta_url_in_command_line.yml index 26183d67d0..b702ab9549 100644 --- a/detections/endpoint/detect_mshta_url_in_command_line.yml +++ b/detections/endpoint/detect_mshta_url_in_command_line.yml @@ -50,9 +50,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $est$ by user $user$ attempting to access a remote destination to download an additional payload. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_new_local_admin_account.yml b/detections/endpoint/detect_new_local_admin_account.yml index 3475b05b9f..974714c678 100644 --- a/detections/endpoint/detect_new_local_admin_account.yml +++ b/detections/endpoint/detect_new_local_admin_account.yml @@ -48,4 +48,22 @@ tags: - Group_Name - member_id - dest + - user security_domain: access + impact: 60 + confidence: 70 + # (impact * confidence)/100 + risk_score: 42 + context: + - Source:Endpoint + - Stage:Persistence + message: A $user$ on $dest$ was added recently. Identify if this was legitimate behavior or not. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim \ No newline at end of file diff --git a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml index b330ccef74..e4047e134d 100644 --- a/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml +++ b/detections/endpoint/detect_path_interception_by_creation_of_program_exe.yml @@ -46,9 +46,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.parent_process_name + - Processes.dest - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Privilege Escalation + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to perform privilege escalation by using unquoted service paths. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml index cf874d103c..cd71643412 100644 --- a/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml +++ b/detections/endpoint/detect_processes_used_for_system_network_configuration_discovery.yml @@ -9,7 +9,7 @@ datamodel: description: This search looks for fast execution of processes used for system network configuration discovery on the endpoint. search: '| tstats `security_content_summariesonly` count values(Processes.process) - as process values(Processes.parent_process) as parent_process min(_time) as firstTime + as process values(Processes.parent_process_name) as parent_process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes by Processes.dest Processes.process_name Processes.user _time | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `drop_dm_object_name(Processes)` | search `system_network_configuration_discovery_tools` @@ -49,9 +49,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.parent_process - Processes.dest - - Processes.process_name - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 40 + confidence: 80 + # (impact * confidence)/100 + risk_score: 32 + context: + - Source:Endpoint + - Stage:Discovery + message: An instance of $parent_process_name$ spawning multiple $process_name$ was identified on endpoint $dest$ by user $user$ typically not a normal behavior of the process. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml index c75e68cbec..e31bcc913a 100644 --- a/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml +++ b/detections/endpoint/detect_prohibited_applications_spawning_cmd_exe.yml @@ -47,9 +47,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - - Processes.parent_process_name - Processes.dest - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running prohibited applications. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_psexec_with_accepteula_flag.yml b/detections/endpoint/detect_psexec_with_accepteula_flag.yml index 4853444bb1..99d82d4c47 100644 --- a/detections/endpoint/detect_psexec_with_accepteula_flag.yml +++ b/detections/endpoint/detect_psexec_with_accepteula_flag.yml @@ -16,8 +16,8 @@ description: This search looks for events where `PsExec.exe` is run with the `ac within the command line. search: '| tstats `security_content_summariesonly` values(Processes.process) as process min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes - where Processes.process=*psexec* Processes.process=*accepteula* by Processes.process_name - Processes.dest Processes.parent_process_name | `drop_dm_object_name(Processes)`| + where Processes.process=*psexec* Processes.process=*accepteula* Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)`| `security_content_ctime(firstTime)`| `security_content_ctime(lastTime)` | `detect_psexec_with_accepteula_flag_filter`' how_to_implement: You must be ingesting data that records process activity from your hosts to populate the Endpoint data model in the Processes node. You must also be @@ -55,8 +55,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - Processes.dest + - Processes.user - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Execution + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ running the utility for possibly the first time. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_rclone_command_line_usage.yml b/detections/endpoint/detect_rclone_command_line_usage.yml index af35807b1c..16d6865dbe 100644 --- a/detections/endpoint/detect_rclone_command_line_usage.yml +++ b/detections/endpoint/detect_rclone_command_line_usage.yml @@ -54,3 +54,28 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 50 + confidence: 70 + # (impact * confidence)/100 + risk_score: 35 + context: + - Source:Endpoint + - Stage:Exfiltration + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ attempting to connect to a remote cloud service to move files or folders. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regasm_spawning_a_process.yml b/detections/endpoint/detect_regasm_spawning_a_process.yml index b98d0fe9f8..c369f9d593 100644 --- a/detections/endpoint/detect_regasm_spawning_a_process.yml +++ b/detections/endpoint/detect_regasm_spawning_a_process.yml @@ -60,3 +60,28 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ spawning a child process, typically not normal behavior for $parent_process_name$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regasm_with_network_connection.yml b/detections/endpoint/detect_regasm_with_network_connection.yml index cb935b0f85..6c3e720c69 100644 --- a/detections/endpoint/detect_regasm_with_network_connection.yml +++ b/detections/endpoint/detect_regasm_with_network_connection.yml @@ -61,3 +61,24 @@ tags: - dest_host - dest_ip security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml index 37cce4746c..4acacf18cc 100644 --- a/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regasm_with_no_command_line_arguments.yml @@ -60,3 +60,28 @@ tags: - process_path - Computer security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The process $process_name$ was spawned by $parent_image$ without any command-line arguements on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_image + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process diff --git a/detections/endpoint/detect_regsvcs_spawning_a_process.yml b/detections/endpoint/detect_regsvcs_spawning_a_process.yml index 852c8379c1..c70806f735 100644 --- a/detections/endpoint/detect_regsvcs_spawning_a_process.yml +++ b/detections/endpoint/detect_regsvcs_spawning_a_process.yml @@ -60,3 +60,28 @@ tags: - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 80 + # (impact * confidence)/100 + risk_score: 64 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ was identified on endpoint $dest$ by user $user$ typically not normal for this process. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regsvcs_with_network_connection.yml b/detections/endpoint/detect_regsvcs_with_network_connection.yml index f58d167364..fa6e35b81f 100644 --- a/detections/endpoint/detect_regsvcs_with_network_connection.yml +++ b/detections/endpoint/detect_regsvcs_with_network_connection.yml @@ -60,3 +60,24 @@ tags: - src_ip - dest_host security_domain: Endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $process_name$ contacting a remote destination was identified on endpoint $Computer$ by user $user$. This behavior is not normal for $process_name$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index 47bbffd0a1..f97042c23e 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -61,3 +61,28 @@ tags: - process_path - Computer security_domain: endpoint + impact: 70 + confidence: 70 + # (impact * confidence)/100 + risk_score: 49 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: The process $process_name$ was spawned by $parent_image$ without any command-line arguements on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_image + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_regsvr32_application_control_bypass.yml b/detections/endpoint/detect_regsvr32_application_control_bypass.yml index 038b0495f4..50d6d4d7c4 100644 --- a/detections/endpoint/detect_regsvr32_application_control_bypass.yml +++ b/detections/endpoint/detect_regsvr32_application_control_bypass.yml @@ -60,7 +60,32 @@ tags: - Processes.process - Processes.dest - Processes.user - - Processes.parent_process + - Processes.parent_process_name - Processes.process_id - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ in an attempt to bypass detection and preventative controls was identified on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_renamed_7_zip.yml b/detections/endpoint/detect_renamed_7_zip.yml index 2e22aba088..8bbff4ae9e 100644 --- a/detections/endpoint/detect_renamed_7_zip.yml +++ b/detections/endpoint/detect_renamed_7_zip.yml @@ -47,3 +47,28 @@ tags: - CommandLine - Product security_domain: endpoint + impact: 30 + confidence: 90 + # (impact * confidence)/100 + risk_score: 27 + context: + - Source:Endpoint + - Stage:Collection + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_renamed_psexec.yml b/detections/endpoint/detect_renamed_psexec.yml index d66e0892fd..f0282c12ec 100644 --- a/detections/endpoint/detect_renamed_psexec.yml +++ b/detections/endpoint/detect_renamed_psexec.yml @@ -57,3 +57,28 @@ tags: - CommandLine - Product security_domain: endpoint + impact: 30 + confidence: 90 + # (impact * confidence)/100 + risk_score: 27 + context: + - Source:Endpoint + - Stage:Collection + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_renamed_rclone.yml b/detections/endpoint/detect_renamed_rclone.yml index 564bf81adb..f7e494eca1 100644 --- a/detections/endpoint/detect_renamed_rclone.yml +++ b/detections/endpoint/detect_renamed_rclone.yml @@ -50,3 +50,28 @@ tags: - CommandLine - dest security_domain: endpoint + impact: 30 + confidence: 90 + # (impact * confidence)/100 + risk_score: 27 + context: + - Source:Endpoint + - Stage:Collection + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_renamed_winrar.yml b/detections/endpoint/detect_renamed_winrar.yml index c769a95800..7a90d03aae 100644 --- a/detections/endpoint/detect_renamed_winrar.yml +++ b/detections/endpoint/detect_renamed_winrar.yml @@ -51,3 +51,28 @@ tags: - CommandLine - Product security_domain: endpoint + impact: 30 + confidence: 90 + # (impact * confidence)/100 + risk_score: 27 + context: + - Source:Endpoint + - Stage:Collection + message: The following $process_name$ has been identified as renamed, spawning from $parent_process_name$ on $dest$ by $user$. + observable: + - name: user + type: User + role: + - Victim + - name: dest + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml index ededc6777c..c881803914 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___advpack.yml @@ -17,8 +17,8 @@ description: The following analytic identifies rundll32.exe loading advpack.dll It's possible other files are on disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*advpack* by Processes.user Processes.process_name Processes.process - Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + Processes.process=*advpack* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___advpack_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -53,8 +53,36 @@ tags: - Splunk Cloud required_fields: - _time + - Processes.dest + - Processes.user + - Processes.parent_process_name - Processes.process_name - Processes.process - - Processes.user - - Processes.dest + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ loading advpack.dll and ieadvpack.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml index ef478ee546..3c18b96368 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___setupapi.yml @@ -17,8 +17,8 @@ description: The following analytic identifies rundll32.exe loading setupapi.dll It's possible other files are on disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*setupapi* by Processes.user Processes.process_name Processes.process - Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + Processes.process=*setupapi* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___setupapi_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -53,8 +53,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ loading setupapi.dll and iesetupapi.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml index 03925c4d56..38c9efcd55 100644 --- a/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml +++ b/detections/endpoint/detect_rundll32_application_control_bypass___syssetup.yml @@ -17,8 +17,8 @@ description: The following analytic identifies rundll32.exe loading syssetup.dll files are on disk. search: '| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where Processes.process_name=rundll32.exe - Processes.process=*syssetup* by Processes.user Processes.process_name Processes.process - Processes.dest | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` + Processes.process=*syssetup* by Processes.dest Processes.user Processes.parent_process_name Processes.process_name + Processes.process Processes.process_id Processes.parent_process_id | `drop_dm_object_name(Processes)` | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_rundll32_application_control_bypass___syssetup_filter`' how_to_implement: To successfully implement this search you need to be ingesting information on process that include the name of the process responsible for the changes from @@ -53,8 +53,36 @@ tags: - Splunk Cloud required_fields: - _time - - Processes.process - - Processes.process_name - - Processes.user - Processes.dest + - Processes.user + - Processes.parent_process_name + - Processes.process_name + - Processes.process + - Processes.process_id + - Processes.parent_process_id security_domain: endpoint + impact: 80 + confidence: 100 + # (impact * confidence)/100 + risk_score: 80 + context: + - Source:Endpoint + - Stage:Defense Evasion + message: An instance of $parent_process_name$ spawning $process_name$ loading syssetup.dll by calling the LaunchINFSection function on the command line was identified on endpoint $dest$ by user $user$. + observable: + - name: user + type: User + role: + - Victim + - name: Computer + type: Hostname + role: + - Victim + - name: parent_process_name + type: Parent Process + role: + - Parent Process + - name: process_name + type: Process + role: + - Child Process \ No newline at end of file diff --git a/detections/endpoint/detect_rundll32_inline_hta_execution.yml b/detections/endpoint/detect_rundll32_inline_hta_execution.yml index ce66139a91..66ef2445cc 100644 --- a/detections/endpoint/detect_rundll32_inline_hta_execution.yml +++ b/detections/endpoint/detect_rundll32_inline_hta_execution.yml @@ -63,9 +63,11 @@ tags: confidence: 80 risk_score: 56 context: - - Source: Endpoint - - Stage: Initial Access, Execution, Defense Evasion - message: Suspicious rundll32.exe inline HTA execution on $dest + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion + message: Suspicious rundll32.exe inline HTA execution on $dest$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/detect_sharphound_command_line_arguments.yml b/detections/endpoint/detect_sharphound_command_line_arguments.yml index bf28befed0..1193cc70c4 100644 --- a/detections/endpoint/detect_sharphound_command_line_arguments.yml +++ b/detections/endpoint/detect_sharphound_command_line_arguments.yml @@ -61,9 +61,9 @@ tags: confidence: 80 risk_score: 24 context: - - Source: Endpoint - - Stage: Discovery - message: Possible SharpHound command-Line arguments identified on $dest + - Source:Endpoint + - Stage:Discovery + message: Possible SharpHound command-Line arguments identified on $dest$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/detect_sharphound_file_modifications.yml b/detections/endpoint/detect_sharphound_file_modifications.yml index ee47e1240d..056b832c2b 100644 --- a/detections/endpoint/detect_sharphound_file_modifications.yml +++ b/detections/endpoint/detect_sharphound_file_modifications.yml @@ -69,9 +69,9 @@ tags: confidence: 80 risk_score: 24 context: - - Source: Endpoint - - Stage: Discovery - message: Potential SharpHound file modifications identified on $dest + - Source:Endpoint + - Stage:Discovery + message: Potential SharpHound file modifications identified on $dest$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/detect_sharphound_usage.yml b/detections/endpoint/detect_sharphound_usage.yml index 98a57763f0..5a1a51c969 100644 --- a/detections/endpoint/detect_sharphound_usage.yml +++ b/detections/endpoint/detect_sharphound_usage.yml @@ -65,9 +65,9 @@ tags: confidence: 80 risk_score: 24 context: - - Source: Endpoint - - Stage: Discovery - message: Potential SharpHound binary identified on $dest + - Source:Endpoint + - Stage:Discovery + message: Potential SharpHound binary identified on $dest$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml index 060d4c7c41..bf3385df95 100644 --- a/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml +++ b/detections/endpoint/detect_use_of_cmd_exe_to_launch_script_interpreters.yml @@ -56,9 +56,11 @@ tags: confidence: 50 risk_score: 35 context: - - Source: Endpoint - - Stage: Initial Access, Execution, Defense Evasion - message: cmd.exe launching script interpreters on $dest + - Source:Endpoint + - Stage:Initial Access + - Stage:Execution + - Stage:Defense Evasion + message: cmd.exe launching script interpreters on $dest$ observable: - name: dest type: Endpoint diff --git a/detections/endpoint/detect_wmi_event_subscription_persistence.yml b/detections/endpoint/detect_wmi_event_subscription_persistence.yml index 24428f7ef9..96540dfef4 100644 --- a/detections/endpoint/detect_wmi_event_subscription_persistence.yml +++ b/detections/endpoint/detect_wmi_event_subscription_persistence.yml @@ -59,9 +59,10 @@ tags: confidence: 90 risk_score: 63 context: - - Source: Endpoint - - Stage: Persistence, Privilege Escalation - message: Possible malicious WMI Subscription created on $dest + - Source:Endpoint + - Stage:Persistence + - Stage:Privilege Escalation + message: Possible malicious WMI Subscription created on $dest$ observable: - name: dest type: Endpoint